Software update distribution techniques are disclosed. Authentication information is received, from a content source authenticator, by an update agent included in a client device. The authentication information comprises a list of a plurality of content sources, wherein the plurality of content sources have been verified by the content source authenticator as being authentic content sources for legitimate software applications. The update agent selects a first content source of the plurality of content sources, where the first content source is configured to provide updates for a first software application. The update agent checks the first content source for updates for the first software application.