Walkie Desk for Windows updates

Walkie Desk for Windows updates itself, securely, without interrupting anyone who is working. This page explains how it works, how to postpone or turn off updates and how to verify a release.

Automatic updates arrive with an upcoming version of Walkie Desk for Windows. Until then the tray app lets you know when a new version is out, and you can install it from the Download page. The settings described here apply from that version.

How it works

Automatic and on by default. You don’t need to do anything: Walkie Desk checks for a new version and installs it on its own.
Signed twice. Every update is signed with a Walkie Desk release key, kept off our servers, and the installer carries the iDev srl digital signature. Walkie Desk installs an update only if both signatures are valid: not even someone who took control of our servers could, on their own, make it install a different program.
Never during a session. An update never closes a session in progress: it waits until nobody is connected. Windows does not need to restart and whoever is working at the PC is not interrupted.
Automatic rollback. If the new version does not start correctly after the update, Walkie Desk goes back to the previous version on its own and reports it in the tray app.
For everyone, regardless of the licence. Updates are delivered with the Personal plan and with an expired licence too, at no cost.

There are two kinds of updates: security updates, which fix vulnerabilities and are installed as soon as possible, and feature updates, with new features and improvements. Every security fix is described in the security advisories. QuickSupport is not updated: it is downloaded from the website every time, so it is always the latest version.

Postponing an update

If an update comes at a bad time, an administrator of the PC can postpone it from the tray app, “Updates” page, with “Postpone by 1 day”. It can be postponed several times, up to:

Feature updates: 7 days in total
Security updates: 3 days in total
Version no longer supported: no postponing: with updates turned on, the update is installed as soon as there are no sessions in progress

People using the PC without administrator rights see the update status but cannot postpone it. With “Update now” an administrator can install it straight away, still never during a session.

Choosing “Security only” or turning them off

An administrator of the PC can choose between three settings:

Automatic (recommended, default): both security and feature updates are installed
Security only: only security updates are installed on their own; for new features the app lets you know and you decide when to install them
Off: nothing is installed automatically (read the consequences first)

You can change the setting in four ways.

From the tray app

Click the Walkie Desk icon in the taskbar and open the main window.
Go to the “Updates” page.
Under “Automatic updates” choose “Automatic”, “Security only” or “Off”. Windows asks for an administrator’s confirmation.
If you choose “Off”, the app shows you the consequences and asks you to confirm.

From the command line

Open a command prompt as administrator and type:

"C:\Program Files\WalkieDesk\wd-host-service.exe" --updates off

Instead of off you can type security (Security only) or auto (Automatic). With --status you see the setting in force and the update status.

In a silent installation

For company deployments the setup accepts the /UPDATES= parameter with the same values:

WalkieDesk-Setup-<version>.exe /S /UPDATES=off

Without the parameter, the setting already in force on the PC does not change.

With a group policy

To manage many PCs, set in the registry, with Group Policy or with another management tool, the key HKLM\SOFTWARE\Policies\WalkieDesk with the string value (REG_SZ) Updates equal to off, security or auto. For example, from a command prompt as administrator:

reg add "HKLM\SOFTWARE\Policies\WalkieDesk" /v Updates /t REG_SZ /d off /f

The group policy takes precedence over the app: the setting appears locked, with the note “Set by your organization’s administrator”. An invalid value is ignored. An administrative template (ADMX) for the Group Policy Editor will come later.

Maintenance window (optional)

You can set a time range, in local time, in which feature updates are installed: for example at night, from 02:00 to 05:00. From the app, on the “Updates” page; from the command line with --update-window 02:00-05:00 (--update-window none to remove it); with a group policy with the string value UpdateWindow in the HH:MM-HH:MM format:

reg add "HKLM\SOFTWARE\Policies\WalkieDesk" /v UpdateWindow /t REG_SZ /d 02:00-05:00 /f

Security updates use the window when they can, but if the wait gets long they are installed outside the window too, still never during a session. If the PC is off during that range, the update waits for the next one.

Turning updates back on

From the app: “Updates” page, “Turn on again”, or choose “Automatic”.
From the command line: "C:\Program Files\WalkieDesk\wd-host-service.exe" --updates auto.
If you turned them off with a group policy, remove the value (or set auto):
reg delete "HKLM\SOFTWARE\Policies\WalkieDesk" /v Updates /f

Once they are back on, Walkie Desk installs the latest version at the first chance without sessions in progress.

What happens if you turn them off

The PC no longer receives Walkie Desk security fixes, not even those for serious vulnerabilities.
A permanent notice reminds you of this in the tray app on the PC and in the account owner’s user area.
When security fixes come out that the PC does not have, its version becomes “not supported”, and this too is shown as a notice. Connecting to the PC remains possible, with a warning, so that a technician can get in precisely to update it.

Turn updates off only if the PC receives Walkie Desk in another way, for example through your organization’s deployment system, and install the versions with security fixes as soon as they come out anyway. With updates turned off, protecting the PC from already fixed vulnerabilities depends on whoever manages it.

Support period

During the beta: only the latest version receives fixes
From the launch: each version receives security fixes until 12 months after the next version is released; the product is supported for at least 5 years from the launch
End of support: not set yet

The end-of-support date (month and year) will be given here and in the tray app once it is set: today it is not known yet.

Verifying a release

Anyone can check that a setup is exactly the one we released. Next to every setup, in the same download folder, we publish a WalkieDesk-Setup-<version>.release.json file: the release manifest, signed with the Walkie Desk release key (WD-RELEASE-v1 format). The first manifests will be published together with the first automatic update.

The manifest is a small JSON file with two fields: canonical, a 14-line text with product, platform, channel, version, update kind, minimum version, file name, size in bytes, SHA-256 hash, issue and expiry dates, notes page and key identifier; sig, the ECDSA P-256 with SHA-256 signature of that text (64 bytes in base64url).

The file hash. Compute the SHA-256 of the setup and compare it with the tenth line of canonical, which is in base64url (not hexadecimal). In PowerShell:

$f = (Resolve-Path .\WalkieDesk-Setup-<version>.exe).Path
$h = [Security.Cryptography.SHA256]::Create().ComputeHash([IO.File]::ReadAllBytes($f))
[Convert]::ToBase64String($h).TrimEnd('=').Replace('+','-').Replace('/','_')

Also check that the file name and size match.

The manifest signature. Verify sig over the canonical text with the public release key published on this page; the last line of canonical must be that key’s identifier. The Walkie Desk tool runs all the checks with one command:
```
wd-release verify --manifest WalkieDesk-Setup-<version>.release.json --setup WalkieDesk-Setup-<version>.exe
```
The digital signature of the setup. In File Explorer: right-click the file, Properties, Digital Signatures: the publisher must be iDev srl (how to check it).

Public release key: its fingerprint will be published here before the first automatic update.

Previous versions

We keep the setups of the security updates already published available for download, with their manifest, for those who cannot install the latest version.

Unsupported version: use it only if you cannot install the latest one.

No security updates published so far.