Controlling updates

When the app updates itself

The app can only update itself if it is allowed to replace its own installation. With the MSI that is not the case: it installs for all users of the device into C:\Program Files, where a standard user cannot write. A self-update would therefore not replace the managed installation, it would create a second copy inside the user profile.

The app detects this and turns automatic updates off. At startup it checks:

1. Does the program live in C:\Program Files (Windows) or in an application bundle the signed-in user cannot write to (macOS)?
2. Has an administrator disabled updates by policy?

If either applies, the app never checks for new versions and the update button does not appear. Rolling out new versions is then entirely up to you.

On the Mac this comes down to how tightly you lock /Applications. If the application bundle stays writable for the signed-in user, the app keeps itself up to date even when you deployed it through an MDM. If you want to control the timing anyway, set the policy in the next section.

An app started straight from the opened DMG or from the Downloads folder does not count as managed. It offers the update, cannot install it from there, and asks the user to move DeutschlandGPT into the Applications folder.

Disabling automatic updates by policy

This policy applies regardless of the installation location, so it also covers an installation inside the user profile.

Windows. Value DisableAutoUpdate (REG_DWORD) under HKEY_LOCAL_MACHINE\SOFTWARE\Policies\DeutschlandGPT. 1 disables updates, 0 or a missing value allows them. The same path under HKEY_CURRENT_USER is read as well, in case you want the policy to apply to individual users only.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\DeutschlandGPT]
"DisableAutoUpdate"=dword:00000001

Deploy it as a registry preference in a group policy, or as a PowerShell script in Intune:

New-Item -Path 'HKLM:\SOFTWARE\Policies\DeutschlandGPT' -Force | Out-Null
New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\DeutschlandGPT' `
  -Name 'DisableAutoUpdate' -PropertyType DWord -Value 1 -Force | Out-Null

macOS. Create the file /Library/Application Support/DeutschlandGPT/managed-config.json. It deliberately sits outside the user profile so that only administrative processes and MDM payloads can write it.

{
  "disableAutoUpdate": true
}

The policy is read when the app starts, so a change takes effect on the next launch.

Enforcing automatic updates by policy

This policy turns the previous one around: the app no longer waits for anyone to agree. It downloads a new signed build in the background on every operating system, including Windows, where it otherwise waits for a click. It then shows a window that cannot be dismissed, counts down 60 seconds and installs. There is no "later" and no cancel. The only button shortens the wait, and it reads "restart now".

Those 60 seconds exist so that nobody loses a sentence they are typing. They are not a consent step: when they elapse the installation runs, whether or not anyone is at the machine. Installing restarts the app, like any other restart.

If the installation fails, for example because the download drops, the app tries again after 30 minutes. After three failed attempts it stops until the next start. If it cannot replace the application bundle at all, it stops right away. The regular update button stays available either way.

Windows. Value ForceAutoUpdate (REG_DWORD) under HKEY_LOCAL_MACHINE\SOFTWARE\Policies\DeutschlandGPT, the same key as DisableAutoUpdate. 1 enforces updates, 0 or a missing value leaves the timing to the user as before. A string value (REG_SZ) containing 1 is accepted as well. The same path under HKEY_CURRENT_USER is read here too.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\DeutschlandGPT]
"ForceAutoUpdate"=dword:00000001

Deploy it again as a registry preference in a group policy, or as a PowerShell script in Intune:

New-Item -Path 'HKLM:\SOFTWARE\Policies\DeutschlandGPT' -Force | Out-Null
New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\DeutschlandGPT' `
  -Name 'ForceAutoUpdate' -PropertyType DWord -Value 1 -Force | Out-Null

macOS. Put the same key into /Library/Application Support/DeutschlandGPT/managed-config.json. Both policies live in one file:

{
  "disableAutoUpdate": false,
  "forceAutoUpdate": true
}

For enforced updates on Windows that means: deploy the per-user installer -setup.exe (NSIS), in user context through Intune, and set ForceAutoUpdate. If you stay with the MSI, keep distributing new versions yourself. The condition for that is the version endpoint in Detecting new versions.

On Linux the policy is not read, just like DisableAutoUpdate. It applies on Windows and macOS only, and it is read when the app starts.

What users see

With updates switched off and the installed version still supported, nothing changes: the app works normally, it simply stops offering to install updates.

When a version should be replaced, the app goes through three stages.

Notice. When a newer recommended version exists, a quiet notice appears in the sidebar. If the app may update itself, it is an update button. On a managed installation it says that your IT distributes the new version.

Deadline. When a minimum version is announced with a cut-off date, the app shows a notice at the top with the date and the required version. It can be hidden for the day. During the last three days before the cut-off it appears on every start. On a managed installation it contains a link to the matching installer and a "Copy details for IT" button, which puts the installed and required version, the cut-off date, the operating system and the link on the clipboard. The linked file follows the installation: the MSI for an installation under C:\Program Files, the -setup.exe for an installation inside the user profile, the DMG on the Mac and the AppImage for the machine's own CPU architecture on Linux. For an installation from DEB or RPM the link leads to the downloads page, because the app cannot tell which package format was used.

Block. From the cut-off date the app shows a window that cannot be dismissed. If the app may update itself, the button in it leads straight to a matching version and work continues afterwards. Managed installations (MSI, an app bundle deployed via MDM, DEB, RPM, updates switched off) and devices whose network blocks updates are not blocked along with them. They keep the notice, which can then no longer be hidden, and can keep working. They are only blocked if a separate, later cut-off date for managed installations is set. We agree that date with you beforehand.

Besides the minimum version, individual versions can also be asked to update, for example when only one specific version contains a bug. The app then shows the same notice with the reason. Other versions are not affected.

Everything is set per operating system, so for Windows, macOS and Linux independently. A build with nothing configured is not asked to update.

If no published version meets the requirement yet, the app does not block. It shows the notice with a download link and the option to check again.

Detecting new versions

To find out whether a newer version exists without a JSON parser, use the version endpoint:

curl -fsL https://www.deutschlandgpt.de/api/desktop/version/windows-msi

That works well as a condition in a scheduled task, an Intune script or a Jamf extension attribute. The full list of stable URLs is in the overview.

Network

Updates use their own addresses, which have to be allowed separately from the running app. The full list is on Network requirements.