Agents

Agent updates

Agents update themselves when the server offers a new build. The offer is signed, and the agent checks the download before it swaps.

Behind

When you update the server it builds new agents too. A device whose agent differs from the server's build says behind on its page and in the list.

Updating

• One device: Update agent on its page. Each step shows: waiting for check-in, installing, or failed with the agent's reason.
• All of them: Update all, in the Devices list's Agent updates dialog.
• On a schedule, in the same dialog: when I ask, as soon as there's a new build, or nightly at an hour.

Agents don't update or move while they're running a job. You need the Manage devices privilege.

How it works

1. A report's response carries a manifest signed with the server's key, naming the new build's SHA-256.
2. The agent checks the signature against the key it pinned at enrollment, downloads the build and checks its hash.
3. It swaps its own binary (on Windows it renames the running one to .old first) and exits, and the service manager starts the new one.

Agents enrolled before the server had a signing key have to be installed again once.