Bulk installation and updates for admins

This article is for IT teams who want to deploy Pulse through a device management tool. It explains how automatic updates work, which distribution source to use if you manage the package yourself, and what to allow on your network.

At present we do not offer documented deployment support for individual tools such as Jamf, Kandji, Omnissa Workspace ONE, FleetDM or WinGet. What we recommend is installing the app in a state where it can update itself. If you nonetheless need to pin the package on your side, use the installer retrieval steps in the second half of this article.

#How automatic updates work

On most users' machines Pulse keeps itself on the latest version. While the desktop app is running it checks for updates roughly every ten minutes. If there is one, it downloads it in the background and applies it either when the app can safely restart or when the user chooses to install it.

#What automatic updates require

• macOS: it must be installed in the Applications folder, and the signed-in macOS user must have permission to replace the Pulse app bundle.
• Windows: the default installer installs per user. Automatic updates work most reliably when the app is installed somewhere the signed-in Windows user can write to.
• Both: the machine must be able to reach the update-check and download endpoints.

If MDM policy, an OS restriction, or an all-users installation leaves the signed-in user unable to update the app, automatic updates may not work. In that case, use the installer sources and version-check endpoint below and manage updates from the IT side.

#Getting the latest installer

The following sources always return the latest public installer and need no authentication.

Both return a redirect to the actual file. Configure whatever tool you download with to follow redirects.

curl -L -o installer.dmg https://api.the-unchain.com/v1/download-latest

curl -L -o installer.exe https://api.the-unchain.com/v1/download-latest-windows

#Allowing network traffic

If your corporate network restricts outbound destinations, allow traffic to these two:

• the API host (api.the-unchain.com)
• the CDN host that serves the installer itself — the host the sources above redirect to.

You can obtain the actual CDN hostname with the redirect-check command below. For narrowing down problems when traffic goes through a corporate proxy or TLS inspection appliance, see Network and allowlists.

#Getting a version-pinned URL

Package managers such as WinGet and FleetDM usually need an installer URL that does not change, along with a matching SHA256 hash. The “latest” sources above always redirect to the current version, so the resolved URL changes with every release.

To pin to a specific release, fetch just the redirect target without downloading the installer.

curl -sI -o /dev/null -w '%{redirect_url}' "https://api.the-unchain.com/v1/download-latest"

curl -sI -o /dev/null -w '%{redirect_url}' "https://api.the-unchain.com/v1/download-latest-windows"

What comes back is a URL in this form:

https://<CDN host>/7.205.1/Pulse-7.205.1-win-x64.exe

That URL is fixed for a given version and stays valid after later releases. If you want to look at the redirect header directly:

curl -sI "https://api.the-unchain.com/v1/download-latest-windows" | grep -i location

#Steps for package managers

1. 1

   Detect a new release

   Poll the version-check endpoint described below and watch whether the value of production has changed.

2. 2

   Get the version-pinned URL

   When a new version appears, fetch the redirect target from the “latest” source above and note that version-pinned URL.

3. 3

   Calculate the hash

   Download the installer from the URL you noted and calculate its SHA256 hash.

4. 4

   Update the manifest

   Update your package manifest with the new URL and hash.

You can calculate the hash with:

sha256sum Pulse-7.205.1-win-x64.exe

In PowerShell:

Get-FileHash .\Pulse-7.205.1-win-x64.exe -Algorithm SHA256

#Checking whether a new version is out

Use the public version-check endpoint. No authentication is needed.

curl -s https://api.the-unchain.com/v1/get-versions

The response takes this form:

{
  "production": "7.205.0",
  "beta": "7.205.0"
}

For managed deployment, compare the value of production with the version you currently distribute. You can poll this endpoint at whatever interval suits you — daily, weekly, or otherwise.production changes, fetch the new installer for each operating system you support.beta is the early-access channel. For letting individual users opt into pre-release builds, see Profile and preferences.

#What each user still has to do after deployment

Even when your organisation handles installation, the following still has to be done on each user's machine. Including it in your rollout notice will cut down on support requests.

• signing in with a Google or Microsoft account, and connecting a calendar
• granting microphone and screen recording (system audio capture) permission on macOS
• granting microphone permission on Windows

The steps are in the First-time setup guide. Note that whether macOS privacy permissions can be pre-granted from your device management tool depends on the tool and the OS version. Check your management tool's own documentation to see whether pre-granting is possible in your configuration.

#Related articles