Citrix VDA Upgrade Orchestrator v1.0.1

v1.0.1 — Documentation patch on top of v1.0.0

This is a documentation-only patch on top of v1.0.0. The VDA update orchestrator code, runtime behavior, security guarantees, recovery semantics, and supported matrix are unchanged. The only differences are additional German-language equivalents and a one-clause privacy clarification.

Public repository

• https://github.com/flathack/Citrix-VDA-Upgrade-Automation

Source provenance

• Extracted and generalized from flathack/MyScripts at Citrix/VDA-Update/VDA-Update-Orchestrator-v2.ps1
• Source commit: 0a1132e63eea4964a97be15b910646e8822b272e
• Original-file SHA-256: 45297974198d37b31077675f798bafb85615363096766df86c0e8b893f8d118c

Immutable candidate bound to this release

• Git tree: ec52c2f3a2fdb24780a7186be54fc1e842a80382
• Manifest fingerprint SHA-256: 5d3db7650e482e6a4edcec5788ef10d5ef12c00740953a9d63951be671030aa1
• Per-file SHA-256 fingerprints are pinned in the Windows-side candidate verifier.
• This is an additive documentation patch over v1.0.0 (f9a060adc1f90008db41c2ed77f18c0f37224113, fingerprint d9cc85e67e25e5cf40a08af082c759ecba83b7236bbc959b95ec66137dfb22cf). The verifier confirms the eight public files match this candidate's manifest fingerprint.

What changed since v1.0.0

• README.md now contains a German-langsection equivalents of the existing English content under the existing "License and trademarks" section. The German translation mirrors the English Highlights, Requirements, Quick start, Actions, Runtime evidence, Configuration and privacy, Source provenance, Tests, and License and trademarks sections verbatim, with identical code paths, configuration keys, supported matrix, and provenance citations.
• docs/ADMINISTRATOR-GUIDE.md now contains a German runbook equivalent of the existing English guide. The German translation mirrors the English sections verbatim, with identical code paths, configuration keys, supported matrix, recovery sequence, and provenance citation.
• Both documents receive an explicit "no telemetry, no external update check, no credential scan" sentence under the configuration/privacy narrative, to make the local-only behavior unambiguous.
• Code bytes are unchanged from v1.0.0. The orchestrator script, tests/VDA-Update-Orchestrator.Tests.ps1, tests/Windows-Security.Tests.ps1, and vda-update.config.example.psd1 retain their v1.0.0 SHA-256 hashes.

Security highlights (unchanged from v1.0.0)

• The fixed runtime root is established under C:\ProgramData\Citrix-VDA-Update and is hardened to SYSTEM and local Administrators only.
• The orchestrator inherits reparse-point rejection at the runtime root and its ancestors and rejects any pre-existing mutable directory handle before trusting the namespace.
• A separate WRITE_DAC | WRITE_OWNER probe with FILE_SHARE_NONE rejects any pre-existing DACL-control capability on the runtime root before the namespace-freezing guard is enabled.
• A retained Task namespace guard binds scheduled-task artifact creation, registration, post-registration logging, start, and SYSTEM child acknowledgement; failure anywhere in that window triggers exact-ownership disable, stop, unregister, and absence verification before the guard is released.
• Cached Citrix launchers are validated through a retained no-follow directory chain, a no-follow no-write/no-delete read handle, exact approved publisher identity, and immediate ACL/owner escalation-capability rejection.
• The fixed PVS remnants path is destroyed through a no-follow ancestor chain, retained no-follow no-write/delete handles, and bottom-up SetFileInformationByHandle(FileDispositionInfo) — never a path-based recursive delete.
• Supported only on Windows 10/11 single-session workstation or Remote PC VDA deployments. Windows Server and multi-session VDA deployments are explicitly out of scope.

Behavior contracts (unchanged from v1.0.0)

• #< + integer constant, $true, $false are the only allowed literal forms; coercive casts, computed keys, and AST subexpressions are rejected.
• The literal engine path uses PowerShell 5.1 and PowerShell 7.4; the AST allowlist is verified across both engines.
• The same-boot AwaitingReboot path is idempotent and does not reschedule shutdown or consume another reboot attempt.
• Terminal Completed and Failed states require a verified disabled task before they are reported.

Supported matrix (unchanged from v1.0.0)

• Windows 10 / 11 single-session workstation or Remote PC VDA deployment.
• Administrator or SYSTEM invocation.
• Tested on Windows PowerShell 5.1 and PowerShell 7.4.

Out of scope

• Windows Server, multi-session VDA deployments.
• Anything that requires the orchestrator to write outside the protected runtime root.
• Any third-party Citrix product or alternative deployment tooling.

Previous markings

• The immediately preceding development snapshot fe94cdafbef50bcb8bc09513f09f6d3de9240bf7 remains in the public repository as a non-deployable checkpoint.
• Earlier candidates 7efc8499451513177f976c8e0038d439610a0a7a and 93ae395eaa8ea3ef340613b71962df04bc7004ea were rejected by independent review and are not part of this release.
• v1.0.0 release commit c2c8c5e8b6ba6fb8838423380522243b14a46c3f (tree f9a060adc1f90008db41c2ed77f18c0f37224113) is the security gate base for this documentation patch.

Citrix VDA Upgrade Orchestrator v1.0.0

v1.0.0 — Public release of the Citrix VDA upgrade orchestrator

Public repository

• https://github.com/flathack/Citrix-VDA-Upgrade-Automation

Source provenance

• Extracted and generalized from flathack/MyScripts at Citrix/VDA-Update/VDA-Update-Orchestrator-v2.ps1
• Source commit: 0a1132e63eea4964a97be15b910646e8822b272e
• Original-file SHA-256: 45297974198d37b31077675f798bafb85615363096766df86c0e8b893f8d118c

Immutable candidate bound to this release

• Git tree: f9a060adc1f90008db41c2ed77f18c0f37224113
• Manifest fingerprint SHA-256: d9cc85e67e25e5cf40a08af082c759ecba83b7236bbc959b95ec66137dfb22cf
• Per-file SHA-256 fingerprints are pinned in the Windows-side candidate verifier.

What this release contains

• A neutral, MIT-licensed Citrix VDA upgrade orchestrator for Windows 10/11 single-session workstation and Remote PC VDA deployments.
• Local vda-update.config.example.psd1 and a .gitignore scope that excludes the production configuration, state, logs, payloads, and installer binaries.
• An administrator runbook documenting the trust boundary, the recovery path, and the explicit destructive-operation warning.
• A portable PowerShell 7.4 test suite (no network) and a Windows PowerShell 5.1 system test suite that exercises the orchestrator as NT AUTHORITY\SYSTEM on a disposable VM.

Security highlights

• The fixed runtime root is established under C:\ProgramData\Citrix-VDA-Update and is hardened to SYSTEM and local Administrators only.
• The orchestrator inherits reparse-point rejection at the runtime root and its ancestors and rejects any pre-existing mutable directory handle before trusting the namespace.
• A separate WRITE_DAC | WRITE_OWNER probe with FILE_SHARE_NONE rejects any pre-existing DACL-control capability on the runtime root before the namespace-freezing guard is enabled.
• A retained Task namespace guard binds scheduled-task artifact creation, registration, post-registration logging, start, and SYSTEM child acknowledgement; failure anywhere in that window triggers exact-ownership disable, stop, unregister, and absence verification before the guard is released.
• Cached Citrix launchers are validated through a retained no-follow directory chain, a no-follow no-write/no-delete read handle, exact approved publisher identity, and immediate ACL/owner escalation-capability rejection.
• The fixed PVS remnants path is destroyed through a no-follow ancestor chain, retained no-follow no-write/delete handles, and bottom-up SetFileInformationByHandle(FileDispositionInfo) — never a path-based recursive delete.
• Supported only on Windows 10/11 single-session workstation or Remote PC VDA deployments. Windows Server and multi-session VDA deployments are explicitly out of scope.

Behavior contracts

• #< + integer constant, $true, $false are the only allowed literal forms; coercive casts, computed keys, and AST subexpressions are rejected.
• The literal engine path uses PowerShell 5.1 and PowerShell 7.4; the AST allowlist is verified across both engines.
• The same-boot AwaitingReboot path is idempotent and does not reschedule shutdown or consume another reboot attempt.
• Terminal Completed and Failed states require a verified disabled task before they are reported.

Supported matrix

• Windows 10 / 11 single-session workstation or Remote PC VDA deployment.
• Administrator or SYSTEM invocation.
• Tested on Windows PowerShell 5.1 and PowerShell 7.4.

Out of scope

• Windows Server, multi-session VDA deployments.
• Anything that requires the orchestrator to write outside the protected runtime root.
• Any third-party Citrix product or alternative deployment tooling.

Previous markings

• The immediately preceding development snapshot fe94cdafbef50bcb8bc09513f09f6d3de9240bf7 remains in the public repository as a non-deployable checkpoint.
• Earlier candidates 7efc8499451513177f976c8e0038d439610a0a7a and 93ae395eaa8ea3ef340613b71962df04bc7004ea were rejected by independent review and are not part of this release.