license: require the signed license file, drop by-email activation#8
Merged
Conversation
Activation previously posted the buyer's email to the license server and got the license back - which meant anyone who knew a buyer's address (e.g. the public admin email) could unlock for free. Now activation requires the signed .klipa license file itself. - activate_from_clipboard parses the pasted license blob and verifies the Ed25519 signature offline; no network call. Knowing an email is no longer sufficient - you need the signed file. - verify_blob drops the email argument (possession of a valid signature is the proof); reverify_if_stale becomes a cheap offline integrity re-check instead of a server round-trip. - Remove the now-unused license endpoint const and http::post_json; the license feature no longer touches the network. - Menu label -> "Activate (paste license file)". Docs/welcome/READMEs updated for the file-based flow. Tradeoff: no online revocation (a refund can't be revoked remotely) - acceptable for a EUR 1.99 open-source "honest nudge" gate. App Store build is unaffected (license feature compiled out).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the freeload hole you spotted: previously the app posted a buyer's email to the server and got the license back, so anyone who knew a licensed address (including the public admin email) could unlock for free.
Change
Activation now requires the signed
.klipalicense file itself, verified offline:activate_from_clipboardparses the pasted license blob and checks the Ed25519 signature offline against the embedded public key. No network. Knowing an email is no longer enough - you need the signed file.verify_blobdrops the email argument (a valid signature is the proof);reverify_if_stalebecomes a cheap offline integrity check instead of a server round-trip.http::post_json- thelicensefeature no longer touches the network.Paired with the server change (PromptBar) that disables klipa's
/activateemail-lookup (returns 403) and inlines the license in the purchase email so it's easy to copy.Tradeoff
No online revocation - a refund can't be remotely revoked, since a valid license is a permanent signed file. Acceptable for a €1.99 open-source "honest nudge" gate.
Testing
cargo test -p klipa-ui(8 pass, incl. real-signature verify + tamper). Clean build on default,mas,mas weather, no-default-features. App Store build unaffected (license compiled out).