Repository navigation
feat: verify offline licenses locally (VerifyOfflineLicense) - #4
Merged
Merged
Conversation
Add VerifyOfflineLicense, which checks a signed .lic file (or bare token) against trusted Ed25519 public key PEMs with the standard library only. ProductID and MachineCode are required, so a license for one product cannot unlock another under the shared org signing key (L-04). Failures return *OfflineLicenseError with one of eight reason codes; bad options wrap ErrInvalidOfflineOptions. Also adds OfflineKeyID, re-exports from the deprecated /src package, the shared 34-case fixture file with a table test, a live check of the signed file when KEYMINT_TEST_PUBLIC_KEY is set, and a README section.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this adds
VerifyOfflineLicense(license, OfflineVerifyOptions): verifies a signed.licfile (or bare token) locally withcrypto/ed25519andcrypto/x509. No new dependencies.OfflineLicenseresult,*OfflineLicenseErrorwith eight exported reason codes (OfflineMalformed...OfflineExpired, string values as in the spec), andErrInvalidOfflineOptionsfor bad options, so callers can tell the two apart witherrors.As/errors.Is.OfflineKeyID(pem): the key ID Keymint computes for a public key./srcpackage; CI's consumer build compiles both paths.Spec
Follows the shared offline-verifier spec (same nine ordered checks as the other SDKs) and passes all 34 shared fixtures (
testdata/offline-license-fixtures.json, copied unchanged).ProductIDandMachineCodeare required: one signing key covers every product in an org, so skipping the product check would let a license for one product unlock another (L-04).Tests
TestVerifyOfflineLicenseFixtures: table test over all 34 cases (codes and every license field).TestVerifyOfflineLicenseOptionErrors: no keys, garbage/non-Ed25519 PEM, empty product/machine, skew out of range; skew 0 and 1h accepted.SignKeywhenKEYMINT_TEST_PUBLIC_KEY(repository variable, PEM) is set; skipped otherwise. Wired into the live job's env. The contract-test filter in CI now includesTestVerifyOfflineLicense.Local:
gofmt -l .clean,go vet ./...clean,go test ./...passes.