Documentation
¶
Overview ¶
Package license implements offline verification of ed25519-signed license files for premium external plugins. The sarde binary embeds only the vendor's public key; signing happens in the separate, never-shipped tools/sarde-license-sign program.
Index ¶
- Variables
- func CandidatePaths(projectDir, slug string) []string
- func Locate(projectDir, slug string) (string, bool)
- func Sign(f *File, priv ed25519.PrivateKey)
- func Verify(f *File, pub ed25519.PublicKey, slug, version string, now time.Time) error
- func VerifyFor(projectDir, slug, version string) error
- type File
Constants ¶
This section is empty.
Variables ¶
var PublicKey = ed25519.PublicKey{
0x90, 0x2d, 0x54, 0x75, 0x96, 0x42, 0x52, 0x2e,
0x63, 0x7f, 0xc5, 0x62, 0xf1, 0x8d, 0x13, 0x74,
0x55, 0xa2, 0x34, 0xa2, 0xf4, 0x01, 0x23, 0xc6,
0x63, 0x2f, 0xed, 0x8d, 0xa2, 0x76, 0xae, 0x75,
}
PublicKey is the vendor ed25519 public key embedded in the sarde binary and used to verify premium plugin licenses.
The matching private key is held offline by the vendor and is never present in this repository. Licenses are signed with the separate `tools/sarde-license-sign` program. Rotating this value invalidates every license already issued, so it must not change without a coordinated reissue.
Functions ¶
func CandidatePaths ¶
CandidatePaths returns the locations checked for a plugin's license, in priority order: project-level .sarde/licenses/ first (CI, per-project overrides), then the user home directory (one purchase, every project).
func Sign ¶
func Sign(f *File, priv ed25519.PrivateKey)
Sign fills Sig with the base64 ed25519 signature of the payload. Used by the vendor signing tool and tests; the sarde binary only ever verifies.
Types ¶
type File ¶
type File struct {
V int `json:"v"`
Slug string `json:"slug"`
Licensee string `json:"licensee"`
Issued string `json:"issued"` // YYYY-MM-DD
Expires string `json:"expires,omitempty"` // empty = never
MaxVersion string `json:"max_version,omitempty"` // empty = unlimited
Seats int `json:"seats,omitempty"`
Sig string `json:"sig"` // base64 ed25519 signature over canonical()
}
File is a signed plugin license as stored on disk (JSON).
Source Files