One key, one machine
Activation binds a key to the hash of the Linux machine ID and an installation-specific Ed25519 device public key. The API serialises activation in a database transaction and permits one activation row per license. Copying the token to a host with a different machine ID fails local verification.
sudo bhimkvh license activate
sudo bhimkvh license fingerprint
sudo bhimkvh license statusPrivate key handling
The activation prompt does not echo the license key. The device private key is stored root-only at /etc/bhim-protection/license/device.key; it signs renewal requests. The signed lease is readable by the service account, but modifying its dates, machine hash, or other signed data invalidates the signature.
sudo bhimkvh license activate --key-file /private/license-key.txtOffline leases and paid expiry
An activated server receives a machine-bound signed license valid until the paid expiry date. It can run offline for that entire period, including a month or longer. The hourly renewal timer remains available when online, but failed renewal does not invalidate an unexpired saved license. Existing short leases require one successful online renewal to receive full-term validity.
sudo bhimkvh license renew
sudo bhimkvh license check
sudo systemctl list-timers bhim-license-renew.timerWhat stops at expiry
The license gate checks locally every two seconds. The systemd monitor, response helper, and any gated collector stop when their gate exits. Native daemon and executor loops also verify leases. Protection does not resume automatically merely because a timer later renews the lease; after a stopped deployment renew, check status, and start deliberately.
sudo bhimkvh license renew
sudo systemctl start bhim-license.service bhim-response.service bhim-agent.serviceClock handling
The gate combines signed server timestamps, a root-owned persisted high-water mark, and monotonic elapsed time within the process. Significant local clock rollback is rejected. Keep the host synchronised using its normal NTP service. These measures detect ordinary rollback and do not turn a root-controlled machine into trusted hardware.
Honest security boundaries
A root user can patch the executable, clone machine identity and device secrets, replace systemd units, or reset local clock state and VM snapshots. No software-only licensing design can guarantee impossibility of bypass on that host. The release uses signed grants and one-machine activation, not a claim of unbreakable DRM.
License API
Activation and renewal use HTTPS /api/v1/licenses/activate and /api/v1/licenses/renew. Requests carry device signatures, fresh nonces, and timestamps. This API is only for licensing; it does not expose host incidents, command execution, or monitoring data.