cairnd: auto-install refreshed license key from check-in response #58

New issue

Closed

opened 2026-07-29 22:34:23 +00:00 by Cordy · 0 comments

Cordy commented

2026-07-29 22:34:23 +00:00

Owner

Companion to cairn-license-server#3 (renewal refreshes the existing license instead of re-issuing).

The license server's /v1/checkin response will carry the current signed key: {status: "ok", key: "CAIRN1…"}. cairnd's monthly check-in (license.Manager CheckinLoop) should:

Compare the returned key to the installed one.
If different: verify offline against the embedded public key and require the same license id (a renewal re-signs the same id — a different id must be rejected, so a compromised license server cannot swap in an arbitrary license).
Install + persist to statePath, log at info.

Result: subscription renewals propagate to >50-seat instances hands-free within one check-in cycle — nobody re-pastes keys. Sub-50 instances never check in (by design) and don't need a license anyway.

Small change: manager parses the check-in response body (currently ignores it) + one guarded install path + tests (refresh accepted; different-id rejected; malformed key rejected; unchanged key = no-op).

Companion to cairn-license-server#3 (renewal refreshes the existing license instead of re-issuing). The license server's `/v1/checkin` response will carry the current signed key: `{status: "ok", key: "CAIRN1…"}`. cairnd's monthly check-in (license.Manager `CheckinLoop`) should: 1. Compare the returned key to the installed one. 2. If different: verify offline against the embedded public key **and require the same license id** (a renewal re-signs the same id — a different id must be rejected, so a compromised license server cannot swap in an arbitrary license). 3. Install + persist to `statePath`, log at info. Result: subscription renewals propagate to >50-seat instances hands-free within one check-in cycle — nobody re-pastes keys. Sub-50 instances never check in (by design) and don't need a license anyway. Small change: manager parses the check-in response body (currently ignores it) + one guarded install path + tests (refresh accepted; different-id rejected; malformed key rejected; unchanged key = no-op).