feat: bind each licence to the computer it was activated on #2

Merged

jwarykowski merged 1 commit from feat/machine into main

2026-10-14 13:30:59 +00:00

jwarykowski commented

2026-10-14 13:23:18 +00:00

Owner

Copying licence.json to another computer unlocked Pro there, so the three-machine limit only counted activations through the server.

The client sends machine: machineid.ProtectedID(product), an HMAC-SHA256 of the OS machine ID keyed by the product, so the raw ID never leaves the computer and differs per product. The Worker requires it (64 hex characters) and signs it into the token; it isn't sent to Polar.
Verify and Load return ErrOtherMachine (with the licence) when the token names another computer; the app offers to activate there, which takes a slot.
Deactivate on a copied licence only deletes the file: it doesn't free the original computer's activation.
New dependency: github.com/denisbrodbeck/machineid (MIT), plus golang.org/x/sys.

Needs a Worker deploy before apps send machine; the old Worker would ignore it and issue tokens apps then reject.

Copying `licence.json` to another computer unlocked Pro there, so the three-machine limit only counted activations through the server. - The client sends `machine`: `machineid.ProtectedID(product)`, an HMAC-SHA256 of the OS machine ID keyed by the product, so the raw ID never leaves the computer and differs per product. The Worker requires it (64 hex characters) and signs it into the token; it isn't sent to Polar. - `Verify` and `Load` return `ErrOtherMachine` (with the licence) when the token names another computer; the app offers to activate there, which takes a slot. - `Deactivate` on a copied licence only deletes the file: it doesn't free the original computer's activation. - New dependency: github.com/denisbrodbeck/machineid (MIT), plus golang.org/x/sys. Needs a Worker deploy before apps send `machine`; the old Worker would ignore it and issue tokens apps then reject.

jwarykowski added 1 commit

2026-10-14 13:23:18 +00:00

feat: bind each licence to the computer it was activated on

CI / worker (pull_request) Successful in 38s

Details

CI / go (pull_request) Successful in 40s

Details

e40bf2ca33

The client sends an HMAC of the machine ID (keyed per product, so the ID never leaves the computer) and the Worker signs it into the token. A licence file copied to another computer verifies with ErrOtherMachine, so Polar's activation limit holds. Deleting a copied licence frees nothing, as the activation belongs to the original computer.

jwarykowski merged commit e68a8601e6 into main

2026-10-14 13:30:59 +00:00

jwarykowski deleted branch feat/machine

2026-10-14 13:30:59 +00:00

jwarykowski referenced this pull request from a commit

2026-10-14 13:30:59 +00:00

feat: bind each licence to the computer it was activated on (#2)

jwarykowski referenced this pull request

2026-10-14 13:51:09 +00:00

fix: give back an activation an out-of-date server signed #3