Offline software licensing with Ed25519 node locking

How the license file works

Stretchy license files are structured JSON payloads containing the licensed organization, tier, expiry epoch, feature flags, and hardware node lock hash. The payload is signed by AveLynx using an Ed25519 private key. At server boot, Stretchy verifies the cryptographic signature using a hardcoded, public verification key. If even a single byte is modified, the signature check fails immediately.

Hardware node locking

To prevent license unauthorized cloning across virtual machines, Stretchy generates a deterministic SHA-256 fingerprint from immutable hardware traits: the primary network interface MAC address, CPU serial information, and system UUID. The server will only initialize if the current host matches the fingerprint encoded in the cryptographic license.

Clock-rollback defense

In air-gapped environments without NTP, users might attempt to roll back the system clock to bypass license expiration. Stretchy implements an anti-tamper monotonic watermark file (`.license_watermark`). On every launch and periodic audit cycle, the engine verifies that the current system time is strictly greater than or equal to the watermark timestamp before updating it.

Issuing and renewing licenses offline

1. The customer runs the standalone Stretchy fingerprint utility to output their node hash.
2. The hash is transmitted to AveLynx via secure portal or authorized support email.
3. AveLynx generates a signed `.lic` file.
4. The customer places the file in the Stretchy root directory and restarts the container.

Common questions

What happens if the hardware changes?

If network interface cards or motherboards are upgraded, the administrator requests a license reissuance through AveLynx support by providing the new fingerprint hash.

Can a license be transferred?

Yes. A license can be revoked and re-keyed to a new host under standard enterprise license agreements.