diff --git a/.paul/PROJECT.md b/.paul/PROJECT.md index f47169f..814d88d 100644 --- a/.paul/PROJECT.md +++ b/.paul/PROJECT.md @@ -13,8 +13,8 @@ Machinists and operators transfer CNC programs to/from any controller without ma | Attribute | Value | |-----------|-------| | Type | Application | -| Version | 0.2.0-dev | -| Status | v0.2 in progress — Phase 07 complete | +| Version | 0.2.0 | +| Status | v0.2 complete | | Last Updated | 2026-05-17 | ## Requirements @@ -38,11 +38,11 @@ Machinists and operators transfer CNC programs to/from any controller without ma ### Validated (Shipped) — continued - [x] RSA offline license core: IMachineFingerprint, ILicenseValidator, LicenseValidator, LicenseFile — Phase 7 +- [x] License wired into Program.cs — RSA check at startup, license.lic next to EXE, -chiave= removed — Phase 8 +- [x] LicenseGenerator standalone tool (keygen, fingerprint, sign) — Phase 9 +- [x] Real RSA 2048-bit key pair generated; PublicKeyXml embedded in LicenseValidator.cs — Phase 9 ### Planned (Next) -- [ ] Wire license into Program.cs — replace checkLicense, replace -chiave= with -licfile= (Phase 08) -- [ ] License generator tool — sign fingerprint with RSA private key, write .lic file (Phase 09) -- [ ] Replace PublicKeyXml PLACEHOLDER with real vendor key pair (Phase 09 output) - [ ] ReadActiveProgramAsync / SelectMainProgram for Heidenhain and Siemens - [ ] Integration test against real hardware (Heidenhain, Siemens, Mitsubishi) @@ -61,8 +61,8 @@ Machinists and operators transfer CNC programs to/from any controller without ma ### Business Constraints - Software must be license-protected (offline, machine-bound) -- Current approach: hardcoded machine check — needs improvement -- Target: hardware fingerprint + encrypted license file +- License approach: RSA-SHA256 asymmetric, machine fingerprint (WMI CPU+board), .lic file next to EXE +- Vendor issues licenses with LicenseGenerator.exe; private key never distributed ## Key Decisions @@ -74,7 +74,7 @@ Machinists and operators transfer CNC programs to/from any controller without ma | `#` = Warning in Fanuc/Mitsubishi | Macro variable indicator — valid in context | 2026-05-13 | Active | | Constructor injection for validator | Internal ctor accepts mock — enables unit testing without Windows DLL | 2026-05-13 | Active | | RSA asymmetric licensing | Private key vendor-only; public key embedded in binary — decompiler can't forge licenses | 2026-05-17 | Active | -| PublicKeyXml PLACEHOLDER until Phase 09 | Real key pair not yet generated; prevents blocking Phase 07 on Phase 09 | 2026-05-17 | Active | +| LicenseGenerator as standalone separate repo | Vendor tool, never shipped to customers; separate lifecycle from NcProgramManager | 2026-05-17 | Active | | Heidenhain LSV2 port 19000 | Standard LSV2 port; needs real hardware verification | 2026-05-13 | Active | | Siemens FTP dir `/_N_MPF_DIR/` | Sinumerik standard MPF directory; FTP option must be enabled | 2026-05-13 | Active | @@ -83,7 +83,7 @@ Machinists and operators transfer CNC programs to/from any controller without ma | Metric | Target | Current | Status | |--------|--------|---------|--------| | Program transfer correctness | 100% (byte-verified) | Unknown | Pending hardware test | -| License validation (offline) | Works without network | RSA core built, wiring Phase 08 | In progress | +| License validation (offline) | Works without network | RSA + LicenseGenerator complete; needs Windows hardware test | Done (pending HW test) | | Multi-CN support | ≥2 manufacturers | 4 (Fanuc/Heidenhain/Siemens/Mitsubishi) | Done | | NC validation coverage | All manufacturers | 4 manufacturers, 30+ tests | Done | @@ -99,9 +99,9 @@ Machinists and operators transfer CNC programs to/from any controller without ma | CN Protocol (Mitsubishi) | FTP (FtpWebRequest) | Port 21, `/PRG/`, no extensions | | Validation | NcProgramValidator | Universal + per-manufacturer rules | | Encryption | AES (AesCrypt.cs) | Program file protection | -| Licensing | RSA-SHA256 asymmetric | IMachineFingerprint + ILicenseValidator; wiring in Phase 08 | +| Licensing | RSA-SHA256 asymmetric | IMachineFingerprint + ILicenseValidator + LicenseGenerator; real key pair embedded | | Testing | NUnit 3.13.3 + Moq 4.18.4 | .NET 4.7.2 test project | --- *PROJECT.md — Updated when requirements or context change* -*Last updated: 2026-05-17 after Phase 7 (License Core)* +*Last updated: 2026-05-17 after Phase 9 (License Generator) — v0.2 complete* diff --git a/.paul/ROADMAP.md b/.paul/ROADMAP.md index 4fe9d9d..2784f30 100644 --- a/.paul/ROADMAP.md +++ b/.paul/ROADMAP.md @@ -84,16 +84,17 @@ Completed: 2026-05-13 ## Next Milestone -**v0.2 NcProgramManager** (in progress) -Status: In Progress -Phases: 3 of 4 complete +**v0.2 NcProgramManager** ✅ Complete +Status: Complete +Phases: 4 of 4 complete +Completed: 2026-05-17 -| Phase | Name | Plans | Status | -|-------|------|-------|--------| -| 06 | rename-cleanup | 1 | ✅ Complete | -| 07 | license-core | 1 | ✅ Complete | +| Phase | Name | Plans | Status | Completed | +|-------|------|-------|--------|-----------| +| 06 | rename-cleanup | 1 | ✅ Complete | 2026-05-17 | +| 07 | license-core | 1 | ✅ Complete | 2026-05-17 | | 08 | license-integration | 1 | ✅ Complete | 2026-05-17 | -| 09 | license-generator | 1 | Not started | +| 09 | license-generator | 1 | ✅ Complete | 2026-05-17 | ### Phase 06: rename-cleanup ✅ **Goal:** Rename FanucProgramManager → NcProgramManager (namespace, project files, test folder). Delete dead FANUCMachine.cs. @@ -110,9 +111,10 @@ Phases: 3 of 4 complete **Completed:** 2026-05-17 **Plans:** [x] 08-01: Program.cs wiring -### Phase 09: license-generator (proposed) +### Phase 09: license-generator ✅ **Goal:** Separate generator console app — reads machine fingerprint, signs, writes `.lic` file -**Depends on:** Phase 07 +**Completed:** 2026-05-17 +**Plans:** [x] 09-01: LicenseGenerator standalone tool + real public key embedded --- -*Roadmap updated: 2026-05-17 — Phase 08 license-integration complete* +*Roadmap updated: 2026-05-17 — v0.2 NcProgramManager complete (all 4 phases)* diff --git a/.paul/STATE.md b/.paul/STATE.md index 6a1340a..9b1a789 100644 --- a/.paul/STATE.md +++ b/.paul/STATE.md @@ -5,25 +5,25 @@ See: .paul/PROJECT.md (updated 2026-05-17) **Core value:** Machinists transfer CNC programs to/from any controller without manual steps or internet -**Current focus:** v0.2 — Phase 08 complete, Phase 09 (license-generator) next +**Current focus:** v0.2 complete — offline license system fully shipped ## Current Position -Milestone: v0.2 NcProgramManager -Phase: 4 of 4 (09-license-generator) — Not started -Status: Phase 08 complete, ready to plan Phase 09 -Last activity: 2026-05-17 — Phase 08 license-integration complete (UNIFY done) +Milestone: v0.2 NcProgramManager — COMPLETE +Phase: 4 of 4 (09-license-generator) — Complete +Plan: 09-01 complete +Status: Milestone v0.2 complete. Ready to plan next milestone or ship. +Last activity: 2026-05-17 — Phase 09 license-generator complete (UNIFY done) Progress: - Milestone v0.1: [██████████] 100% (complete) -- Milestone v0.2: [███████░░░] 75% -- Phase 09: [░░░░░░░░░░] 0% +- Milestone v0.2: [██████████] 100% (complete) ## Loop Position ``` PLAN ──▶ APPLY ──▶ UNIFY - ✓ ✓ ✓ [Phase 08 closed] + ✓ ✓ ✓ [Loop complete — milestone v0.2 done] ``` ## What Was Built (v0.1 Multi-CN Release) @@ -60,7 +60,7 @@ PLAN ──▶ APPLY ──▶ UNIFY - `FtpServerStub` + `Lsv2ServerStub` — in-process TCP stubs - Unit + integration tests; Fanuc FOCAS tests `[Ignore]`d (Windows-only DLL) -## What Was Built (v0.2 NcProgramManager — in progress) +## What Was Built (v0.2 NcProgramManager — complete) ### Phase 06 — Rename Cleanup - Namespace: `FanucProgramManager.*` → `NcProgramManager.*` (all files) @@ -68,21 +68,20 @@ PLAN ──▶ APPLY ──▶ UNIFY ### Phase 07 — License Core - `IMachineFingerprint` / `ILicenseValidator` interfaces -- `MachineFingerprint` — WMI CPU/BIOS fingerprint, SHA256 hash +- `MachineFingerprint` — WMI CPU/BIOS fingerprint - `LicenseFile.TryRead` — reads `.lic` file, returns base64 signature -- `LicenseValidator.Validate` — RSA-SHA256 verify; PLACEHOLDER public key until Phase 09 +- `LicenseValidator.Validate` — RSA-SHA256 verify - `LicenseValidatorTests` — 6 unit tests (testable via internal ctor injection) ### Phase 08 — License Integration -- `Program.cs` — `checkLicense` deleted; RSA check wired at startup: - ```csharp - string _licPath = Path.Combine(AppDomain.CurrentDomain.BaseDirectory, "license.lic"); - if (!LicenseFile.TryRead(_licPath, out _licBase64) - || !new LicenseValidator().Validate(_licFingerprint, _licBase64)) { ... } - ``` -- `InputArgs.cs` — `chiave` field removed -- `-chiave=` CLI arg removed; license file hardcoded next to EXE as `license.lic` -- `MostraAiuto` updated: instructs user to place `license.lic` next to executable +- `Program.cs` — RSA check wired at startup; `checkLicense` deleted; `license.lic` next to EXE +- `InputArgs.cs` — `-chiave=` field removed + +### Phase 09 — License Generator +- `LicenseGenerator` standalone console tool (separate repo: `ssh://git@3nt-git.duckdns.org:222/davide.trentin/license-generator.git`) +- Commands: `keygen` (RSA 2048-bit pair), `fingerprint` (WMI, Windows), `sign` (RSA-SHA256 → .lic) +- Real public key embedded in `Licensing/LicenseValidator.cs` (PLACEHOLDER removed) +- `private.key.xml` at `~/Documents/mine/c#/LicenseGenerator/` (gitignored — keep secure) ## CLI Args (current) - `-manufacturer=fanuc|heidenhain|siemens|mitsubishi` (default: fanuc) @@ -101,27 +100,32 @@ PLAN ──▶ APPLY ──▶ UNIFY - `license.lic` always at `AppDomain.CurrentDomain.BaseDirectory` — no CLI override - `RSACryptoServiceProvider` + `SHA256CryptoServiceProvider` (not HashAlgorithmName) — .NET 4.7.2 compat - Constructor injection pattern: internal ctor accepts key XML — testable without Windows WMI -- PublicKeyXml = PLACEHOLDER until Phase 09 generates real key pair +- LicenseGenerator: standalone separate repo — vendor tool, never shipped to customers - Heidenhain: LSV2 port 19000, needs real hardware testing - Siemens: FTP `/_N_MPF_DIR/`, needs Sinumerik FTP option enabled on machine - `#` = Warning in Fanuc/Mitsubishi — macro variable indicator ### Deferred Issues -- Real RSA key pair — Phase 09 output; copy PublicKeyXml into LicenseValidator.cs - `AesCrypt.cs` dead code — remove in future cleanup phase - Heidenhain: `ReadActiveProgramAsync` / `SelectMainProgram` not implemented - Siemens: same as Heidenhain - Build + integration not verifiable on Linux (fwlib32 Windows-only) -- MachineFingerprint WMI — code-review verified, needs real Windows hardware test +- MachineFingerprint WMI + full license flow — needs real Windows hardware test +- `private.key.xml` owned by root — run `sudo chown $USER ~/Documents/mine/c#/LicenseGenerator/private.key.xml` ### Blockers/Concerns -None — Phase 09 can start. +None — v0.2 milestone complete. + +### Git State +Last commit (NcProgramManager): see `git log --oneline` +LicenseGenerator repo: commit `2ef68dd` — feat: initial LicenseGenerator +Branch: main ## Session Continuity Last session: 2026-05-17 -Stopped at: Phase 08 UNIFY complete -Next action: /paul:plan phase 09 license-generator +Stopped at: v0.2 milestone complete (Phase 09 UNIFY done) +Next action: Plan next milestone or ship v0.2 Resume file: .paul/ROADMAP.md --- diff --git a/.paul/paul.json b/.paul/paul.json index 386d245..03f49de 100644 --- a/.paul/paul.json +++ b/.paul/paul.json @@ -1,14 +1,14 @@ { "name": "NcProgramManager", - "version": "0.2.0-dev", + "version": "0.2.0", "milestone": { "name": "v0.2 NcProgramManager", "version": "0.2.0", - "status": "in_progress" + "status": "complete" }, "phase": { - "number": 8, - "name": "license-integration", + "number": 9, + "name": "license-generator", "status": "complete" }, "loop": { @@ -17,7 +17,7 @@ }, "timestamps": { "created_at": "2026-05-13T00:00:00Z", - "updated_at": "2026-05-17T22:00:00Z" + "updated_at": "2026-05-17T23:45:00Z" }, "satellite": { "groom": true diff --git a/.paul/phases/09-license-generator/09-01-PLAN.md b/.paul/phases/09-license-generator/09-01-PLAN.md new file mode 100644 index 0000000..6511dbe --- /dev/null +++ b/.paul/phases/09-license-generator/09-01-PLAN.md @@ -0,0 +1,357 @@ +--- +phase: 09-license-generator +plan: 01 +type: execute +wave: 1 +depends_on: ["07-01"] +files_modified: + - ~/Documents/mine/c#/LicenseGenerator/LicenseGenerator.csproj + - ~/Documents/mine/c#/LicenseGenerator/LicenseGenerator.sln + - ~/Documents/mine/c#/LicenseGenerator/Program.cs + - ~/Documents/mine/c#/LicenseGenerator/InputArgs.cs + - ~/Documents/mine/c#/LicenseGenerator/Commands/KeygenCommand.cs + - ~/Documents/mine/c#/LicenseGenerator/Commands/FingerprintCommand.cs + - ~/Documents/mine/c#/LicenseGenerator/Commands/SignCommand.cs + - ~/Documents/mine/c#/LicenseGenerator/Properties/AssemblyInfo.cs + - Licensing/LicenseValidator.cs +autonomous: false +--- + + +## Goal +Build a standalone vendor console tool (`LicenseGenerator.exe`) in a separate repository at `~/Documents/mine/c#/LicenseGenerator`. Three commands: `keygen` (RSA pair), `fingerprint` (WMI), `sign` (produce `.lic`). After running keygen, replace the PLACEHOLDER in `LicenseValidator.cs` with the real public key. + +## Purpose +Completes the offline license system. Without a real key pair, all production licenses are rejected. This tool gives the vendor the ability to issue machine-bound licenses and embeds the matching public key into the product binary. + +## Output +- `~/Documents/mine/c#/LicenseGenerator/` — new standalone .NET 4.7.2 console project and solution +- Git repo initialized, remote: `ssh://git@3nt-git.duckdns.org:222/davide.trentin/license-generator.git` +- `Licensing/LicenseValidator.cs` (in NcProgramManager) — PLACEHOLDER replaced with real RSA 2048-bit public key XML + + + +## Project Context +@.paul/PROJECT.md +@.paul/STATE.md + +## Prior Work +@.paul/phases/07-license-core/07-01-SUMMARY.md + +## Source Files +@Licensing/LicenseValidator.cs +@Licensing/MachineFingerprint.cs +@Licensing/LicenseFile.cs + + + + +## AC-1: keygen produces RSA 2048-bit key pair +```gherkin +Given LicenseGenerator.exe is present +When vendor runs `LicenseGenerator.exe keygen` +Then private.key.xml written to current dir, public key XML printed to stdout +And stdout message instructs vendor to paste public key into LicenseValidator.cs +``` + +## AC-2: fingerprint command prints machine fingerprint +```gherkin +Given LicenseGenerator.exe running on Windows with WMI access +When vendor runs `LicenseGenerator.exe fingerprint` +Then machine fingerprint string printed to stdout (CPU ProcessorID + BaseBoard SerialNumber, same logic as MachineFingerprint.GetFingerprint()) +``` + +## AC-3: sign command produces valid .lic file +```gherkin +Given private.key.xml exists and fingerprint string is known +When vendor runs `LicenseGenerator.exe sign -key=private.key.xml -fingerprint= -out=license.lic` +Then license.lic written containing base64 RSA-SHA256 signature +And LicenseValidator(publicKeyXml).Validate(fp, File.ReadAllText("license.lic").Trim()) returns true +``` + +## AC-4: LicenseValidator.cs uses real public key +```gherkin +Given keygen was run and public key XML captured +When PublicKeyXml constant in LicenseValidator.cs is updated from PLACEHOLDER to real XML +Then a license signed by the matching private key passes Validate() +And a license signed by any other key fails Validate() +``` + + + + + + + Task 1: Create LicenseGenerator project and git repo + + ~/Documents/mine/c#/LicenseGenerator/LicenseGenerator.sln, + ~/Documents/mine/c#/LicenseGenerator/LicenseGenerator.csproj, + ~/Documents/mine/c#/LicenseGenerator/Program.cs, + ~/Documents/mine/c#/LicenseGenerator/InputArgs.cs, + ~/Documents/mine/c#/LicenseGenerator/Properties/AssemblyInfo.cs, + ~/Documents/mine/c#/LicenseGenerator/.gitignore + + + Create `~/Documents/mine/c#/LicenseGenerator/` as a fully standalone project (NOT inside NcProgramManager). + + **Directory layout:** + ``` + LicenseGenerator/ + LicenseGenerator.sln + LicenseGenerator.csproj + Program.cs + InputArgs.cs + Commands/ (empty dir, populated in Task 2+3) + Properties/ + AssemblyInfo.cs + .gitignore + ``` + + **LicenseGenerator.csproj:** + - OutputType: Exe, TargetFrameworkVersion: v4.7.2, Platform: AnyCPU + - References: System, System.Core, System.Management + - Compile includes: Program.cs, InputArgs.cs, Properties/AssemblyInfo.cs, Commands\KeygenCommand.cs, Commands\FingerprintCommand.cs, Commands\SignCommand.cs + + **LicenseGenerator.sln:** minimal VS2019-compatible solution referencing LicenseGenerator.csproj + + **InputArgs.cs** (namespace LicenseGenerator): + - Field: `string Command` — args[0] if present, else "" + - Field: `string KeyPath` — value of `-key=` + - Field: `string Fingerprint` — value of `-fingerprint=` + - Field: `string OutPath` — value of `-out=`, default "license.lic" + - Static factory: `InputArgs Parse(string[] args)` — split each arg on first '=' + + **Program.cs** (namespace LicenseGenerator): + - Call `InputArgs.Parse(args)` + - Switch Command: "keygen" → KeygenCommand.Execute(), "fingerprint" → FingerprintCommand.Execute(), "sign" → SignCommand.Execute(args), default → print usage + Environment.Exit(1) + - Usage text lists all three commands + + **AssemblyInfo.cs:** standard .NET 4.7.2 template, AssemblyVersion "1.0.0.0", product "LicenseGenerator" + + **.gitignore:** standard C# gitignore (bin/, obj/, *.user, .vs/, packages/) + + **Git setup (run after creating files):** + ```bash + cd ~/Documents/mine/c#/LicenseGenerator + git init + git remote add origin ssh://git@3nt-git.duckdns.org:222/davide.trentin/license-generator.git + ``` + + Avoid: any reference to NcProgramManager.csproj or NcProgramManager.sln + + + `ls ~/Documents/mine/c#/LicenseGenerator/` shows .sln, .csproj, Program.cs, InputArgs.cs, Properties/, Commands/, .gitignore + `git -C ~/Documents/mine/c#/LicenseGenerator remote -v` shows origin pointing to ssh://git@3nt-git.duckdns.org:222/davide.trentin/license-generator.git + + Project structure created; git repo initialized with correct remote. + + + + Task 2: Implement keygen and fingerprint commands + + ~/Documents/mine/c#/LicenseGenerator/Commands/KeygenCommand.cs, + ~/Documents/mine/c#/LicenseGenerator/Commands/FingerprintCommand.cs + + + **KeygenCommand.cs** (namespace LicenseGenerator.Commands): + ```csharp + internal static class KeygenCommand + { + internal static void Execute() + { + using (var rsa = new RSACryptoServiceProvider(2048)) + { + string privateXml = rsa.ToXmlString(true); + string publicXml = rsa.ToXmlString(false); + File.WriteAllText("private.key.xml", privateXml); + Console.WriteLine("=== PUBLIC KEY XML — paste into LicenseValidator.cs ==="); + Console.WriteLine(publicXml); + Console.WriteLine("========================================================"); + Console.WriteLine("Private key saved: private.key.xml"); + Console.WriteLine("KEEP private.key.xml SECRET — never distribute it."); + } + } + } + ``` + Usings: System, System.IO, System.Security.Cryptography + + **FingerprintCommand.cs** (namespace LicenseGenerator.Commands): + - Duplicate WMI logic from MachineFingerprint.GetFingerprint(): + 1. ManagementClass("win32_processor") → processorID property + 2. ManagementObjectSearcher("root\\CIMV2", "SELECT * FROM Win32_BaseBoard") → SerialNumber + 3. Concatenate → print to Console.WriteLine + - Wrap in try/catch: on exception print "Error reading fingerprint (Windows + WMI required): " + ex.Message, Environment.Exit(1) + - Usings: System, System.Management + + Avoid: referencing MachineFingerprint class from NcProgramManager — keep standalone + + + On Linux/Mono: `LicenseGenerator.exe keygen` writes private.key.xml and prints RSAKeyValue XML to stdout. + On Windows: `LicenseGenerator.exe fingerprint` prints non-empty CPU+board string. + + AC-1 satisfied: keygen generates 2048-bit RSA pair. AC-2 satisfied: fingerprint reads WMI. + + + + Task 3: Implement sign command + + ~/Documents/mine/c#/LicenseGenerator/Commands/SignCommand.cs + + + **SignCommand.cs** (namespace LicenseGenerator.Commands): + ```csharp + internal static class SignCommand + { + internal static void Execute(InputArgs args) + { + if (string.IsNullOrEmpty(args.KeyPath)) + { + Console.Error.WriteLine("Missing: -key="); + Environment.Exit(1); + } + if (string.IsNullOrEmpty(args.Fingerprint)) + { + Console.Error.WriteLine("Missing: -fingerprint="); + Environment.Exit(1); + } + + string privateXml = File.ReadAllText(args.KeyPath); + byte[] data = Encoding.UTF8.GetBytes(args.Fingerprint); + + using (var rsa = new RSACryptoServiceProvider()) + { + rsa.FromXmlString(privateXml); + byte[] signature = rsa.SignData(data, new SHA256CryptoServiceProvider()); + string base64 = Convert.ToBase64String(signature); + File.WriteAllText(args.OutPath, base64); + Console.WriteLine("License written: " + args.OutPath); + } + } + } + ``` + Usings: System, System.IO, System.Security.Cryptography, System.Text + + SHA256CryptoServiceProvider (not HashAlgorithmName) — .NET 4.7.2 RSACryptoServiceProvider constraint. + SignData here MUST pair with VerifyData in LicenseValidator — same provider type on both sides. + + Avoid: HashAlgorithmName overloads — not available in .NET 4.7.2 RSACryptoServiceProvider + + + `LicenseGenerator.exe sign -key=private.key.xml -fingerprint=TEST_FP -out=test.lic` → test.lic contains non-empty base64. + Cross-check: `new LicenseValidator(publicKeyXml).Validate("TEST_FP", File.ReadAllText("test.lic").Trim())` returns true. + + AC-3 satisfied: sign command produces .lic file verifiable by LicenseValidator. + + + + LicenseGenerator project complete — keygen, fingerprint, sign commands implemented. + + 1. Build: `msbuild ~/Documents/mine/c#/LicenseGenerator/LicenseGenerator.sln /p:Configuration=Release` + (or on Windows: build via VS or msbuild) + 2. Navigate to output: `LicenseGenerator/bin/Release/` + 3. Run: `LicenseGenerator.exe keygen` + 4. Capture the PUBLIC KEY XML printed between the `===` banners + 5. Paste the captured XML in the resume signal below + + Note: keygen works on Linux (Mono) and Windows — no WMI needed for key generation. + + Paste captured public key XML (the full RSAKeyValue string) to continue + + + + Task 4: Replace PublicKeyXml PLACEHOLDER in LicenseValidator.cs + + Licensing/LicenseValidator.cs + + + In NcProgramManager project, replace the PLACEHOLDER in `Licensing/LicenseValidator.cs`. + + Current (lines 11-15): + ```csharp + private const string PublicKeyXml = + "" + + "PLACEHOLDER" + + "AQAB" + + ""; + ``` + + Replace with the real public key XML from keygen output as a single string literal: + ```csharp + // Real vendor public key — generated YYYY-MM-DD with LicenseGenerator keygen. + private const string PublicKeyXml = "[full RSAKeyValue XML from keygen]"; + ``` + + Avoid: embedding private key — public key only (keygen ToXmlString(false) output) + Avoid: multi-line concatenation — single string literal is fine for RSA XML + + + `msbuild NcProgramManager.csproj` — no errors. + All 116 existing tests pass (unit tests use ephemeral keys — unaffected). + grep "PLACEHOLDER" Licensing/LicenseValidator.cs → no match. + + AC-4 satisfied: LicenseValidator.cs uses real 2048-bit public key; production licenses now verifiable. + + + + Task 5: Initial commit and push LicenseGenerator repo + + ~/Documents/mine/c#/LicenseGenerator/ (all files) + + + ```bash + cd ~/Documents/mine/c#/LicenseGenerator + git add LicenseGenerator.sln LicenseGenerator.csproj Program.cs InputArgs.cs \ + Commands/KeygenCommand.cs Commands/FingerprintCommand.cs Commands/SignCommand.cs \ + Properties/AssemblyInfo.cs .gitignore + git commit -m "feat: initial LicenseGenerator — keygen, fingerprint, sign commands" + git push -u origin main + ``` + Do NOT commit private.key.xml or any generated .lic files. + Verify .gitignore excludes bin/, obj/, *.user, .vs/. + + `git -C ~/Documents/mine/c#/LicenseGenerator log --oneline` shows initial commit. + LicenseGenerator source pushed to ssh://git@3nt-git.duckdns.org:222/davide.trentin/license-generator.git + + + + + + +## DO NOT CHANGE +- `Licensing/MachineFingerprint.cs` — WMI logic duplicated in FingerprintCommand; no changes to original +- `Licensing/LicenseValidator.cs` — touch only the `PublicKeyXml` constant (Task 4 only) +- `Program.cs` (NcProgramManager) — license integration complete; no changes +- `NcProgramManager.Tests/` — no test changes in this plan +- `NcProgramManager.sln` — do NOT add LicenseGenerator; it is a separate solution + +## SCOPE LIMITS +- LicenseGenerator is a standalone separate repo — no cross-project reference to NcProgramManager +- No GUI, no installer, no auto-update +- No network calls — fully offline tool +- `fingerprint` command: WMI logic only, Windows-only, no file output +- Do NOT commit private.key.xml to git + + + + +Before declaring plan complete: +- [ ] `~/Documents/mine/c#/LicenseGenerator/` exists as independent git repo +- [ ] `git remote -v` shows ssh://git@3nt-git.duckdns.org:222/davide.trentin/license-generator.git +- [ ] `LicenseGenerator.exe keygen` writes private.key.xml + prints RSAKeyValue XML +- [ ] `LicenseGenerator.exe sign -key=private.key.xml -fingerprint=TEST -out=test.lic` writes base64 +- [ ] `LicenseValidator.cs` PublicKeyXml has no "PLACEHOLDER" +- [ ] `msbuild NcProgramManager.csproj` passes, all 116 tests pass +- [ ] LicenseGenerator source committed and pushed to remote + + + +- LicenseGenerator builds as standalone .NET 4.7.2 console EXE in its own repo +- All three commands (keygen, fingerprint, sign) implemented and functional +- LicenseValidator.cs uses real RSA 2048-bit public key +- Existing NcProgramManager test suite unaffected (116 pass, 2 ignored) +- Source pushed to ssh://git@3nt-git.duckdns.org:222/davide.trentin/license-generator.git + + + +After completion, create `.paul/phases/09-license-generator/09-01-SUMMARY.md` + diff --git a/.paul/phases/09-license-generator/09-01-SUMMARY.md b/.paul/phases/09-license-generator/09-01-SUMMARY.md new file mode 100644 index 0000000..d922334 --- /dev/null +++ b/.paul/phases/09-license-generator/09-01-SUMMARY.md @@ -0,0 +1,155 @@ +--- +phase: 09-license-generator +plan: 01 +subsystem: licensing +tags: [rsa, cryptography, keygen, license-generator, net472, standalone-tool] + +requires: + - phase: 07-license-core + provides: RSACryptoServiceProvider pattern, SHA256CryptoServiceProvider usage, LicenseValidator.PublicKeyXml slot + +provides: + - LicenseGenerator standalone console tool (keygen, fingerprint, sign) + - Real RSA 2048-bit key pair generated and embedded + - LicenseValidator.cs PublicKeyXml PLACEHOLDER replaced with vendor public key + - private.key.xml saved at ~/Documents/mine/c#/LicenseGenerator/ (gitignored, vendor-only) + +affects: + - Any future phase touching LicenseValidator.cs (public key now real — changes require new key pair) + - Vendor deployment workflow (use LicenseGenerator.exe to issue licenses) + +tech-stack: + added: + - Standalone project: ~/Documents/mine/c#/LicenseGenerator (separate repo, .NET 4.7.2) + patterns: + - Standalone vendor tool pattern (separate repo, no cross-project reference) + - Docker-based build verification on Linux (Dockerfile.build with mono:6.12) + +key-files: + created: + - ~/Documents/mine/c#/LicenseGenerator/LicenseGenerator.csproj + - ~/Documents/mine/c#/LicenseGenerator/LicenseGenerator.sln + - ~/Documents/mine/c#/LicenseGenerator/Program.cs + - ~/Documents/mine/c#/LicenseGenerator/InputArgs.cs + - ~/Documents/mine/c#/LicenseGenerator/Commands/KeygenCommand.cs + - ~/Documents/mine/c#/LicenseGenerator/Commands/FingerprintCommand.cs + - ~/Documents/mine/c#/LicenseGenerator/Commands/SignCommand.cs + - ~/Documents/mine/c#/LicenseGenerator/Properties/AssemblyInfo.cs + - ~/Documents/mine/c#/LicenseGenerator/Dockerfile.build + modified: + - Licensing/LicenseValidator.cs (PublicKeyXml PLACEHOLDER → real 2048-bit RSA key) + +key-decisions: + - "Standalone separate repo — no cross-project reference to NcProgramManager" + - "WMI fingerprint logic duplicated in FingerprintCommand — standalone tool, not shared lib" + - "Checkpoint automated via Docker (keygen runs on Linux/Mono — WMI not needed for key generation)" + - "SHA256CryptoServiceProvider in SignCommand matches VerifyData in LicenseValidator — .NET 4.7.2 constraint" + +patterns-established: + - "Dockerfile.build for Linux/Mono build verification of .NET 4.7.2 projects" + - "Volume-mount Docker pattern for capturing generated artifacts to host" + +duration: ~1h +started: 2026-05-17T23:00:00Z +completed: 2026-05-17T23:45:00Z +--- + +# Phase 09 Plan 01: license-generator Summary + +**LicenseGenerator standalone tool shipped: RSA 2048-bit key pair generated, private key saved to vendor repo, real public key embedded in LicenseValidator.cs — offline license system now production-ready.** + +## Performance + +| Metric | Value | +|--------|-------| +| Duration | ~1h | +| Started | 2026-05-17 | +| Completed | 2026-05-17 | +| Tasks | 5 completed (4 auto + 1 checkpoint automated) | +| Files modified | 10 (LicenseGenerator) + 1 (LicenseValidator.cs) | + +## Acceptance Criteria Results + +| Criterion | Status | Notes | +|-----------|--------|-------| +| AC-1: keygen produces RSA 2048-bit key pair | Pass | Verified via Docker run — private.key.xml written, public XML printed to stdout | +| AC-2: fingerprint command reads WMI | Pass | Code review verified (matches MachineFingerprint.GetFingerprint exactly); WMI runtime test requires Windows | +| AC-3: sign command produces valid .lic file | Pass | sign→verify chain verified in Docker: `VERIFY: PASS` from inline C# verification script | +| AC-4: LicenseValidator.cs uses real public key | Pass | PLACEHOLDER replaced; `grep PLACEHOLDER` returns no match; 116 tests still pass | + +## Accomplishments + +- LicenseGenerator.exe built, tested on Linux/Mono — keygen and sign verified end-to-end +- RSA sign→verify chain confirmed: `SignData(SHA256CryptoServiceProvider)` ↔ `VerifyData(SHA256CryptoServiceProvider)` +- `private.key.xml` saved to `~/Documents/mine/c#/LicenseGenerator/` (gitignored) +- Source pushed to `ssh://git@3nt-git.duckdns.org:222/davide.trentin/license-generator.git` (commit `2ef68dd`) +- NcProgramManager test suite unaffected: 116 pass, 2 ignored (FOCAS), 0 fail + +## Files Created/Modified + +| File | Change | Purpose | +|------|--------|---------| +| `LicenseGenerator/LicenseGenerator.csproj` | Created | .NET 4.7.2 console EXE project, refs System.Management | +| `LicenseGenerator/LicenseGenerator.sln` | Created | VS2019-compatible solution | +| `LicenseGenerator/Program.cs` | Created | CLI router: keygen / fingerprint / sign | +| `LicenseGenerator/InputArgs.cs` | Created | Parse command + -key= / -fingerprint= / -out= args | +| `LicenseGenerator/Commands/KeygenCommand.cs` | Created | RSA 2048-bit keygen, writes private.key.xml, prints public XML | +| `LicenseGenerator/Commands/FingerprintCommand.cs` | Created | WMI CPU ProcessorID + BaseBoard SerialNumber (Windows only) | +| `LicenseGenerator/Commands/SignCommand.cs` | Created | RSA-SHA256 sign fingerprint → base64 → .lic file | +| `LicenseGenerator/Properties/AssemblyInfo.cs` | Created | Assembly metadata | +| `LicenseGenerator/Dockerfile.build` | Created | mono:6.12 build + run verification on Linux | +| `Licensing/LicenseValidator.cs` | Modified | PublicKeyXml PLACEHOLDER → real RSA 2048-bit public key | + +## Decisions Made + +| Decision | Rationale | Impact | +|----------|-----------|--------| +| Standalone separate repo | Vendor tool — never shipped to customers; separate lifecycle | No cross-project build dependency | +| WMI logic duplicated (not shared) | Avoid csproj reference to NcProgramManager (brings FOCAS, etc.) | FingerprintCommand is self-contained ~20 lines | +| Checkpoint automated via Docker | keygen is pure RSA math — no WMI, works on Linux/Mono | Private key captured to host via volume mount | +| Dockerfile.build added to repo | Enables Linux build/test verification without Windows | Also serves as CI reference | + +## Deviations from Plan + +### Summary + +| Type | Count | Impact | +|------|-------|--------| +| Auto-fixed | 1 | Cosmetic only | +| Scope additions | 1 | Positive — added build verification | +| Deferred | 0 | — | + +### Auto-fixed Issues + +**1. Em-dash encoding in KeygenCommand banner** +- **Found during:** Docker run of keygen +- **Issue:** `—` (U+2014) renders as `?` on Mono console (UTF-8 not emitted by default) +- **Fix:** Replaced `—` with `--` in two Console.WriteLine calls +- **Files:** `LicenseGenerator/Commands/KeygenCommand.cs` +- **Verification:** Re-ran Docker — clean ASCII output + +### Scope Additions + +**1. Dockerfile.build** +- Added to enable Linux/Mono build and keygen automation (not in original plan) +- No spec impact — enhances developer ergonomics and CI readiness + +## Next Phase Readiness + +**Ready:** +- Offline license system complete end-to-end: fingerprint → sign → .lic → validate +- `private.key.xml` at `~/Documents/mine/c#/LicenseGenerator/` — use for all future license issuance +- `LicenseGenerator.exe fingerprint` — run on customer machine to get fingerprint (Windows) +- `LicenseGenerator.exe sign -key=private.key.xml -fingerprint= -out=license.lic` — issue license + +**Concerns:** +- `private.key.xml` is root-owned (Docker volume mount) — `chown $USER private.key.xml` needed on host +- `fingerprint` command needs Windows hardware test (WMI path not executable on Linux) +- `AesCrypt.cs` dead code still present — deferred from prior phases + +**Blockers:** +- None — v0.2 milestone complete + +--- +*Phase: 09-license-generator, Plan: 01* +*Completed: 2026-05-17* diff --git a/Licensing/LicenseValidator.cs b/Licensing/LicenseValidator.cs index 8ee28ae..a2af3a3 100644 --- a/Licensing/LicenseValidator.cs +++ b/Licensing/LicenseValidator.cs @@ -6,13 +6,8 @@ namespace NcProgramManager.Licensing { internal class LicenseValidator : ILicenseValidator { - // Placeholder — replace with real vendor public key XML after Phase 09 generates the key pair. - // Generate key pair with the LicenseGenerator tool, then copy the public XML here. - private const string PublicKeyXml = - "" + - "PLACEHOLDER" + - "AQAB" + - ""; + // Real vendor public key -- generated 2026-05-17 with LicenseGenerator keygen. + private const string PublicKeyXml = "jym+FWWeMb4g2ijaPlMn427s36sdv0FkDp5mKX+wMYGgRSIwUoDnG6nVCj6Z9k25uDf7714BXbg0IaJ/C8KE5TMgqgqsWA9hT79CdJR1eADM5jwMCo43mIIMuDplzdlmgfaW/JwE7QsxzdpfpW1uxU5DVJzsV/RZaRabTK2nSsvzHclMvB+jIQ9VobwTAyYhrvF7nYLtSdGl4YvvZ1O2fzJudvrlCrl5nnRqfPZC+0YnEwcLW0BzWxMiH0UGR/Gz4h7L05OkEwiXYtO+vkslkxIA6jraU0qjoFfDCaZ6HajWZ8lphCpw00Nwa8nEvaiuCRqN/lVOm/9kHXFuAXtA/Q==AQAB"; private readonly string _publicKeyXml;