05/22 Implement license version

2026-05-22 16:31:19 -04:00
parent e6657e60cf
commit 687216e332
16 changed files with 1373 additions and 37 deletions
@@ -0,0 +1,73 @@
+"""
+generate_keys.py — One-time RSA-2048 key pair generator for TechDesk licensing.
+
+Run this ONCE on your server to produce the key pair:
+
+    python generate_keys.py
+
+Output:
+    private_key.pem  — Keep secret. Never ship to customers.
+    public_key.pem   — Paste the contents into license_service.py in TechDesk.
+
+Security notes:
+    - private_key.pem must NEVER be committed to git or shipped in any customer build.
+    - public_key.pem is safe to embed in TechDesk — it can only verify signatures,
+      not forge them.
+    - Store private_key.pem on a secure, offline or access-restricted machine.
+"""
+
+from cryptography.hazmat.primitives.asymmetric import rsa
+from cryptography.hazmat.primitives import serialization
+import os
+
+KEY_SIZE = 2048
+PRIVATE_KEY_FILE = 'private_key.pem'
+PUBLIC_KEY_FILE  = 'public_key.pem'
+
+
+def generate():
+    if os.path.exists(PRIVATE_KEY_FILE) or os.path.exists(PUBLIC_KEY_FILE):
+        print('Key files already exist. Delete them manually before regenerating.')
+        print(f'  {PRIVATE_KEY_FILE}')
+        print(f'  {PUBLIC_KEY_FILE}')
+        return
+
+    private_key = rsa.generate_private_key(
+        public_exponent=65537,
+        key_size=KEY_SIZE,
+    )
+
+    # Write private key (unencrypted PEM — restrict file permissions after writing)
+    private_pem = private_key.private_bytes(
+        encoding=serialization.Encoding.PEM,
+        format=serialization.PrivateFormat.TraditionalOpenSSL,
+        encryption_algorithm=serialization.NoEncryption(),
+    )
+    with open(PRIVATE_KEY_FILE, 'wb') as f:
+        f.write(private_pem)
+
+    # Write public key (PEM)
+    public_pem = private_key.public_key().public_bytes(
+        encoding=serialization.Encoding.PEM,
+        format=serialization.PublicFormat.SubjectPublicKeyInfo,
+    )
+    with open(PUBLIC_KEY_FILE, 'wb') as f:
+        f.write(public_pem)
+
+    # Restrict private key permissions on Unix-like systems
+    try:
+        os.chmod(PRIVATE_KEY_FILE, 0o600)
+    except AttributeError:
+        pass  # Windows — manage permissions manually
+
+    print('Key pair generated successfully.')
+    print(f'  Private key : {PRIVATE_KEY_FILE}  (KEEP SECRET)')
+    print(f'  Public key  : {PUBLIC_KEY_FILE}  (safe to embed in TechDesk)')
+    print()
+    print('Next steps:')
+    print('  1. Copy the contents of public_key.pem into license_service.py (PUBLIC_KEY_PEM constant).')
+    print('  2. Never commit or share private_key.pem.')
+
+
+if __name__ == '__main__':
+    generate()