74 lines
2.4 KiB
Python
74 lines
2.4 KiB
Python
"""
|
|
generate_keys.py — One-time RSA-2048 key pair generator for TechDesk licensing.
|
|
|
|
Run this ONCE on your server to produce the key pair:
|
|
|
|
python generate_keys.py
|
|
|
|
Output:
|
|
private_key.pem — Keep secret. Never ship to customers.
|
|
public_key.pem — Paste the contents into license_service.py in TechDesk.
|
|
|
|
Security notes:
|
|
- private_key.pem must NEVER be committed to git or shipped in any customer build.
|
|
- public_key.pem is safe to embed in TechDesk — it can only verify signatures,
|
|
not forge them.
|
|
- Store private_key.pem on a secure, offline or access-restricted machine.
|
|
"""
|
|
|
|
from cryptography.hazmat.primitives.asymmetric import rsa
|
|
from cryptography.hazmat.primitives import serialization
|
|
import os
|
|
|
|
KEY_SIZE = 2048
|
|
PRIVATE_KEY_FILE = 'private_key.pem'
|
|
PUBLIC_KEY_FILE = 'public_key.pem'
|
|
|
|
|
|
def generate():
|
|
if os.path.exists(PRIVATE_KEY_FILE) or os.path.exists(PUBLIC_KEY_FILE):
|
|
print('Key files already exist. Delete them manually before regenerating.')
|
|
print(f' {PRIVATE_KEY_FILE}')
|
|
print(f' {PUBLIC_KEY_FILE}')
|
|
return
|
|
|
|
private_key = rsa.generate_private_key(
|
|
public_exponent=65537,
|
|
key_size=KEY_SIZE,
|
|
)
|
|
|
|
# Write private key (unencrypted PEM — restrict file permissions after writing)
|
|
private_pem = private_key.private_bytes(
|
|
encoding=serialization.Encoding.PEM,
|
|
format=serialization.PrivateFormat.TraditionalOpenSSL,
|
|
encryption_algorithm=serialization.NoEncryption(),
|
|
)
|
|
with open(PRIVATE_KEY_FILE, 'wb') as f:
|
|
f.write(private_pem)
|
|
|
|
# Write public key (PEM)
|
|
public_pem = private_key.public_key().public_bytes(
|
|
encoding=serialization.Encoding.PEM,
|
|
format=serialization.PublicFormat.SubjectPublicKeyInfo,
|
|
)
|
|
with open(PUBLIC_KEY_FILE, 'wb') as f:
|
|
f.write(public_pem)
|
|
|
|
# Restrict private key permissions on Unix-like systems
|
|
try:
|
|
os.chmod(PRIVATE_KEY_FILE, 0o600)
|
|
except AttributeError:
|
|
pass # Windows — manage permissions manually
|
|
|
|
print('Key pair generated successfully.')
|
|
print(f' Private key : {PRIVATE_KEY_FILE} (KEEP SECRET)')
|
|
print(f' Public key : {PUBLIC_KEY_FILE} (safe to embed in TechDesk)')
|
|
print()
|
|
print('Next steps:')
|
|
print(' 1. Copy the contents of public_key.pem into license_service.py (PUBLIC_KEY_PEM constant).')
|
|
print(' 2. Never commit or share private_key.pem.')
|
|
|
|
|
|
if __name__ == '__main__':
|
|
generate()
|