RADSecurity

RADSecurity provides the trust primitives used by update manifests, installers, and embedded deployment tools.

Use RADSecurity::Crypto for SHA-256 hashing, secure random bytes, RSA-SHA256 signing, signature verification, and file fingerprints. Use readCapabilitySet() to inspect Linux process capability masks from /proc/self/status without requiring libcap. Use SandboxProfile to describe a future launcher/sandbox policy in JSON.

Use RADSecurity::LicenseManager for offline signed license checks. RADLib license documents include an issuer key_id, a signed payload, and an RSA-SHA256 signature. Applications can verify against one public issuer key or a set of TrustedLicenseKey records when key rotation is required.

This runtime license check complements the compile-time SDK acknowledgement macros. The macros declare which license tier the application is being compiled under; the signed license file verifies a specific commercial grant, customer key fingerprint, and node fingerprint.

For auditability, applications should log or display RADLicense::compileAuditStamp() and the verified LicenseCheckResult::payload.kind, licenseId, licensee, and issuerKeyId where appropriate. A community build should visibly report RADLIB_LICENSE_TIER=community; public beta RADLib binaries should also report RADLIB_EDITION=community-edition through RADCore::runtimeAuditStamp(). A future paid-edition build should report RADLIB_EDITION=paid-edition and show a valid signed-license status.

Example:

auto digest = RADSecurity::Crypto::sha256File("payload.bin");
auto hex = RADSecurity::Crypto::toHex(digest.value());

Node-locked license verification:

RADSecurity::LicenseCheckOptions options;
options.product = "RADLib";
options.appMajorVersion = 0;
options.requiredFeature = "ui";
options.expectedLicenseePublicKeyFingerprint = expectedCustomerKeyFingerprint;
 
auto check = RADSecurity::LicenseManager::verifySignedLicenseFile(
    "crimson.license.json", issuerPublicKeyPem, options);
 
if (!check.valid()) {
    // Decide whether to disable commercial-only features, show activation UI,
    // or continue in community/evaluation mode.
}

By default, LicenseCheckOptions rejects portable licenses. Set allowPortableLicense = true only for community, academic, evaluation, or explicitly portable grants.

Release tooling can generate a signed universal community license when the offline issuer private key is provided:

RADLIB_ISSUER_PRIVATE_KEY_PATH=/secure/path/radlib-issuer-private.pem \
RADLIB_ISSUER_KEY_ID=radlib-community-0.1.0 \
    ./build.py --release-crimson

The resulting licenses/RADLib-Community-0.1.0.license.json can be hosted on a public GitHub release or downloaded from a website. Commercial license files should use createNodeLockedLicense() and include both machineFingerprint and licenseePublicKeyFingerprint.