BastionGuard::Activation Namespace Reference

Namespaces
namespace	anonymous_namespace{activation.cpp}

Classes
struct	ActivationStatus

Functions
std::string	activation_engine_id ()
std::string	machine_id ()
std::string	motherboard_serial ()
std::string	activation_key_path ()
ActivationStatus	validate_key (const std::string &raw_key)
ActivationStatus	validate_installed_key ()
bool	save_key_if_valid (const std::string &raw_key, std::string &error_message)

Function Documentation

activation_engine_id()

std::string BastionGuard::Activation::activation_engine_id

(

)

Definition at line 675 of file activation.cpp.

                                 {
    return std::string(kActivationEngineId);
}

References activation_engine_id().

Referenced by activation_engine_id(), and validate_key().

activation_key_path()

std::string BastionGuard::Activation::activation_key_path

(

)

Definition at line 710 of file activation.cpp.

                                {
    const std::string system_path = system_activation_key_path();
    std::error_code ec;
    if (std::filesystem::exists(system_path, ec) && !ec) {
        return system_path;
    }
 
    if (is_running_as_root()) {
        return system_path;
    }
 
    return user_activation_key_path();
}

References activation_key_path().

Referenced by activation_key_path().

machine_id()

std::string BastionGuard::Activation::machine_id

(

)

Definition at line 679 of file activation.cpp.

                       {
    const std::string raw_machine_id = read_first_existing_file({
        "/etc/machine-id",
        "/var/lib/dbus/machine-id"
    });
 
    const std::string cleaned = compact_hex_machine_id(raw_machine_id);
    if (cleaned.size() == 32) {
        // Use the real Linux machine-id exactly as requested: this is the
        // identifier shown in About → Activation and stored inside keys.
        return cleaned;
    }
 
    // Fallback only for unusual systems where /etc/machine-id is unavailable
    // or malformed. This keeps activation usable without changing the public UI.
    return legacy_application_machine_id();
}

References machine_id().

Referenced by machine_id(), and validate_key().

motherboard_serial()

std::string BastionGuard::Activation::motherboard_serial

(

)

Definition at line 697 of file activation.cpp.

                               {
    const std::string serial = read_first_valid_serial({
        "/sys/class/dmi/id/board_serial",
        "/sys/devices/virtual/dmi/id/board_serial",
        "/sys/class/dmi/id/product_serial",
        "/sys/devices/virtual/dmi/id/product_serial",
        "/sys/class/dmi/id/product_uuid",
        "/sys/devices/virtual/dmi/id/product_uuid"
    });
 
    return serial;
}

References motherboard_serial().

Referenced by motherboard_serial(), and validate_key().

save_key_if_valid()

bool BastionGuard::Activation::save_key_if_valid	(	const std::string &	raw_key,
		std::string &	error_message )

Definition at line 974 of file activation.cpp.

                                                                           {
    const ActivationStatus status = validate_key(raw_key);
    if (!status.active) {
        error_message = status.message;
        return false;
    }
 
    const std::string target_path = preferred_activation_key_path_for_save();
    const std::string dir = std::filesystem::path(target_path).parent_path().string();
 
    std::error_code ec;
    std::filesystem::create_directories(dir, ec);
    if (ec) {
        error_message = "Cannot create activation directory '" + dir + "': " + ec.message();
        return false;
    }
 
    std::ofstream output(target_path, std::ios::binary | std::ios::trunc);
    if (!output.is_open()) {
        error_message = "Cannot write activation key file: " + target_path;
        if (!is_running_as_root() && target_path.rfind("/etc/", 0) == 0) {
            error_message += " Run the application as root/pkexec.";
        }
        return false;
    }
 
    output << extract_activation_key(raw_key) << "\n";
    output.close();
 
    if (!output) {
        error_message = "Activation key file was opened but could not be written completely: " + target_path;
        return false;
    }
 
    std::error_code verify_ec;
    if (!std::filesystem::exists(target_path, verify_ec) || verify_ec) {
        error_message = "Activation key was not created at: " + target_path;
        if (verify_ec) error_message += " (" + verify_ec.message() + ")";
        return false;
    }
 
    const ActivationStatus saved_status = validate_key(read_file_all(target_path));
    if (!saved_status.active) {
        error_message = "Activation key was written but could not be read back as valid: " + saved_status.message;
        return false;
    }
 
    error_message.clear();
    return true;
}

References BastionGuard::Activation::ActivationStatus::active, BastionGuard::Activation::ActivationStatus::message, save_key_if_valid(), and validate_key().

Referenced by save_key_if_valid().

validate_installed_key()

ActivationStatus BastionGuard::Activation::validate_installed_key

(

)

Definition at line 950 of file activation.cpp.

                                          {
    const std::string system_path = system_activation_key_path();
    const std::string user_path = user_activation_key_path();
 
    std::error_code ec;
    if (std::filesystem::exists(system_path, ec) && !ec) {
        ActivationStatus system_status = validate_key(read_file_all(system_path));
        if (system_status.active) {
            return system_status;
        }
 
        if (std::filesystem::exists(user_path, ec) && !ec) {
            ActivationStatus user_status = validate_key(read_file_all(user_path));
            if (user_status.active) {
                return user_status;
            }
        }
 
        return system_status;
    }
 
    return validate_key(read_file_all(user_path));
}

References BastionGuard::Activation::ActivationStatus::active, validate_installed_key(), and validate_key().

Referenced by validate_installed_key().

validate_key()

ActivationStatus BastionGuard::Activation::validate_key

(

const std::string &

raw_key

)

Definition at line 724 of file activation.cpp.

                                                        {
    ActivationStatus status;
    status.machine_id = machine_id();
    status.motherboard_serial = motherboard_serial();
 
    const std::string key = extract_activation_key(raw_key);
    if (key.empty()) {
        status.message = "No activation key installed.";
        return status;
    }
 
    const auto apply_common_field_checks = [&](const std::string& product,
                                               const std::string& key_machine_raw,
                                               const std::string& key_motherboard_raw,
                                               const std::string& owner,
                                               const std::string& edition,
                                               const std::string& expires) -> bool {
        if (product != kProductId) {
            status.message = "Activation key is for a different product.";
            return false;
        }
 
        if (key_machine_raw.empty()) {
            status.message = "Activation key does not contain a Machine ID.";
            return false;
        }
 
        if (key_motherboard_raw.empty()) {
            status.message = "Activation key does not contain a motherboard serial.";
            return false;
        }
 
        if (status.motherboard_serial.empty()) {
            status.message = "Motherboard serial could not be read on this computer.";
            return false;
        }
 
        const std::string key_machine = compact_hex_machine_id(key_machine_raw);
        const std::string current_machine = compact_hex_machine_id(status.machine_id);
        const std::string legacy_machine = compact_hex_machine_id(legacy_application_machine_id());
 
        if (key_machine != current_machine && key_machine != legacy_machine) {
            status.message = "Activation key is for a different machine-id.";
            return false;
        }
 
        const std::string key_motherboard = canonical_serial(key_motherboard_raw);
        const std::string current_motherboard = canonical_serial(status.motherboard_serial);
 
        if (key_motherboard != current_motherboard) {
            status.message = "Activation key is for a different motherboard serial.";
            return false;
        }
 
        status.owner = owner.empty() ? "Donation supporter" : owner;
        status.edition = edition.empty() ? "Donation" : edition;
        status.expires = expires.empty() ? "never" : lowercase(expires);
 
        if (!is_valid_expiry(status.expires)) {
            status.expired = true;
            status.message = "Activation key contains an invalid expiry date.";
            return false;
        }
 
        if (has_expired(status.expires)) {
            status.expired = true;
            status.message = "Activation key has expired.";
            return false;
        }
 
        status.active = true;
        status.message = "Activation is valid.";
        return true;
    };
 
    // Preferred clean key format: BGRD3. This avoids SHA-based signing and uses
    // a simple owner-only donation code calculated from product, engine,
    // /etc/machine-id, motherboard serial, edition, expiry, and the private
    // owner secret. The visible owner name is informational and does not affect
    // the code, which avoids UTF-8/locale copy-paste mismatches.
    if (key.find(std::string(kKeyPrefixV3)) != std::string::npos) {
        const auto fields = parse_key_block(key);
        const std::string code = normalize_activation_code(field_or_empty(fields, "CODE"));
        const std::string product = trim(field_or_empty(fields, "PRODUCT"));
        const std::string engine = normalize_engine_id(field_or_empty(fields, "ENGINE"));
        const std::string machine = compact_hex_machine_id(field_or_empty(fields, "MACHINE"));
        const std::string motherboard = canonical_serial(field_or_empty(fields, "MOTHERBOARD"));
        const std::string owner = trim(field_or_empty(fields, "OWNER"));
        const std::string edition = trim(field_or_empty(fields, "EDITION"));
        const std::string expires = lowercase(trim(field_or_empty(fields, "EXPIRES")));
 
        if (field_or_empty(fields, "FORMAT") != std::string(kKeyPrefixV3)) {
            status.message = "Invalid BGRD3 activation key: BGRD3 format line is missing.";
            return status;
        }
 
        if (code.size() != 25) {
            status.message = "Invalid BGRD3 activation key: CODE must contain 25 letters/numbers.";
            return status;
        }
 
        if (engine.empty()) {
            status.message = "Invalid BGRD3 activation key: ENGINE field is missing.";
            return status;
        }
 
        const std::string current_engine = normalize_engine_id(activation_engine_id());
        if (normalize_engine_id(engine) != current_engine) {
            status.message = "Activation engine mismatch. App engine is " + current_engine +
                " but key engine is " + engine +
                ". Rebuild and reinstall the app and generate the keygen from the same package.";
            return status;
        }
 
        const std::string canonical_payload = code_payload_v3(fields);
        const std::string expected_code = normalize_activation_code(generate_activation_code_v3(canonical_payload));
        if (code != expected_code) {
            status.message = "BGRD3 activation code is not valid. The key was not saved. Generate the key again with the matching keygen and copy the whole BEGIN/END block.";
            return status;
        }
 
        apply_common_field_checks(product, machine, motherboard, owner, edition, expires);
        return status;
    }
 
    // Legacy clean key format: multiline BGRD2 block. The key explicitly
    // carries the activation engine so mismatched app/keygen builds are
    // diagnosed before signature validation.
    if (key.find(std::string(kKeyPrefixV2)) != std::string::npos) {
        const auto fields = parse_key_block(key);
        const std::string signature = uppercase(trim(field_or_empty(fields, "SIGNATURE")));
        const std::string product = trim(field_or_empty(fields, "PRODUCT"));
        const std::string engine = normalize_engine_id(field_or_empty(fields, "ENGINE"));
        const std::string machine = compact_hex_machine_id(field_or_empty(fields, "MACHINE"));
        const std::string motherboard = canonical_serial(field_or_empty(fields, "MOTHERBOARD"));
        const std::string owner = trim(field_or_empty(fields, "OWNER"));
        const std::string edition = trim(field_or_empty(fields, "EDITION"));
        const std::string expires = lowercase(trim(field_or_empty(fields, "EXPIRES")));
 
        if (signature.size() != 40) {
            status.message = "Invalid BGRD2 activation key: SIGNATURE must contain 40 hexadecimal characters.";
            return status;
        }
        for (unsigned char c : signature) {
            if (std::isxdigit(c) == 0) {
                status.message = "Invalid BGRD2 activation key: SIGNATURE contains a non-hexadecimal character.";
                return status;
            }
        }
 
        if (engine.empty()) {
            status.message = "Invalid BGRD2 activation key: ENGINE field is missing.";
            return status;
        }
 
        const std::string current_engine = normalize_engine_id(activation_engine_id());
        if (normalize_engine_id(engine) != current_engine) {
            status.message = "Activation engine mismatch. App engine is " + current_engine +
                " but key engine is " + engine +
                ". Rebuild and reinstall the app and generate the keygen from the same package.";
            return status;
        }
 
        const std::string canonical_payload = canonical_v2_payload(fields);
        const std::string expected_signature = sign_payload_v2(canonical_payload);
        if (signature != expected_signature) {
            status.message = "BGRD2 activation key signature is not valid. The key was not saved. Generate the key again with the matching keygen and copy the whole BEGIN/END block.";
            return status;
        }
 
        apply_common_field_checks(product, machine, motherboard, owner, edition, expires);
        return status;
    }
 
    // Legacy BGRD1 one-line key support.
    const std::string prefix = std::string(kKeyPrefixV1) + ".";
    if (key.rfind(prefix, 0) != 0) {
        status.message = "Invalid activation key prefix. Paste a BGRD3 activation block generated by the matching keygen.";
        return status;
    }
 
    const auto first_dot = key.find('.', prefix.size());
    if (first_dot == std::string::npos) {
        status.message = "Malformed legacy activation key.";
        return status;
    }
 
    const std::string payload_b64 = key.substr(prefix.size(), first_dot - prefix.size());
    const std::string signature = uppercase(key.substr(first_dot + 1));
 
    if (signature.size() != 40) {
        status.message = "Invalid legacy activation key signature length.";
        return status;
    }
 
    const auto decoded_payload = base64url_decode(payload_b64);
    if (!decoded_payload.has_value()) {
        status.message = "Legacy activation key payload is not valid base64url.";
        return status;
    }
 
    const std::string expected_signature = sign_payload_v1(*decoded_payload);
    if (signature != expected_signature) {
        status.message = "Legacy activation key signature is not valid. Generate a new BGRD3 key with the matching keygen.";
        return status;
    }
 
    const auto fields = parse_payload(*decoded_payload);
    const auto product_it = fields.find("product");
    const auto machine_it = fields.find("machine");
    const auto motherboard_it = fields.find("motherboard");
    const auto owner_it = fields.find("owner");
    const auto edition_it = fields.find("edition");
    const auto expires_it = fields.find("expires");
 
    apply_common_field_checks(
        product_it != fields.end() ? product_it->second : std::string{},
        machine_it != fields.end() ? machine_it->second : std::string{},
        motherboard_it != fields.end() ? motherboard_it->second : std::string{},
        owner_it != fields.end() ? owner_it->second : std::string{},
        edition_it != fields.end() ? edition_it->second : std::string{},
        expires_it != fields.end() ? expires_it->second : std::string{}
    );
    return status;
}

References activation_engine_id(), BastionGuard::Activation::ActivationStatus::active, BastionGuard::Activation::ActivationStatus::edition, BastionGuard::Activation::ActivationStatus::expired, BastionGuard::Activation::ActivationStatus::expires, BastionGuard::Activation::ActivationStatus::machine_id, machine_id(), BastionGuard::Activation::ActivationStatus::message, BastionGuard::Activation::ActivationStatus::motherboard_serial, motherboard_serial(), BastionGuard::Activation::ActivationStatus::owner, and validate_key().

Referenced by save_key_if_valid(), validate_installed_key(), and validate_key().