Sigil issues license keys for the modules you distribute and binds each one to
a machine. The module checks the license itself, offline, against public keys
compiled into it. Anyone can copy the .wasm, but without a lease
signed for that machine it refuses to run.
Ed25519 leases · no_std Rust, no unsafe · First customer: conFIEL
conFIEL Core
Checked inside the module
Enforced by the module
The problem
A Chrome extension or a server image is open by construction: whoever has it can
unzip it and call your module's exports directly. A license check in the host's
JavaScript is one if away from gone.
License checked by the host
The module does whatever it's asked. The license is a suggestion the host can ignore.
License checked by the module (Sigil)
The check sits next to the code it protects, against keys compiled in at build time. There is no flag in the host to flip.
How it works
Four steps, and the last one needs no network. The quickstart walks through them with real commands.
Step 01
Add your module as an application in the portal. Sigil generates an Ed25519 key just for it, so a compromise stays contained to one product.
Step 02
Compile the application's public keyset into your module with the Rust SDK, then gate each protected export on a lease.
Step 03
Create a license under a policy: what it unlocks, where it may run, on how many machines. The key is shown once, and Sigil keeps only its hash.
Step 04
The host activates the key once and gets a short-lived lease. The module verifies it on every protected call, offline, and the install appears in your portal.
Two kinds of licence
The module checks the same lease either way. What changes is who asks for it: a customer's install with a license key, or your own backend with a service token.
For software your customers install. Each key activates on a set number of machines and draws from your account's seat pool. Leases renew in the background, and a machine that can never go online gets a lease file instead.
For modules that run inside your own product, such as an extension and the server beside it. No key ships anywhere: your backend asks for a short lease each time the module is used, bound to what it is about to process, and Sigil keeps a daily count instead of a row per machine.
Security model
These checks run in your binary, not in Sigil's servers. Once a module has a lease, Sigil being down doesn't stop it, and a host that lies doesn't get further.
01
A lease is a compact JWS signed with the application's Ed25519 key. The module checks the signature before it reads anything else, against public keys fixed when it was built.
02
Each lease names the machine it was issued to, as a hash scoped to your application. A lease copied to another machine fails, and installs can't be correlated across vendors.
03
Policies decide which exports a license unlocks and where it may run. A server license doesn't unlock an extension build.
04
Leases expire on their own, with a grace window you set. A clock wound back while the module holds a lease is caught.
05
Revoke in the portal and renewals stop. The lease's lifetime is the most an offline install can run afterwards, and you choose it.
In production
Keys get rotated, customers stop paying, tokens leak. Each of these is one action in the portal, and none of them needs a new build in your users' hands.
01
Every application keeps a standby key next to the active one, and both go into each build. Rotating promotes the standby, so builds already installed, or waiting on a store review, keep working.
02
Pause a customer who hasn't paid and turn them back on when they do, or end a licence for good. Leases already issued run out on their own, and you choose how long they are.
03
Your backend's token works for one application and only the scopes you give it. Sigil shows it once and keeps a hash. A leaked token is revoked in the portal and replaced in a minute.
04
Every activation, refusal, issue, rotation and status change is recorded with its reason, beside daily counts of leases issued and refused.
Secure distribution
Store rules forbid fetching code at run time or shipping it encrypted. Sigil works with that: the module ships in the package, and the lease that gates it is data.
Free and paid users carry the same package. The paid tier is a license key, not a different download, and every install that redeems it shows up in your portal.
For a server that can never reach Sigil, the customer sends you its fingerprint and you send back a lease file from the portal. It takes a seat like any other install.
The default
Comparison
Putting the check in the host is easy to bypass. Encrypting or fetching the module breaks store rules and offline use. Sigil puts the check in the module and keeps the module itself plain.
| Property | Check in host JS | Encrypt or fetch the WASM | Sigil |
|---|---|---|---|
| Survives a patched host | No | Until the key is in memory | Yes |
| Allowed by the Chrome Web Store | Yes | No | Yes |
| Works offline | Yes | After first fetch | Within the lease |
| Bound to a machine | No | No | Yes |
| Seats and revocation | Build it yourself | Build it yourself | Portal |
| Rotate the signing key without a rebuild | No | Rebuild and re-ship | Yes |
| Audit trail of installs | No | No | Yes |
Sigil is a commercial control on a client-side artifact, not DRM: someone who patches the module binary itself can remove the check. The threat model lists exactly what is and isn't covered.
First customer
conFIEL's threshold-signing core for the Mexican e.firma is a Rust WebAssembly module. It ships inside a Chrome extension and runs on servers.
conFIEL.
The module splits an e.firma key so that no single party can sign alone. conFIEL needed that module to run only for paying firms, with the check inside the module, where a patched extension can't skip it.
conFIEL holds one instance licence in Sigil, for the two places its module runs. Its own backend mints a short lease per use with a service token, so no key ever ships in the extension. The module verifies each lease before it deals or signs, and a lease issued for one e.firma can't drive another.
Before going to production, conFIEL rehearsed the bad days on staging: a suspended licence, Sigil unreachable, a revoked token, the module copied out of the extension, a key rotation and a revoked licence. Each was refused, or kept working, exactly as designed.
One instance licence · two instances · in production
deal, sign · every install · 1-hour lease per use
sign · conFIEL's co-signer · 1-hour lease per use
no lease, no deal and no signature, until it answers again
FAQ
A small token, signed by your application's key, that says "this license may run these features on this machine and platform until this time". Activating a license key gets one, and the module verifies it offline. Leases are short-lived and renew in the background while the machine is online.
No. The host needs the network once, to activate, and again now and then to renew. The module itself only reads the lease it's given and the keys compiled into it. A lease keeps working offline for the time you set in the policy, plus a grace period.
Someone who patches the module binary can remove the check. Sigil doesn't claim otherwise. What it does stop is everything short of that: calling the exports directly, editing a lease, reusing a lease on another machine, sharing one key without limit, and using a revoked license past its lease. See the threat model.
The verifier is a Rust crate (no_std, no unsafe). It builds into a wasm32-unknown-unknown module that imports nothing, or into a native program. A JavaScript SDK handles activation and renewal for WASM hosts such as extensions and Node, and a Rust client does the same for native programs.
Nothing your users notice. Each build embeds the application's active key and its standby key. Rotation promotes the standby, retires the old key and creates the next standby, so every build already in the field keeps verifying. Ship your next release with the new keyset and the cycle repeats. A key that leaked stays trusted by builds that embedded it until they update; the threat model covers that case.
No. That's what instance licences are for: your backend holds a service token and asks Sigil for a short lease each time the module is used. There are no keys to hand out and no seats to count, and suspending the licence stops the next lease.
License keys only as SHA-256 hashes, machines only as application-scoped fingerprints, and the labels and versions your host chooses to send. Raw machine identifiers never leave the machine.
Sigil is in use with design partners. Staff sign in to the portal through their organisation's identity provider; for conFIEL that's conFIEL Auth. To become a design partner, write to ultra@enigma.sh.
Download the SDK, gate one export, issue a key, and watch the install appear in the portal. It takes about fifteen minutes.
Rust SDK v0.2.0 · WASM and native · Portal via conFIEL Auth