NK Ed25519 signing + compile-time pubkey embedding. Plan + IP + machine ID 3-factor binding. Required for all paid editions.
3-piece machine fingerprint
- /etc/machine-id (written by systemd, boot-stable, 0644 readable by anyone)
- /etc/hostname (0644)
- /sys/class/dmi/id/product_uuid (0444/0400 distro-dependent; placeholder if unreadable)
SHA-256 over the three. cli machine-id detects placeholder → refuses output + tells user to run with sudo.
Two-factor (v50)
v44+ IP-type tokens also carry machine_id_hash; verify checks both. v50 ip_in_cidr has 3-way fallback: ipify HTTP / UDP connect trick / if_addrs interface scan, so NAT customers activate correctly.
first_seen lock
After first activation, first_seen_machine_id_hash is locked. Another machine using the same license is rejected (anti NAT-sharing).