Sigil issues license keys for the modules you distribute and binds each one to
a machine. The module checks the license itself, offline, against public keys
compiled into it. Anyone can copy the .wasm, but without a lease
signed for that machine it refuses to run.
Ed25519 leases · no_std Rust, no unsafe · First customer: conFIEL
conFIEL Core
Checked inside the module
Enforced by the module
The problem
A Chrome extension or a server image is open by construction: whoever has it can
unzip it and call your module's exports directly. A license check in the host's
JavaScript is one if away from gone.
License checked by the host
The module does whatever it's asked. The license is a suggestion the host can ignore.
License checked by the module (Sigil)
The check sits next to the code it protects, against keys compiled in at build time. There is no flag in the host to flip.
How it works
Four steps, and the last one needs no network. The quickstart walks through them with real commands.
Step 01
Add your module as an application in the portal. Sigil generates an Ed25519 key just for it, so a compromise stays contained to one product.
Step 02
Compile the application's public keyset into your module with the Rust SDK, then gate each protected export on a lease.
Step 03
Create a license under a policy: what it unlocks, where it may run, on how many machines. The key is shown once, and Sigil keeps only its hash.
Step 04
The host activates the key once and gets a short-lived lease. The module verifies it on every protected call, offline, and the install appears in your portal.
Security model
These checks run in your binary, not in Sigil's servers. Once a module has a lease, Sigil being down doesn't stop it, and a host that lies doesn't get further.
01
A lease is a compact JWS signed with the application's Ed25519 key. The module checks the signature before it reads anything else, against public keys fixed when it was built.
02
Each lease names the machine it was issued to, as a hash scoped to your application. A lease copied to another machine fails, and installs can't be correlated across vendors.
03
Policies decide which exports a license unlocks and where it may run. A server license doesn't unlock an extension build.
04
Leases expire on their own, with a grace window you set. A clock wound back while the module holds a lease is caught.
05
Revoke in the portal and renewals stop. The lease's lifetime is the most an offline install can run afterwards, and you choose it.
Secure distribution
Store rules forbid fetching code at run time or shipping it encrypted. Sigil works with that: the module ships in the package, and the lease that gates it is data.
Free and paid users carry the same package. The paid tier is a license key, not a different download, and every install that redeems it shows up in your portal.
For a server that can never reach Sigil, the customer sends you its fingerprint and you send back a lease file from the portal. It takes a seat like any other install.
The default
Comparison
Putting the check in the host is easy to bypass. Encrypting or fetching the module breaks store rules and offline use. Sigil puts the check in the module and keeps the module itself plain.
| Property | Check in host JS | Encrypt or fetch the WASM | Sigil |
|---|---|---|---|
| Survives a patched host | No | Until the key is in memory | Yes |
| Allowed by the Chrome Web Store | Yes | No | Yes |
| Works offline | Yes | After first fetch | Within the lease |
| Bound to a machine | No | No | Yes |
| Seats and revocation | Build it yourself | Build it yourself | Portal |
| Audit trail of installs | No | No | Yes |
Sigil is a commercial control on a client-side artifact, not DRM: someone who patches the module binary itself can remove the check. The threat model lists exactly what is and isn't covered.
First customer
conFIEL's threshold-signing core for the Mexican e.firma is a Rust WebAssembly module. It ships inside a Chrome extension and runs on servers.
conFIEL.
The module splits an e.firma key so that no single party can sign alone. conFIEL needed that module to run only for paying firms, with the check inside the module, where a patched extension can't skip it.
conFIEL holds one licence in Sigil, for the two places its module runs. Its own backend mints a short lease per use with a service token, so no key ever ships in the extension. The module verifies each lease before it deals or signs, and a lease issued for one e.firma can't drive another.
One licence · two instances
deal, sign · every install · 1-hour lease per use
sign · conFIEL's co-signer · 1-hour lease per use
FAQ
A small token, signed by your application's key, that says "this license may run these features on this machine and platform until this time". Activating a license key gets one, and the module verifies it offline. Leases are short-lived and renew in the background while the machine is online.
No. The host needs the network once, to activate, and again now and then to renew. The module itself only reads the lease it's given and the keys compiled into it. A lease keeps working offline for the time you set in the policy, plus a grace period.
Someone who patches the module binary can remove the check. Sigil doesn't claim otherwise. What it does stop is everything short of that: calling the exports directly, editing a lease, reusing a lease on another machine, sharing one key without limit, and using a revoked license past its lease. See the threat model.
The verifier is a Rust crate (no_std, no unsafe). It builds into a wasm32-unknown-unknown module that imports nothing, or into a native program. A JavaScript SDK handles activation and renewal for WASM hosts such as extensions and Node, and a Rust client does the same for native programs.
License keys only as SHA-256 hashes, machines only as application-scoped fingerprints, and the labels and versions your host chooses to send. Raw machine identifiers never leave the machine.
Sigil is in use with design partners. Staff sign in to the portal through their organisation's identity provider; for conFIEL that's conFIEL Auth. To become a design partner, write to ultra@enigma.sh.
Download the SDK, gate one export, issue a key, and watch the install appear in the portal. It takes about fifteen minutes.
Rust SDK v0.2.0 · WASM and native · Portal via conFIEL Auth