Guides

Using the portal

The portal at sigil.enigmahq.sh/portal is where your staff run licensing: applications, policies, licenses, installs and the audit trail.

Sign-in: conFIEL Auth

Sigil doesn't keep passwords for its users. Sign in with conFIEL Auth sends you to conFIEL's identity provider. You come back with a session that lasts eight hours and lives in an HttpOnly cookie. On the first sign-in from your organisation, Sigil creates the account and sets its seat pool from your conFIEL entitlement.

Overview

An account that holds only instance licences sees its licences, instances and the leases its backend minted and had refused over 30 days. Otherwise: seats allocated against your pool, live installs by platform, active licenses, recent denials, activations over 30 days and the latest activity. A new account also gets a getting started checklist that ticks itself off as you register an application, create a policy, issue a license and see the first install.

Licenses

• Issue a key licence: pick an application and policy, name the licensee, and optionally override the machine count. The key is shown once; copy it into your sales or onboarding flow.
• Issue an instance licence: choose Instance licence as the kind and name it. On its page, add an instance for each place your product runs (name, platform, entitlements, longest lease, grace). Each instance shows the leases minted and refused in the last 7 days.
• Suspend / reinstate: renewals are refused while suspended.
• Revoke: renewals stop and the license's seats return to the pool. Installs that already hold a lease keep running offline until it lapses, at most lease + grace. That bound is the price of working offline, and you set it per policy.
• Release a seat: on a license's page, free one machine's seat. The machine must activate again after its current lease lapses.

Service tokens

On an application's page, under Service tokens: name the token, tick its scopes (mint leases, revoke licences) and create it. The token is shown once; put it in your backend's secrets. The list shows each token's last four characters, when it was last used, and a Revoke button.

Installs

Every machine that holds or has held a seat, with the label and version its host sent, its platform, when it was last seen, and how long its lease has left. A machine that hasn't renewed shows lease lapsed. A released or revoked one shows released.

Air-gapped activation

For a machine that can never reach Sigil:

1. On the machine, print its fingerprint (my-engine fingerprint in the quickstart program, or Client::fingerprint()).
2. On the license's page, under Air-gapped activation, paste it, pick the platform and validity, and issue.
3. Send the lease to the customer. The program installs it with Client::import_offline_lease.

An offline lease takes a seat like any activation and can't be renewed. Issue a new one before it expires.

The standby key

Your builds trust only the keys in the keyset they embedded. So every application keeps two live keys, shown under Signing keys on its page:

• Active · signs leases. Every lease Sigil issues is signed with it.
• Standby · published, signs nothing. It is in the keyset you download, so every build you ship carries it, but Sigil never signs with it until you rotate.

Rotating promotes the standby. Builds already in your users' hands trust it, so nothing breaks, and nothing has to wait for a rebuild or a store review. A new application is created with both keys. One created before standby keys existed shows a warning instead (No standby key) and rotation is blocked until you press Create standby key. A new standby protects only the builds that carry it, so download the keyset, rebuild and ship.

The habit that makes it work: ship every release with the keyset as it is that day.

Key rotation

On an application's page, Rotate key (confirmed as Promote standby) does three things at once. The standby key starts signing every new lease. The active key is retired: it stays in the keyset so leases it signed run until they lapse. A new standby is created. Builds whose keyset was downloaded after the promoted key became standby keep working. Older builds refuse new leases with SIGIL_UNKNOWN_KEY. Afterwards, download the keyset and ship it with your next release, so your builds carry the new standby before you next need it.

If you rotate because a key may have leaked, rotating stops Sigil from using it, but builds that embedded it still trust it until they are replaced. See the protocol.

Activity

An append-only trail of every issuance, activation, renewal, denial (with its reason), revocation, release, rotation and seat change, with the country the request came from.