Quickstart

$ curl -fLO https://sigil.enigmahq.sh/downloads/sigil-sdk-rust-0.2.0.tar.gz
$ echo "01d38edffdcfe0138b50fe8d66d243b6704164d2910938f1cb12a0a19dbc24a8  sigil-sdk-rust-0.2.0.tar.gz" | shasum -a 256 -c
sigil-sdk-rust-0.2.0.tar.gz: OK
$ tar xzf sigil-sdk-rust-0.2.0.tar.gz

$ cargo new my-engine
$ cd my-engine

[dependencies]
sigil-lease = { path = "../sigil-sdk-rust-0.2.0/lease", features = ["std"] }
sigil-client = { path = "../sigil-sdk-rust-0.2.0/client" }

$ curl -fsS https://sigil.enigmahq.sh/v1/client/apps/app_YOUR_APP_ID/keys -o sigil-keys.json

//! A native program whose core only runs with a Sigil license.
//!
//!   my-engine activate SGL-XXXXX-…   take a seat on this machine, cache the lease
//!   my-engine run [message]          the protected work: refuses without a license
//!   my-engine status                 what the gate sees, verified offline
//!   my-engine deactivate             release the seat
//!
//! Environment: SIGIL_API (default https://sigil.enigmahq.sh), SIGIL_STATE
//! (default ./.sigil).

use std::process::ExitCode;

use sigil_client::{Client, Config};
use sigil_lease::{Gate, Keyset};

// Downloaded from the portal (or GET /v1/client/apps/<app>/keys) and compiled
// in. This is where trust is fixed: the gate accepts leases signed by these
// keys and no others, whatever the host or the network says at run time.
static KEYS: &[u8] = include_bytes!("../sigil-keys.json");

// The entitlement the protected work needs: one of the policy's entitlements.
const FEATURE: &str = "cosign";

fn main() -> ExitCode {
    let keyset = Keyset::parse(KEYS).expect("sigil-keys.json is a Sigil keyset");
    let api = std::env::var("SIGIL_API").unwrap_or_else(|_| "https://sigil.enigmahq.sh".into());
    let state = std::env::var("SIGIL_STATE").unwrap_or_else(|_| ".sigil".into());
    let client = Client::new(Config::new(api, keyset.app(), state).app_version(env!("CARGO_PKG_VERSION")));
    let mut gate = Gate::new(keyset);

    let args: Vec<String> = std::env::args().skip(1).collect();
    let result = match args.first().map(String::as_str) {
        Some("activate") => match args.get(1) {
            Some(key) => client.activate(key).map(|s| {
                let l = s.license.expect("an online activation describes its license");
                println!("✔ activated: {} · {} · seat {}/{}", l.name, l.entitlements.join(", "), l.machines_used, l.max_machines);
            }),
            None => {
                eprintln!("usage: activate <license-key>");
                return ExitCode::from(2);
            }
        },
        Some("run") => client.unlock(&mut gate).and_then(|_| {
            gate.require_now(FEATURE)?; // the check: inside this binary, against the keys above
            let message = args.get(1).map(String::as_str).unwrap_or("hello");
            println!("✔ running · {}", protected_work(message));
            Ok(())
        }),
        Some("status") => client.unlock(&mut gate).map(|u| {
            let c = &u.verified.claims;
            println!("✔ {:?} · licensed to {} · {} · lease until {}", u.verified.status, c.lic, c.ent.join(", "), c.exp);
        }),
        Some("deactivate") => client.deactivate(Some(&mut gate)).map(|_| println!("✔ seat released")),
        Some("fingerprint") => client.fingerprint().map(|fp| println!("{fp}")),
        _ => {
            eprintln!("commands: activate <key> | run [message] | status | deactivate | fingerprint");
            return ExitCode::from(2);
        }
    };
    match result {
        Ok(()) => ExitCode::SUCCESS,
        Err(e) => {
            eprintln!("✖ not licensed: {e}");
            ExitCode::from(3)
        }
    }
}

/// Stands in for the code worth protecting.
fn protected_work(message: &str) -> String {
    let digest = message.bytes().fold(0xcbf2_9ce4_8422_2325u64, |h, b| (h ^ b as u64).wrapping_mul(0x0100_0000_01b3));
    format!("co-signed \"{message}\" → {digest:016x}")
}

$ cargo run -q -- run
✖ not licensed: NOT_ACTIVATED: no license on this machine: activate a license key first

SGL-7KQ2M-4WZ9P-R3T8X-B6N1C-H4X9D

$ cargo run -q -- activate SGL-7KQ2M-4WZ9P-R3T8X-B6N1C-H4X9D
✔ activated: conFIEL Engine (prod) · cosign · seat 1/1
$ cargo run -q -- run "invoice 42"
✔ running · co-signed "invoice 42" → 7f3e1c0d2b9a4e61
$ cargo run -q -- status
✔ Valid · licensed to conFIEL Engine (prod) · cosign · lease until 1791234567