Reference
Security
Sigil makes running your code without a valid license harder than writing your own binary patch. It does not make your code unreadable. Here is exactly where that line is.
What is enforced where
| Check | Where | Bypassable by |
|---|---|---|
| Seat pool, seats per license, license status, platform ∈ policy | Sigil API | nobody without your admins' sign-in |
| Signature, application, machine, platform, time window, license term, entitlement per call | inside your module or program | patching your binary |
now and platform | supplied by the host | a host that lies, within limits (below) |
| Renewal cadence, cache, UX | SDK in the host | anyone; it's convenience |
What it stops
| Attack | Result |
|---|---|
| Copy the module and call its exports directly | SIGIL_NOT_LOADED: no lease, no protected call |
| Edit a lease (more entitlements, later expiry) | SIGIL_BAD_SIGNATURE |
| Forge a lease with your own key | SIGIL_UNKNOWN_KEY / SIGIL_BAD_SIGNATURE: the keyset is compiled in, and the host can't add keys |
| Copy a lease to another machine | SIGIL_WRONG_MACHINE |
| Use a server license in an extension build | PLATFORM_NOT_ALLOWED at activation; SIGIL_WRONG_PLATFORM in the module |
| Share one key widely | SEAT_LIMIT_REACHED after its machines are taken, all visible in the portal |
| Keep using a revoked license | Stops at the next renewal; at most lease + grace offline |
| Wind the clock back (Gate) | SIGIL_CLOCK_ROLLBACK |
| A new call site forgets the check | The check lives in the protected function, not at call sites |
What it does not stop
- Patching the binary. Anyone who can edit your module can remove the check. Raising that cost is the job of obfuscation or of keeping the valuable part on a server. Sigil doesn't claim to do it.
- Reading the binary. A plain
.wasmin a package is inspectable. Sigil controls running, not reading. The protocol's strings (sigil+jwt,sigil-fp:v1:, claim names) and your public keyset are visible in the module and reveal that Sigil is in use, but not what your code does. - A host that lies about the time. A module with no imports has no clock, so the host passes
now. A hostile host can keep passing a time inside the lease, but it can't go below the lease's issue time. A Gate also refuses to go backwards once it has seen a later time. Short leases bound the damage. Per-request verification (no Gate) relies on short leases alone. - A host that lies about the platform. The platform tier is commercial, not cryptographic. It stops a lease being pasted between product tiers, not a determined host.
- Revocation while offline. An install that never renews keeps its lease until it expires. You choose that bound per policy.
Data Sigil holds
- License keys as SHA-256 hashes and the last group only. A database leak doesn't reveal working keys.
- Machines as application-scoped fingerprints. Raw machine ids never leave the host.
- Each application's Ed25519 private key, wrapped with AES-256-GCM under a key-encryption key held as a Worker secret, with the key id as associated data.
- Labels and versions your host chooses to send, and the country of each request, for the audit trail.
Portal sign-in
Staff sign in through conFIEL Auth. The session is an ID token in an HttpOnly, SameSite=Lax cookie, verified on every call. Requests that change anything must carry Sigil's own Origin, and the sign-in page only redirects to Sigil's own callback. While conFIEL Auth is a stand-in, its user directory and token key live with Sigil and are clearly marked as a mock.