Administration

Release verification and your licence binding

How an on-prem installation checks that it runs the files Yavaren released, and how its licence is bound to it. What happens after a move or a restore.

Your on-prem installation checks two things on its own: that it runs exactly what Yavaren released, and that its licence belongs to it. Neither check ever deletes anything.

The files Yavaren released

Each Yavaren image carries a list of all its files with their fingerprints (SHA-256), signed by Yavaren. Every time the control plane or a runner starts, it checks the signature and then every file. This takes a fraction of a second.

• When everything matches, nothing is shown. System › Cloud Link › Release integrity and licence binding shows that the release matches, and how long the check took.
• When a file was changed, removed or added, a production installation does not start. The message names the files. Reinstall the images of your release (or restore those files), then start again. If your installation is connected, Yavaren support is told at the same time.
• Outside production the installation starts anyway and shows a warning.

The installer also checks the images themselves before it starts them. It uses cosign when it is installed. Otherwise it checks Yavaren's signature of the image fingerprints, and no extra tool is needed. For an offline bundle loaded by hand, run ./load-images.sh --trust <the release key Yavaren gave you> and it checks the images too.

Your licence belongs to this installation

When the installation first starts, it records its licence together with a fingerprint of this installation. The fingerprint is made from the installation's own id and a random key. No hardware is used, so moving the virtual machine or restoring a backup of the same installation changes nothing.

If the licence is used somewhere it was not issued for (for example, copied to a second installation):

• For 14 days everything keeps working, with a warning on System › Cloud Link.
• After that, new jobs and new engineers are refused. Work that is running finishes, everything stays readable and exportable, and nothing is deleted.

After a move or a restore

1. Open System › Cloud Link › Release integrity and licence binding and copy This installation's fingerprint (it starts with fp_).
2. Send it to Yavaren support with a short reason.
3. Yavaren issues your licence again, bound to the new fingerprint: - Connected: it arrives at the next licence refresh. You can click Check now on the Cloud Link page. - Air-gapped: you receive a licence file. Install it under Install a licence file.

Licences issued before this check existed keep working. They are treated as belonging to the installation that first starts with them.