Haskell reaches the dongle through the SDK’s flat C API, called through function pointers resolved at run time, so the package is pure Haskell with nothing to link: no C sources, no extra-libraries, no build flags. keynub-licdongle from Hackage, GHC 9.4 or later, on Windows, Linux and macOS. For a licensing component that is the right shape: nothing sits in the path of the check that a customer could substitute for something more agreeable.
cabal install keynub-licdongle
-- or in your .cabal file:
build-depends: keynub-licdongleCode language: Haskell (haskell)Reading a license
import KeyNub.LicDongle
main :: IO ()
main = withDongle open $ \d -> do -- first dongle, or openSerial "..."
_ <- verifyGenuine d -- throws unless genuine
license <- withSession d $ readRecord d "license"
...Code language: Haskell (haskell)What you are actually protecting
Haskell software that is sold tends to be the kind where the value is in what the program knows: a pricing engine, a compiler for a domain language, a verification tool, a trading model. The source may be compiled to native code, but a check that returns a Bool is still one conditional branch in that binary, and patching one of those is a beginner exercise.
So the strong pattern is the one to reach for: the data the program needs only exists when the dongle is present.
-- Weak: one patched branch.
ok <- isGenuine d
unless ok exitFailure
-- Strong: the parameters only exist with the dongle present.
parameters <- decodeParameters <$> withSession d (appDecrypt d sealedBlobShippedWithYourProgram)Code language: Haskell (haskell)Failures are LicDongleError exceptions carrying the status (NoDevice, NotGenuine, AuthRequired, …), the operation and the library’s detail; isGenuine fails closed. withDongle and withSession are brackets, so the dongle and the session are released on every exit path. The package calls the SDK’s flat companion API, the one designed for foreign function interfaces: integer handles and buffers, no hand-written structure layouts.
Shipping the native library with a Haskell application
The keynub-licdongle package is pure Haskell over the SDK’s flat API through dynamic foreign imports: nothing is linked at build time and there are no C stubs, so a Cabal or Stack build needs no extra-lib-dirs. The library is loaded on the first call from setLibraryPath, KEYNUB_LICDONGLE_FLAT_LIBRARY, the natives/ folder of an SDK clone, or the system search path.
A shipped executable takes keynub_licdongle_flat for its platform beside it or on the search path. The prebuilt libraries for every platform are in the SDK repository’s natives/<platform>/ folder, with a SHA-256 manifest: Windows x64, x86 and ARM64, Linux x86_64 and aarch64, and universal macOS binaries for Intel and Apple silicon. On Linux, install the udev rule from NATIVES.md once, so that ordinary users may open the device.
Questions Haskell developers ask
Which GHC versions does the binding support?
GHC 8.10 and later (base 4.14), tested with GHC 9.12, on Windows, Linux and macOS.
Does a Haskell application need administrator rights to talk to the dongle?
No, and no driver either: the dongle is a USB HID device that the operating systems handle with their built-in class drivers. On Linux, install the shipped udev rule once so that ordinary users may open it; without the rule the SDK reports access denied and names the cause in its error detail.
Does a Haskell license check need an internet connection?
No. Verification is a local exchange between your program and the dongle over USB: the SDK checks the dongle’s certificate chain to KeyNub’s root and runs a live challenge-response. There is no activation server and no account, so the check works on air-gapped machines.
Who can read the license records on a dongle?
Anyone holding the dongle: a program opens a session and reads records, and can decrypt data sealed for that dongle. Writing records, erasing them and incrementing counters need your write key. What the dongle guarantees is that none of it is available without the dongle present.
Can a license written from Haskell be read by a program in another language?
Yes. Every binding drives the same core library and the same dongle, and records and sealed data are language-neutral bytes. Your issuing tool can be written in one language and your product in another.
How do I test the Haskell integration?
Against a dongle. The samples in the repository run against real hardware; with no dongle attached they print what to do and exit cleanly, which makes them a quick check that the library is found and the device is accessible.
Code
Runnable sample: haskell/app/VerifyAndRead.hs. Binding source: bindings/haskell. Both are Apache-2.0, in the public SDK repository; the prebuilt native libraries are in the repository’s natives/ folder, one per platform.
All supported languages · All industries · Buy a KeyNub · Ask us something
