Software License Dongle for Python

The Python binding is pure ctypes over the core library, so there is no compiler involved at install time and no wheel to build per interpreter version.

pip install keynub-licdongleCode language: Bash (bash)

Reading a License

import keynub_licdongle as kn

with kn.LicenseDongleContext() as ctx:
    with ctx.open() as dongle:               # first dongle found
        dongle.verify_genuine()              # raises unless genuine

        with dongle.open_session() as session:
            license = session.read_record("license")Code language: Python (python)

Python Needs This More Than Most Languages

Python ships as source, or as a bundle a determined person can unpack. PyInstaller, Nuitka and cx_Freeze raise the effort a little, but .pyc files decompile well and a licence check written as an if is a one-line patch. This is not a reason to avoid Python; it is a reason to put the dongle somewhere that patching cannot reach:

# Weak -- delete one line and it is gone.
if is_licensed:
    enable_feature()

# Strong -- the model, table or key only decrypts with the dongle present.
weights = session.app_decrypt(encrypted_blob_shipped_with_your_installer)Code language: Python (python)

For scientific and engineering software this is usually easy, because there is almost always a calibration table, a coefficient set, a trained model or a protocol key that the program cannot invent for itself.

Shipping the Native Library with a Python Application

The wheel on PyPI is built per platform and carries the native library inside the package, under keynub_licdongle/_libs/; pip install keynub-licdongle is the whole installation, there is no compiler involved and no wheel to build per interpreter version. The binding looks for the library there first, then next to the package, then on the system search path, and KEYNUB_LICDONGLE_LIBRARY names one specific file when you want to be explicit.

Freezing tools collect Python modules but not always a stray shared library inside a package: for PyInstaller add --collect-binaries keynub_licdongle (or a hook that does the same), for Nuitka --include-package-data=keynub_licdongle, and check the frozen build once on a machine without Python. A conda environment takes the same wheel. On Linux, install the udev rule from NATIVES.md once, so that ordinary users may open the device.

Questions Python Developers Ask

Which Python Versions Does the Binding Support?

Python 3.8 and later, on Windows, Linux and macOS. It is pure ctypes over the core library, so there is no extension module to match to an interpreter version.

Can I Protect a Python Script with a Hardware Dongle When the Source Ships in the Clear?

Yes, if the check is not a branch. Python source, .pyc files and frozen bundles are all readable, so an if licensed: line is a one-line edit. Ship the data the program needs (a model, a table, a key) encrypted with the dongle’s app-data encryption and decrypt it at run time; then there is nothing to edit out.

Does a Python Application Need Administrator Rights to Talk to the Dongle?

No, and no driver either: the dongle is a USB HID device that the operating systems handle with their built-in class drivers. On Linux, install the shipped udev rule once so that ordinary users may open it; without the rule the SDK reports access denied and names the cause in its error detail.

Does a Python License Check Need an Internet Connection?

No. Verification is a local exchange between your program and the dongle over USB: the SDK checks the dongle’s certificate chain to KeyNub’s root and runs a live challenge-response. There is no activation server and no account, so the check works on air-gapped machines.

Can a License Written from Python Be Read by a Program in Another Language?

Yes. Every binding drives the same core library and the same dongle, and records and sealed data are language-neutral bytes. Your issuing tool can be written in one language and your product in another.

How Do I Test the Python Integration?

Against a dongle. The samples in the repository run against real hardware; with no dongle attached they print what to do and exit cleanly, which makes them a quick check that the library is found and the device is accessible.

Code

Runnable sample: python/verify_and_read.py. Binding source: bindings/python. Both are Apache-2.0, in the public SDK repository; the prebuilt native libraries are in the repository’s natives/ folder, one per platform.

All supported languages · All industries · Buy a KeyNub · Ask us something