cryptship v0.1.0

First tagged release of cryptship — a toolkit to ship encrypted, license-gated application code inside Docker images. The image on disk is ciphertext; a small loader decrypts and runs the app only with a valid license.

Highlights

• Crypto: AES-256-GCM payloads; Ed25519 licenses (detached signature over the stored claim bytes); HKDF context-bound KEK so editing a claim breaks the unwrap (validity == decryptability).
• Key providers: offline (none / strict / pool machine binding), online (+ a reference license server with signed, nonce-bound responses and instant revocation), and attested (confidential-compute, behind an Attester interface with a mock key broker).
• Anti-extraction: a compile/transform seam (ship bytecode, not source), loader + container hardening, and per-license watermarking.
• Signing-key rotation (key ring), configurable revocation (open / closed / grace), traversal-safe extraction.
• Three runnable demos (baseline, compiled, online) and docs (HOWTO, DIAGRAMS, ARCHITECTURE).

Honest limit

Against host root on a machine the customer controls, only the confidential-compute (attested) path prevents extraction — and only with a vendor-controlled guest. Everything else raises cost. See the README.

GPLv3.