Skip to content

Tool Kits 2.7.31 — Signed License Verification (Pre-release)

Pre-release
Pre-release

Choose a tag to compare

View all tags
@ekods ekods released this 22 Oct 07:42
v2.7.31
37a6295

Tool Kits 2.7.31 — Signed License Verification

This is a pre-release. The stable release remains v2.7.30.

Deployment requirement

Deploy the NexaMonitor signing API and its matching private key before installing this plugin. The production server deployment has not completed. This version requires signed license receipts and rejects unsigned activation and legacy local HMAC credentials. Installing it against the previous server will prevent licensed features from activating. The private signing key is not included in the plugin ZIP.

Changes

  • Verify RSA-SHA256 license receipts bound to the license key, website URL, installation ID, product, license type and expiry.
  • Reject replayed activation responses using a fresh request challenge.
  • Enforce signed expiry across licensed modules and early cache; tolerate temporary server outages only until the existing receipt expires.
  • Require approved HTTPS endpoints, certificate verification, no redirects and bounded response sizes.
  • Add independent license refresh and provisioning/migration documentation in LICENSE_SECURITY.md.

Server counterpart: ekods/nexamonitor commit a2de5beb5d4f542bc49e642f1f436f575bbf80bd.
Plugin commit: 37a6295.

Validation

  • 52/52 plugin regression cases on PHP 7.4 and PHP 8.4, including 51 license security checks.
  • 9 server API tests / 47 assertions, also verified against the staged server tree.
  • 108 plugin PHP files linted on PHP 7.4 and PHP 8.4.
  • 76 cache lifecycle checks and 38 HTTP cache/CSP checks; isolated browser CSP checks passed.
  • Release metadata, ZIP structure, public verification key inclusion and absence of private keys verified.

Assets: tool-kits.zip and SHA256SUMS.

Assets 4
Loading