Skip to content

Licora v5.0.1-baseline — Immutable PHP License Management System Baseline

Choose a tag to compare

View all tags
@victorsteele victorsteele released this 23 Jul 10:43
v5.0.1-baseline
c3db575

Licora v5.0.1-baseline — Immutable Baseline Snapshot

Licora v5.0.1-baseline is the permanent source-code and documentation baseline for the Licora open-source central license management system.

Licora is a self-hosted PHP and MySQL/MariaDB software license management platform designed for license creation, license validation, API-key binding, application scoping, device-limit enforcement, administrator access control, audit logging, security monitoring, database backup, and operational license administration.

This baseline release preserves the verified state of Licora before subsequent development phases. It contains no runtime feature changes, bug fixes, refactoring, database modifications, API changes, authentication changes, UI changes, or license-generation changes.

Baseline Identity

  • Project: Licora — Central License Management System
  • Maintainer: Vib Tools
  • Release tag: v5.0.1-baseline
  • Frozen source commit: c3db5759ac2539ab1525c73530ef5984b4b73ed6
  • Baseline documentation commit: ebd641858ccfd45b34f80d45039681df18c2fe6f
  • Default branch: main
  • License: MIT
  • Baseline date: July 23, 2026

The v5.0.1-baseline annotated Git tag points directly to the frozen source commit:

c3db5759ac2539ab1525c73530ef5984b4b73ed6

Current Platform

Licora currently operates as a server-rendered PHP application with MySQL or MariaDB database storage.

Runtime requirements

  • PHP 8.0 or later
  • MySQL or MariaDB
  • PDO MySQL extension
  • OpenSSL extension
  • JSON extension
  • Apache-compatible web server configuration
  • InnoDB database engine
  • utf8mb4 database encoding

No PHP framework, Composer runtime dependency, JavaScript build system, queue worker, webhook service, or background application framework is required by the current baseline.

Current License Management Features

The frozen Licora baseline includes the following existing capabilities:

  • Software license-key generation
  • License activation and validation
  • License expiration management
  • License suspension and reactivation
  • License deletion
  • Bulk license creation
  • Bulk license operations
  • License extension by hours or days
  • Device-limit enforcement
  • Device registration
  • Existing-device reconnection
  • Device activation and deactivation
  • API-key management
  • API-key hashing
  • API-key application binding
  • Application scope support
  • API request counting
  • Per-hour API rate-limit configuration
  • License blacklist management
  • Device blacklist support
  • IP blacklist support
  • License activity logs
  • API request logs
  • Administrative audit trail
  • Administrator account management
  • Role-based administrative access
  • Dashboard statistics
  • Health-status page
  • Settings management
  • SQL database backup
  • Expiring-license cron processing
  • Log and rate-limit cleanup cron processing
  • Dark-mode administration interface
  • Client-side searching, filtering, and pagination

Public License Validation API

The baseline contains two existing public API entry points:

Primary validation endpoint

POST /api/verify.php

The primary endpoint supports:

  • API-key authentication
  • License-key validation
  • Device identification
  • Application ID context
  • Application version context
  • API-key application binding
  • License status checks
  • License expiration checks
  • Device-limit checks
  • Blacklist checks
  • API logging
  • Request-rate limiting
  • Conditional CORS handling

Legacy validation endpoint

POST /api/check_license.php

The legacy endpoint accepts license-validation requests without the primary API-key contract.

The complete immutable request headers, JSON fields, response structures, behavior, and status-code documentation are preserved in BASELINE.md.

Administration Interface

The current Licora administration interface includes the following existing pages and routes:

/admin/index.php
/admin/login.php
/admin/logout.php
/admin/admins.php
/admin/api_keys.php
/admin/license.php
/admin/device.php
/admin/logs.php
/admin/audit.php
/admin/settings.php
/admin/backup.php
/admin/health.php

The administration interface provides license management, device administration, API-key control, logs, audit records, configuration settings, backups, health information, and administrator-account management.

Database Baseline

The frozen database contract contains 11 logical tables:

admin_users
api_keys
api_logs
audit_trail
blacklist
devices
failed_logins
licenses
logs
rate_limits
settings

The schema includes:

  • Primary keys
  • Unique indexes
  • Secondary indexes
  • Foreign-key constraints
  • Automatic timestamps
  • License status enumeration
  • Administrator role enumeration
  • Blacklist type enumeration
  • Device activity tracking
  • API request tracking
  • Audit records
  • Configuration settings

The baseline also preserves two database triggers:

update_device_last_active
update_license_timestamp

Existing schema and migration files remain unchanged:

database.sql
migration.sql
migration-v4.sql
migration-v5.sql
migration-v5-fix.sql
migration-v5-hotfix.sql

Authentication and Authorization Baseline

The current authentication system includes:

  • Username and password authentication
  • CSRF protection on login
  • Password hashing
  • Bcrypt password support
  • Legacy MD5 and SHA-1 password compatibility
  • Automatic password rehashing after successful legacy login
  • Session ID regeneration
  • Failed-login tracking
  • IP-based login-attempt limiting
  • Account lockout
  • User-agent session validation
  • Administrator roles
  • Super-administrator access
  • Manager access
  • Viewer access
  • Permission checks for administrative actions

The current session cookie configuration includes:

  • Session-only cookie lifetime
  • HttpOnly
  • SameSite=Lax
  • Conditional Secure behavior when HTTPS is detected

Two-factor authentication fields and settings exist in the database baseline, while a complete two-factor authentication challenge workflow is not part of the current runtime behavior.

Encryption and Hashing Baseline

The current Licora baseline uses:

  • AES-256-CBC for reversible encrypted values
  • Random initialization vectors for encrypted data
  • SHA-256 hashing for API-key lookup
  • Bcrypt for current administrator passwords
  • Cryptographically secure random-byte generation
  • SHA-256 file checksums for baseline integrity verification

License keys are stored in their current plain and encrypted representations according to the existing implementation.

No encryption format, key-generation method, hashing method, license-key format, or validation behavior has been changed in this release.

Immutable Baseline Documentation

This release adds only the following baseline and release metadata files:

BASELINE.md
BASELINE_CHECKSUMS.sha256
BASELINE_MANIFEST.md
RELEASE_NOTES_BASELINE.md

BASELINE.md

Contains the complete frozen project snapshot, including:

  • Repository identity
  • Version information
  • Folder and file counts
  • Complete folder tree
  • Public API contract
  • Database schema snapshot
  • Feature inventory
  • Configuration snapshot
  • Security baseline
  • Existing limitations
  • Administrative routes
  • Cron entry points
  • Compatibility contract
  • Critical file checksum references

BASELINE_CHECKSUMS.sha256

Contains SHA-256 checksums for critical runtime files, including:

  • PHP application files
  • API handlers
  • Authentication files
  • Security files
  • Database schema
  • Migration files
  • Administration assets
  • Cron scripts
  • Configuration files
  • Validation scripts
  • Security smoke tests

These checksums allow future repository states to be compared against the frozen baseline and help detect unintended changes.

BASELINE_MANIFEST.md

Records:

  • Frozen commit hash
  • Baseline tag
  • Version
  • File count
  • Folder count
  • Public API count
  • Admin-page count
  • Database-table count
  • Generated baseline documentation
  • Compatibility-contract references
  • Audit references
  • Baseline date

RELEASE_NOTES_BASELINE.md

Documents the current Licora system state without introducing a roadmap, proposed architecture, implementation plan, or future-development commitment.

Repository Snapshot

At the frozen source commit, the repository baseline contains:

  • 96 source and documentation files
  • 17 directories excluding the repository root
  • 28 PHP files
  • 6 core PHP classes
  • 2 public API endpoints
  • 12 administration pages
  • 11 logical database tables
  • 2 database triggers
  • 6 SQL schema and migration files
  • 2 cron entry points
  • 1 local administration CSS file
  • 1 local administration JavaScript file

Cron Entry Points

The current scheduled-maintenance entry points are:

cron/check_expiring.php
cron/cleanup.php

These paths are part of the immutable compatibility contract and remain unchanged.

Compatibility Guarantee

This baseline release does not change:

  • Public API URLs
  • API request JSON
  • API response JSON
  • HTTP routes
  • Database schema
  • Database table names
  • Database column names
  • Indexes
  • Foreign keys
  • Database triggers
  • Migration SQL
  • License-key format
  • License generation
  • License validation behavior
  • Device registration behavior
  • Device-limit enforcement
  • Encryption format
  • API-key hashing
  • Password hashing
  • Authentication behavior
  • Authorization roles
  • Session structure
  • CSRF handling
  • Configuration constants
  • Configuration keys
  • Cron file locations
  • Administration URLs
  • PHP class names
  • PHP method names
  • Runtime file locations
  • HTML output
  • CSS
  • JavaScript
  • User interface
  • Existing application features

Zero Runtime Change Confirmation

The baseline documentation commit adds four documentation and metadata files only.

No files with the following extensions were modified:

.php
.sql
.html
.css
.js

Therefore:

  • Application behavior remains unchanged.
  • Existing installations remain compatible.
  • Existing APIs continue using the same routes and contracts.
  • Existing database installations require no schema update.
  • Existing administrator workflows remain unchanged.
  • Existing license keys remain compatible.
  • Existing API keys remain compatible.
  • Existing devices and validation records remain compatible.
  • Existing cron configuration remains compatible.
  • Existing UI rendering remains unchanged.

Security Baseline

This release records the current verified security posture without applying remediation.

The documented security baseline covers:

  • Authentication
  • Authorization
  • Password hashing
  • API-key hashing
  • Reversible encryption
  • Session handling
  • CSRF protection
  • Rate limiting
  • Failed-login tracking
  • Account lockout
  • Blacklisting
  • API logging
  • Administrative logging
  • Audit trails
  • Installer exposure
  • Cron access controls
  • External frontend dependencies
  • Existing verified security findings

No security-related implementation was changed as part of this release.

Integrity Verification

After checking out the frozen baseline, critical project files can be verified with:

sha256sum -c BASELINE_CHECKSUMS.sha256

Each verified file should return:

OK

The baseline tag target can be verified with:

git rev-list -n 1 v5.0.1-baseline

Expected output:

c3db5759ac2539ab1525c73530ef5984b4b73ed6

The remote annotated tag can be verified with:

git ls-remote --tags origin | grep "refs/tags/v5.0.1-baseline"

Release Scope

This release represents the verified current state of Licora v5.0.1.

It is intended to serve as an immutable reference for:

  • Repository integrity comparison
  • API compatibility verification
  • Database compatibility verification
  • License-format verification
  • Configuration comparison
  • Runtime-file integrity checking
  • Security-baseline comparison
  • Documentation traceability
  • Release auditing
  • Source-code change detection

This release contains no roadmap and does not describe or authorize future implementation work.

About Licora

Licora is an open-source, self-hosted central software license management system built with PHP and MySQL/MariaDB.

It provides license issuing, online license validation, API-key binding, device controls, application scopes, administrator management, audit logs, database backups, and operational license monitoring through a web-based administration interface.

Licora is maintained by Vib Tools.

  • Project: Licora
  • Category: Open-source software license management system
  • Technology: PHP and MySQL/MariaDB
  • Deployment: Self-hosted
  • Maintainer: Vib Tools
  • License: MIT
Assets 3
Loading