RockyGuard v1.3.2 · Windows + Linux
License protection for C++ applications. Simple to integrate, hard to defeat.
RockyGuard is a small, audited C++17 library that handles node-locked and floating license verification with public-key signatures, multi-location time anchors, and binary integrity checks. Sign once, verify everywhere.
Self-contained demo — library + sample license + 30-line C++ program. No credit card, no email gate. The free Developer tier adds a real vendor license (10 end-user licenses, one build machine), issued after request.
What RockyGuard does
Signed license files
Every license is signed with your private Ed25519 or RSA key and verified by the public key embedded in your application. Counterfeiting a license requires the private key — there is no shared secret to leak.
Multi-layer anti-tampering
Time-anchor cross-checks across multiple persistent locations, optional online time verification via TLS, hardware fingerprint matching with configurable threshold, and binary integrity self-check on shared-library builds.
You choose the protection level
Verification gives you a verdict; what you do with it is your call, per feature. The simple pattern is a branch — verify, then exit if the licence is not valid — a few lines, and enough for most code. For a high-value feature, make it load-bearing: the licence carries an encrypted data key, your asset is sealed under it at build time with rg_bind_asset, and opened at runtime through LicenseAsset. A forged or patched licence then yields the wrong key and garbage output, not a bypass — there is no verdict to flip. How it holds up →
No SaaS dependency
Verification runs offline against a static public key. Optional floating server runs on your customer's LAN for concurrent-seat licensing. Nothing phones home to RockyGuard.
Web portal for issuing licenses
A self-hosted admin portal ships in the package, so the people who issue licenses do not have to learn a command line. Define your products and features once, then generate licenses one at a time or in CSV batches, delivered as a signed file or a short activation key. A dashboard widget tracks how much of your generation allowance is left. It runs on your own machine against your own signing key — everything it does is also available from the CLI, so it is entirely optional. How it works →
Built for AI-assisted integration
Every customer zip ships an AI_INTEGRATION_GUIDE.md. Tell your AI agent (Claude, ChatGPT, Cursor, Copilot, Gemini) "integrate this library" — it follows a deterministic recipe to add the CMake, embed your key, and gate features. See the guide →
Integration in one function
Embed the public key, load the signed license file, verify it. No daemon to install,
no SDK to register, no online activation step. Construction is the only call that throws,
and only for a public key that is not parseable PEM — so guard it and every other
outcome reaches you as a LicenseStatus.
#include <rockyguard/rockyguard.h>
int main() {
try {
rockyguard::LicenseVerifier verifier(PUBLIC_KEY);
auto result = verifier.load("license.json");
if (!result) { std::cerr << result.message << "\n"; return 1; }
if (!verifier.check_node_locked()) { return 1; }
} catch (const std::runtime_error& e) {
// Only fires if PUBLIC_KEY above is not parseable PEM -- a
// truncated or mis-pasted key. Never for a bad license file.
std::cerr << "Invalid public key: " << e.what() << "\n";
return 1;
}
// licensed and running
}Same code on Windows and Linux. Static or shared library. Full quick start →
That is the simple branch: verify, then exit if the licence is not valid.
It is enough for most features — and honest about its limit, because it is one boolean
gating a branch, and a one-instruction binary patch can flip it in your own shipped executable,
where the library cannot reach. For a feature worth more than that, make it
load-bearing: seal the feature’s data under a key the licence carries, and
open it at runtime with LicenseAsset. A forged or patched licence then yields the
wrong key and garbage, not a bypass — there is no verdict to flip. It is incremental:
protect one high-value feature, leave the rest on the simple branch.
See how it holds up →
Good fit for
- › Small ISVs and indie developers shipping C++ desktop or server applications
- › Teams replacing aging proprietary licensing suites without committing to a SaaS subscription
- › Products where customers expect to run offline (regulated industries, on-prem deployments, air-gapped environments)
- › Software where signed-and-audited license enforcement matters more than slick admin UI
Not for you if
- × You ship iOS, Android, or browser apps (RockyGuard is C++17 desktop / server only)
- × You need cloud-managed licensing as a service (we run offline; no SaaS dashboard)
- × You target Linux distributions with glibc < 2.34 (RHEL 8, Ubuntu 20.04, Debian 11, Amazon Linux 2) — v1.3.2 requires glibc 2.34 or newer; a glibc-2.28 build is on the roadmap, not shipped
- × You need a shipping macOS build (the macOS support code exists and we build it on request, but it is not in the standard v1.3.2 package)
We list this on the landing page deliberately. Buying licensing infrastructure and discovering a platform gap two weeks in is the worst possible experience for both sides.
We publish our threat model
Most licensing products describe defenses without naming the attacks they actually defend against. RockyGuard publishes a 9-row table mapping every concrete attack — file tampering, keygen, binary patching, clock rollback, MITM on the floating server, server spoofing, eviction forgery, fingerprint forgery, memory dumping — to its specific defense and the residual risk that remains after that defense is applied. The "memory dumping is out of scope" row stays in.
Start integrating today
Free Developer tier — the full SDK, no credit card. Go live from $59/month (Basic) or $189/month (Premium), or prepay the year at $599 / $1,899.