============================================================
 RockyGuard Library - Customer Package (Linux x64)
============================================================

This zip contains the Linux x86_64 build of RockyGuard. For the
Windows x64 build, download rockyguard-vX.Y.Z-windows-x64-customer.zip.
Both packages share the same C++ API and license-file format;
see docs/Customer_Documentation.txt for cross-platform coverage.

PLATFORM REQUIREMENTS:

  x86_64 Linux with glibc >= 2.34. Supported distributions:
    - Ubuntu 22.04 LTS (glibc 2.35), Ubuntu 24.04 LTS (glibc 2.39)
    - Debian 12 "Bookworm" (glibc 2.36)
    - RHEL 9 / CentOS Stream 9 / Rocky Linux 9 / AlmaLinux 9 (glibc 2.34)
    - Amazon Linux 2023 (glibc 2.34)
    - Any other x86_64 Linux distribution with glibc 2.34+

  NOT supported in this release (planned for v1.3):
    - glibc < 2.34 distros (RHEL 8, Amazon Linux 2, Debian 10,
      Ubuntu 20.04). A manylinux_2_28 build is planned for v1.3.
    - macOS (arm64 / x86_64). Planned for v1.3.

  To check your glibc version:
    ldd --version | head -1

CONTENTS:

  include/rockyguard/       Public headers (verification only)
    rockyguard.h              Single-include convenience header
    version.h                 Library version macros (auto-generated)
    types.h                   Enums and result types
    license.h                 License data model
    license_verifier.h        License verification
    hardware_fingerprint.h    Machine hardware fingerprinting
    floating_client.h         Floating license client (Premium)
    export.h                  Shared-library export macros

  lib/static/
    librockyguard.a         Static library. Contains RockyGuard code
                            ONLY -- you must also link the two OpenSSL
                            archives from deps/lib/ below. See LINKING.

  lib/shared/
    librockyguard.so        Shared library (OpenSSL statically linked
                            INTO this one -- nothing extra to link or
                            ship alongside it)
    librockyguard.sig       Integrity signature (ship next to the .so)

  tools/
    license_keygen              Generate your Ed25519/RSA keypair
    license_create              Create end-user licenses
    license_verify              Verify and inspect license files
    rg_fingerprint              Print machine hardware fingerprint
    rg_floating_server          Floating license server (Premium tier only)
    floating_server_config.yaml Sample server config file
    rg_floating_client          Floating license client (Premium tier only)

  deps/
    include/openssl/            Bundled OpenSSL headers, matching the
                                version the library was built against
    lib/libcrypto.a             REQUIRED when you static-link
    lib/libssl.a                REQUIRED when you static-link
                                librockyguard.a. Both archives, and in
                                this order: libssl.a before libcrypto.a
                                on the link line, because ld resolves
                                left to right and libssl depends on
                                libcrypto. Not needed for the shared
                                (.so) path, which has OpenSSL inside it.

  examples/
    CMakeLists.txt                  Build script for the examples
    node_locked_example.cpp         Node-locked license verification example
    rg_floating_client.cpp     Floating license client example (Premium)

  docs/
    Customer_Documentation.txt/pdf          Library documentation
    Customer_API_Reference.txt/pdf          API reference
    RockyGuard_License_Agreement.txt/pdf    Software License Agreement

  AI_INTEGRATION_GUIDE.md                   For AI coding assistants
                                            (Claude, ChatGPT, Cursor,
                                            Copilot, Gemini, Cody, ...).
                                            Tell your AI: "Read
                                            AI_INTEGRATION_GUIDE.md and
                                            integrate RockyGuard into
                                            this project." A deterministic
                                            recipe -- CMake snippet, key
                                            embedding, verification call,
                                            feature gating -- that any
                                            modern coding agent can follow.

  portal/
    start.sh                Launch the licensing-management web app
    README.md               Portal setup and daily workflow
                            Drop your vendor_license.json + vendor_private.pem
                            into Settings on first run, then issue licenses
                            to your end users from a browser at 127.0.0.1:8765.
                            See portal/README.md.

QUICK START:

  BEFORE STEP 3 YOU NEED A FILE THAT IS NOT IN THIS ZIP.
  vendor_license.json is issued to your organisation by Rocky Software
  Inc. and sent by email; it is deliberately not bundled, because it is
  specific to you. Request it now if you do not have it -- the stated
  turnaround is one business day, and step 3 onward cannot run without
  it. Details in Customer_Documentation section 2.2. Steps 1 and 2
  below need nothing from us and can be done while you wait.

  WHERE TO RUN THESE. Work from a directory YOU own -- not this
  extracted package. The tools write their output to the current
  directory, so running them from here drops your private signing key
  inside a folder you are expected to delete and re-extract. Set a
  variable pointing back at the package once, then use it everywhere:

       RG="$(pwd)"                 # run this while still in the package
       mkdir -p ~/licensing/myproduct && cd ~/licensing/myproduct

  1. (Optional) Make the tools executable if your unzip didn't
     preserve the x bit:
       chmod +x "$RG"/tools/*

  2. Generate your keypair (once):
       "$RG/tools/license_keygen" --private private.pem --public public.pem

  3. Create end-user licenses (vendor license required, CLI tool):
       "$RG/tools/license_create" \
         --vendor-license vendor_license.json \
         --key private.pem --id "LIC-001" \
         --licensee "User" --product "App" \
         --fingerprint-value "<end user's fingerprint>" \
         --expires "2027-12-31T23:59:59Z"

  4. In your end-user application (NO vendor license needed):
       std::optional<LicenseVerifier> v;      // not copyable/movable
       try { v.emplace(PUBLIC_KEY); }         // the ONLY call that throws
       catch (const std::runtime_error& e) {
           std::cerr << e.what() << "\n"; return 1;
       }
       auto result = v->load("license.json");
       result = v->check_node_locked();

     The try/catch is not decoration. A PUBLIC_KEY literal that was
     truncated or line-wrapped when pasted compiles fine and throws at
     construction; uncaught, that is std::terminate() on your end
     user's machine -- on Linux, "terminate called after throwing an
     instance of 'std::runtime_error'" and a core dump at exit 134.
     See docs/Customer_Documentation.txt section 12.2.

LINKING:

  The fastest correct route is to copy examples/CMakeLists.txt, which
  already defines the imported targets, both OpenSSL libraries, and the
  platform libraries. The snippets below are the minimum equivalent.

  Static (recommended):
    In your CMakeLists.txt:
      target_include_directories(your_app PRIVATE
          path/to/include
          path/to/deps/include)
      target_link_libraries(your_app PRIVATE
          path/to/lib/static/librockyguard.a
          path/to/deps/lib/libssl.a
          path/to/deps/lib/libcrypto.a
          pthread dl)
    The shipped librockyguard.a contains the RockyGuard code only;
    OpenSSL is bundled in the deps/ directory and must be linked
    explicitly. pthread + dl are required by OpenSSL on Linux.

  Shared (.so):
    In your CMakeLists.txt:
      target_compile_definitions(your_app PRIVATE ROCKYGUARD_SHARED_LIB)
      target_include_directories(your_app PRIVATE path/to/include)
      target_link_libraries(your_app PRIVATE
          path/to/lib/shared/librockyguard.so)
      # Either set RPATH so your_app finds the .so at runtime without
      # LD_LIBRARY_PATH:
      set_target_properties(your_app PROPERTIES
          INSTALL_RPATH "$ORIGIN/../lib/shared")
      # ...or ship your_app next to librockyguard.so and set
      # RPATH=$ORIGIN.

    Ship with your application:
      - librockyguard.so
      - librockyguard.sig  (integrity signature; must be next to the .so)
      OpenSSL is statically linked into librockyguard.so; no separate
      libcrypto/libssl runtime to ship.

DIFFERENCES FROM THE WINDOWS BUILD:

  - Extension: .so instead of .dll, no extension on tools (not .exe)
  - No .lib import library (Linux links .so directly)
  - No libcrypto/libssl runtime files to ship (statically linked)
  - No registry-based time anchor (Linux uses file anchors under
    $HOME/.local/share/rockyguard/ and $HOME/.lck_svc_<tag>)
  - Hardware fingerprint fields: MAC from /sys/class/net, CPU ID
    from /proc/cpuinfo, disk serial from /sys/class/block, motherboard
    UUID from /sys/class/dmi/id/product_uuid (root not required on
    most distros; an empty field is hashed as the empty string and
    skipped in match scoring, so missing fields just reduce the
    hardware-match score rather than breaking verification)
