license.flexfs

Caution

This entire page documents an internal tool. license.flexfs is used by Paradigm4 to generate and verify license grants. It is not intended for customer use.

license.flexfs manages the cryptographic signing identity and license grants used by the flexFS licensing system. Grants are ECDSA-signed JSON documents containing an expiration date.

Persistent Flags

These flags apply to every subcommand.

Flag	Type	Default	Description	Visibility
--keyFolder	string	~/.flexfs/license	Signing key folder path	Public
--reportErrors	bool	false	Report errors and panics to Paradigm4	Public

Subcommands

Subcommand	Description	Visibility
create grant	Create a signed license grant	Public
create identity	Generate a new ECDSA P-256 signing keypair	Public
license	Print license information	Public
verify	Verify a grant’s signature and check expiration	Public
version	Print the build version	Public

create grant

license.flexfs create grant [--expires <RFC3339>] [-o <file>]

Creates a signed grant. The grant expires at the specified time (default: 1 month from now). Expiration must be between 1 day and 2 years from now.

Flag	Type	Default	Description	Visibility
--expires	string	1 month from now	Expiration time in RFC3339 format	Public
--outputFile, -o	string	""	Output file path (stdout if omitted)	Public

create identity

license.flexfs create identity [--force]

Generates a new ECDSA P-256 keypair and saves private.pem and public.pem to the key folder. If the key folder already holds private.pem or public.pem, the command refuses to run unless --force is given. Admin servers verify grants against a public key built into their binary, not against public.pem. Replacing the keypair therefore does not revoke grants already issued, which stay valid until they expire, but grants signed with the new private.pem (for example by a stat server using this key folder) are rejected by admin servers built with the old public key. verify checks against the public.pem in the key folder, so after a replacement it rejects grants signed with the old key.

Flag	Type	Default	Description	Visibility
--force	bool	false	Replace an existing signing identity	Public

verify

license.flexfs verify [-i <file>]

Verifies the signature on a grant and reports whether it has expired.

Flag	Type	Default	Description	Visibility
--inputFile, -i	string	""	Input file path (stdin if omitted)	Public