Package DRM

How a package is protected

When you run pkg create, Nextweb encrypts the package with a key made for that one build and seals that key to your account's key. Your account's key stays on our license server, and the package carries nothing that opens it.

pkg create also registers the build, so the license server knows the exact file. A copy of that file is still that file. A file changed afterwards, or rebuilt, is a different file: it gets no key and won't install.

When a server installs your package, Nextweb asks the license server for the key. A package you publish as yourself installs only on your own license. A package your organization owns installs on its members' licenses and the servers you link to the organization. Every other license is refused. A public catalog, where anyone can install a package, isn't built yet.

Node.js source

The package's encryption ends when it installs. For a Node.js application you can also keep source files encrypted on the server after install. We turn this on for your account first; until then pkg create refuses it. To ask for it, email support@nextwebjs.com. Then name the files in .nextwebrc:

"encrypt": { "source": ["app.js", "lib/**/*.js"] }

Those files stay encrypted on disk. When the application starts, Nextweb gets its key and decrypts each file in memory as Node.js loads it. The plaintext is never written to disk, and your application never sees the license key. Each file is checked against the package's file list before it loads, and a changed file stops the application.

Source encryption covers .js and .json files, except package.json, which the installer reads before a key exists. Nextweb's own core runs this way.

PHP and other languages

PHP files, and everything else in a package that isn't encrypted Node.js source, are covered by the package's encryption from the build until a licensed server installs them. After install they are ordinary files on that server, readable by anyone who can read its disk. Keeping PHP source protected after install isn't built yet; it's on the roadmap.

Compiled programs

A compiled program carries no source to hide. What it needs is a license check: a way to ask Nextweb, when it starts, whether this machine may run it. Nextweb has no check your programs can call yet. It's on the roadmap.

What it doesn't do

• Code is decrypted on the machine that runs it, so whoever controls a licensed server can extract what its license opens. DRM makes a license the cheapest way to get your software; it doesn't make copying impossible.
• Revoking a build, removing a member, or unlinking a server stops the key going to any machine that hasn't had it. A machine that already holds the key keeps it for up to 7 days, and can install that build again in that time.
• Files a server has already installed stay on its disk. Source-encrypted files need the key each time the application starts. While the build is still allowed, the machine gets a new key when the old one runs out; the files stop loading only once that is refused.
• Any license can download the encrypted file. Only the key is restricted.
• Your account's keys are held by our license server, so publishing a package means trusting it with them.

Package your own application in the second lesson, or ask us about protecting yours.