package keynub-licdongle

KeyNub License Dongle SDK

Host SDK for the KeyNub USB-C license dongle — language bindings and samples over one core C library (keynub_licdongle, prefix licd_) with a stable C ABI. Windows, Linux and macOS, with no driver to install: the dongle is a vendor-defined USB HID device.

Getting started

1. Pick the native library for your platform from natives/ — NATIVES.md says which file is which.
2. Install the binding for your language, or drop its source into your project.
3. Enumerate, verify, open a session, read your licence data. Each binding's README shows the whole flow in a dozen lines.

The API surface is the same everywhere, because every binding is a thin layer over the same ABI — declared in include/licdongle.h. Learn it once.

Languages

Every sample carries the exact command that builds and runs it in its header comment, including which native library it wants. All of them except Excel/VBA and LabVIEW were compiled and run against a software dongle before release; those two need Excel and a licensed LabVIEW respectively, so they are written against the API and reviewed rather than executed. LabVIEW also has a ready-made VI library (bindings/labview/keynub_licdongle, saved in LabVIEW 2026, 64-bit), whose VIs were run in LabVIEW against the shipped library; Excel ships a .bas rather than an .xlsm so that the code can be reviewed in a diff.

Environments that cannot express the core ABI — LabVIEW, VBA, COBOL — go through a flat companion API (bindings/flat): one self-contained library with integer handles, caller-allocated buffers and no callbacks.

Visual Basic 6 gets a COM object rather than Declare statements for a specific reason: VB6's Declare emits stdcall while the flat API is cdecl. That is harmless in a 64-bit process and a stack-drifting mismatch in a 32-bit one, and VB6 is 32-bit only. Going through an object removes the question — and adds a handle that closes itself and failures that raise with a real Err.Description.

Where the licence check belongs

The shortest useful version of docs/integration-security.md:

// Weak — one patched branch defeats it, in any language.
if (dongle.IsGenuine) enableFeature();

// Strong — the data your program needs only exists with the dongle present.
coefficients = dongle.AppDecrypt(blobShippedWithYourInstaller);

Encrypt the constants, tables, thresholds or key material your application genuinely cannot compute. Ship them encrypted. Decrypt them through the dongle at run time. Then removing the check does not unlock the feature — it removes the feature's input.

Trust root

verify_genuine validates the device certificate chain against the KeyNub production root CA, whose public certificate is compiled into the released library — so a substituted device fails verification and your application supplies nothing and manages no root. licd_set_trust_root (or the equivalent on your binding) overrides the built-in root, which only vendor tooling needs.

Licence

Everything in this repository — the bindings, the samples and the C ABI header — is Apache-2.0. See LICENSE, NOTICE and THIRD-PARTY-NOTICES.txt for the dependency licence elections.

The prebuilt native libraries in natives/ are not covered by that licence; their terms are in BINARY-LICENSE.txt. You can use them from an Apache-2.0 binding in a closed-source application either way — that is what they are for.

Security reports: SECURITY.md.

Linux

Install packaging/linux/99-keynub-dongle.rules into /etc/udev/rules.d/ so the device is reachable without root. It is a permission rule, not a driver — nothing is compiled or loaded into the kernel.