Licensing

For anyone selling Contao extensions: the shop issues a signed licence key on purchase, confirms it daily and delivers your packages through a Composer repository of its own – with no extra service.

Licensing involves three parties. The licence check contao-consho-licensecheck-bundle is not part of your shop but of the software you sell – it runs at your customers'.

Your own shop has the licence check too – but only because the Licensing package itself needs a licence from consho.eu. It has nothing to do with your customers' licences there. Connect, Mollie and PayPal work the same way: consho.eu is the sales shop, and you are the customer.

The licence check exists as a Contao bundle, so Licensing is meant for Contao extensions. Software for other systems – a WordPress plugin or a desktop application, say – on request.

In config/config.yaml, enter the sales shop's domain without https://; the licence keys point to it:

contao_consho_licensing:
    host: shop.example.org

Then create the key pair once:

php bin/console consho:license:keypair

The command shows the key id and the public key, never the secret one, and replaces an existing pair only with --replace. While the pair or the domain is missing, the start page warns.

A digital article with the delivery type Licence (see Downloads and licence keys):

• One signed key per unit bought, on the order page – never in a mail.
• Daily confirmation: the installation asks once a day and gets a signed answer – active, resting for an unpaid invoice, expired, revoked, or in use elsewhere. Key and answer are checked offline (Ed25519). If the shop cannot be reached, the last answer carries on for up to 14 days.
• One key, one installation: to move, the customer releases the installation on the order page; if a key got out, they issue a new one there – the old one stops working.
• One access to the Composer repository for all their licences, with the commands and a provider ZIP for the Contao Manager on the order page.

New versions enter the repository by command only and are never replaced:

php bin/console consho:license:publish vendor/package 1.4.0 /path/to/package.zip

The composer.json in the ZIP must name the package. The archive is kept outside the web root.

• Issued licences: every licence with product, order, state and the installations it was active on; “Issue internal licence” for your own installations, partners or goodwill.
• Repository access: the login per customer, with “Renew access”.

The commands (consho:license:list, show, release-activation, issue-internal, access-renew) also work through contao-ai. Their answers never contain a key, a token or customer data.

Back up the sales shop at least daily. Licences belong to orders: after restoring an older backup, keys issued since then are unknown. The start page names them, and the installations keep working on their last confirmation for up to 14 days.

For your software to check its licence, it takes in the free contao-consho-licensecheck-bundle (MIT):

1. In your software's composer.json under require: webwerkwien/contao-consho-licensecheck-bundle.
2. A service implementing LicensedProductInterface: product id (the same as at the article in the shop), name, version and your shop's public keys as consho:license:keypair shows them.
3. Before every feature the licence covers, you ask; without a valid licence the call throws an exception with the reason:

$this->gate->assertAllowed('acme-tool', time());

The public keys belong in your code, not in the installation's configuration – otherwise a customer could trust a key pair of their own.

What you lock is your decision. A sensible line: what your customers' customers depend on keeps running, only the conveniences pause.

Keys on purchase, the daily confirmation, the repository and your customers' buttons keep running – they serve your customers. Publishing releases, internal licences and the write commands pause.

← Consho Connect Mollie →