Licensing

Starf is free. Every measurement, every tab, every diagnostic page works without a licence, now and later. A licence removes an occasional reminder, and that is the whole of what it does.

This is an honour-system purchase at https://elyracode.com/starf — a small one-off payment from people who find the thing useful.

What the reminder does and does not do

The three buttons are the same size and weight. Declining is not a lesser act, and a reminder that disguised its own dismissal would be worse than no reminder at all.

The reminder is recorded as shown the moment it appears, so closing it any way at all counts. There is no way to make it reappear by dismissing it "wrongly".

It is checked on this machine

Starf keeps every measurement on the machine, and the only thing that may use the network is the update check, which asks first. A licence check that phoned home would put a second, unavoidable request in front of everyone — licensed and unlicensed alike — so keys are verified against an Ed25519 public key compiled into the binary. No network at all, works offline, and the purchase leaves no trace in the application beyond the address on the key.

A key is a signature over the buyer's email address. Editing the address invalidates the key, because the signature covers it. The application shows "Licensed to …" so a key is visibly someone's.

Which also means it can be copied

An offline key can be shared, and no amount of cleverness changes that. That is accepted rather than fought. Obfuscation, machine binding and activation servers cost real complexity and inconvenience honest buyers most; people who were going to pay, pay.

Where the state lives

~/Library/Application Support/no.gets.starf/license.json:

{
  "key": "STARF-1-…",
  "firstSeen": 1785761299033.9,
  "lastReminder": 1789217304070.3
}

Deleting the file is the same as a fresh installation. To see the reminder without waiting a week, set firstSeen back forty days and clear lastReminder:

python3 - <<'PY'
import json, pathlib, time
p = pathlib.Path.home() / "Library/Application Support/no.gets.starf/license.json"
p.write_text(json.dumps({"key": None, "firstSeen": (time.time() - 40*86400) * 1000,
                         "lastReminder": None}))
PY

The status is also in the status bar, at the right: Licensed or Unlicensed, and clicking it opens the licence panel at any time.

What the rules are, in code

src-tauri/src/license.rs. The timing rule is one pure function with tests covering a new installation, the first reminder, the gap between reminders, a licensed copy, and a clock that has gone backwards — a negative age is a clock problem, not a reason to ask for money.

Key verification has tests for a genuine key, whitespace from an email client, an edited address, a key from a different signer, and assorted nonsense. One test asserts the shipped public key is a real key and not a placeholder of zeroes, which would otherwise make every licence fail silently.