If you provide desktop software, you need a straightforward answer: is this copy allowed to run on this computer, today, without calling home over the internet?

Arnas Verify is a small, public reference implementation showing how we handle that exact problem. You use it as a Python library directly inside the application your customer starts — not as a separate activation tool or heavy daemon. I implemented Arnas Verify in Python to make it as cross-platform as possible.

When a user obtains your software, they receive a signed license file. Your application validates that file locally on their machine. Because each license is tied to a unique machine ID, copying the license file to another PC causes the check to fail.

Code & Docs: github.com/natearnas/Arnas-Verify

Latest Release (v0.1.0): github.com/natearnas/Arnas-Verify/releases/tag/v0.1.0

Machine Binding. On the customer's machine, your app retrieves a machine fingerprint via the library's get_machine_id() function. The customer provides this ID to you.

License Creation. You generate a signed license file tied specifically to that machine ID.

Offline Verification. The end user (or your software) places the license file on their system. Your app checks the file locally: Is the RSA signature real? Is it for this product? Is it for this computer? Has it expired?

No activation websites. No phone-home. No tracking telemetry.

Arnas Verify runs across Windows, Linux, and macOS, requiring Python 3.10+ and a single dependency (cryptography). It is not on PyPI yet — simply clone the repository and run pip install -e ..

This project reflects the exact trust model we use for our commercial software: a public checker anyone can audit, paired with a private signing key that never leaves the vendor.

The private key used to sign real customer licenses remains securely offline in your issuing environment. Only the public verification key is embedded into your shipped application binaries. Publishing the verifier code changes nothing about security: the checking logic isn't the secret — the private signing key is.

A note on the demo keys. The GitHub repository deliberately includes a committed demo keypair (private key included) so that tests and examples work immediately out of the box. Anyone can sign a "valid" demo license using it. It is a teaching key, not the root of trust for any real product.

Arnas Verify is not a full licensing business in a box — there is no customer database, no CRM, no web dashboard. The bundled CLI tool is meant for developer testing, not end users.

It is also not DRM against a determined reverse-engineer. Anyone with administrator privileges and a local debugger can patch a binary check — that is true of every offline verification scheme, and our documentation states this transparently. Expiry checks also rely on the local system clock.

The explicit goal of Arnas Verify is to stop casual license sharing, file copying, and unauthorized reuse among honest users.

Arnas Verify is free for noncommercial use — research, teaching, personal evaluation — under the PolyForm Noncommercial License 1.0.0.

Including this library inside commercial desktop software you sell requires a commercial agreement with Arnas Technologies, LLC. Reading, running, and learning from the codebase is completely free for everyone.

(This summary is informational, not formal legal advice.)

If you are evaluating Arnas Verify for a commercial product, feel free to reach out — conversations are always free. We published this reference as a goodwill gesture to show how small software teams can implement clean, honest licensing.

Questions or commercial licensing inquiries? Get in touch — we're happy to talk.