package with password to initialize (or license key)

[grimace]

Hello,
I'm not sure if I've posted this in the right thread, but here's my problem:
To install certain packages, you can add parameters like passwords (this is the case, for example, with VNC => http://wapt.tranquil.it/wapt/tis-vncres ... 1_all.wapt ).
The major problem is that the package is downloadable by regular users, who can unzip it and see the setup.py file containing the password.

Adding an .htaccess file to the repository (https://wiki.lesfourmisduweb.org/index. ... t_de_passe) only adds another step, because the c:/wapt/wapt-get.ini file is still readable by the user, or at least by someone on an administered machine.

The problem is the same for software with license keys.

Have you ever encountered these problems, and how did you solve them (if a solution exists)?

Thank you,

Grima

[sfonteneau]

This is indeed an unresolved issue.

Here's an idea:

You could encrypt your license key within the package. The data in the package would then be unusable.

Once the package is downloaded by the WAPT client, the license key can be decrypted with a decryption key stored locally on the machine but inaccessible to the user. (See how to store the key in a folder protected by ACLs.)

This way, the user cannot retrieve the license.

However, there's a problem if the decryption key is stolen. Other solutions might be worth exploring; I'm not an expert in this area.