License

Every inkdex command that reads or builds an index, and every scan, needs your organization's inkdex license. --help, --version, completions, license and telemetry work without one.

On a workstation: your license key

An administrator of your organization finds the key on mlab.sh, in RedKit › Code › Inkdex. It is shown once, when it is created or rotated: mlab.sh keeps only a hash of it.

inkdex license activate <your 64-character key>

That is all. The key is kept on your machine (in ~/.config/inkdex/, readable by you only) and inkdex renews its license by itself.

You can also give the key through the environment instead of activating it:

export INKDEX_KEY=<your key>

In CI/CD: a CI token per pipeline

In RedKit › Code › Inkdex › CI tokens, create one token per pipeline and give it a label ("api-main", "front-prod"). Store it as a secret of the pipeline, in the variable INKDEX_TOKEN. Nothing else to do: each job gets its license on its first command.

env:
  INKDEX_TOKEN: ${{ secrets.INKDEX_TOKEN }}

Prefer a CI token to the key in pipelines:

• usage shows per pipeline in your panel;
• a token that leaks is revoked on its own, without changing the key every developer uses.

See CI/CD for complete pipelines.

What your license allows

inkdex license status

It prints your organization, the state of the license, and, in plain words:

• You can: every capability your license includes, with its commands;
• You cannot: the ones it does not include;
• Limits: for example the largest repository you may index, or how many runs can be made offline.

The same list is on mlab.sh, in RedKit › Code › Inkdex › My license. Both read the same license, so they always agree.

A command your license does not include stops with a message naming what is missing, for example:

error: Your inkdex license does not include Library scan. Scan a library for vulnerabilities, without an application entry point. Ask an administrator of your organization, or contact mlab.sh to add it.

When the dependency check is not included, scan still runs and says that dependencies were not checked.

Renewal and offline use

• inkdex renews its license at most once an hour, when you run a command. You never have to do it by hand.
• Without network access, the license kept on your machine keeps working for 3 days. Runs made offline are recorded locally and sent at the next connection.
• After 3 days without reaching mlab.sh, or after the offline run limit of your license, inkdex stops until it can connect again.
• inkdex refuses to run if the system clock is set back before its last run. Fix the clock and run again.

Usage rules

• The key and CI tokens may be used on as many machines, VMs, containers and pipelines as you want.
• Every run is recorded against your license.
• A binary modified to stop reporting its runs breaks the terms of use.

Changing or removing the key

inkdex license activate <new key>    # after a rotation
inkdex license logout                 # forget the key and the license on this machine

After a key rotation on mlab.sh, every workstation must activate the new key; CI tokens keep working.

When a license is refused