Self-hosted software licensing platform with TPM-assisted hardware attestation for Windows applications.
-informational?style=flat-square){kind=icon}
English | 简体中文 | 繁體中文 | 한국어 | Deutsch | Español | Français | Italiano | Dansk | 日本語 | Polski | Русский | Bosanski | العربية | Norsk | Português (Brasil) | ไทย | Türkçe | Українська | বাংলা | Ελληνικά | Tiếng Việt
Matrix (Event Horizon) is an autonomous, self-hosted software licensing and anti-tamper infrastructure designed specifically for Windows desktop applications. It couples hardware-bound TPM 2.0 device attestation with cryptographic runtime leases, out-of-band challenge activations, and sealed package provisioning.
Zero third-party telemetry, zero vendor lock-in, and zero external dependency calls beyond your self-hosted server cluster.
| Component | Stack | Purpose |
|---|---|---|
cmd/eh-server |
Go 1.27+ & SQLite | Core HTTP API: licensing engine, OOB verification, SQLite storage, background cleanup janitor |
cmd/ehctl |
Go CLI | Operator interface: PKI bootstrapping, license issuance, device lifecycle, package imports, backups |
cmd/eh-builder |
Go CLI | Vendor packager: transforms binaries into encrypted .ehpkg distributions and provisioning manifests |
rust/eh-core |
Rust | EHVM1 bytecode virtual machine and assembler for execution protection (see docs/VM.md) |
rust/eh-trustd |
Rust (Isolated) | Sandboxed TPM quote verifier: parses raw hardware structures without DB, sockets, or secret access |
rust/eh-client |
Rust & C FFI | Windows client SDK: TLS, TPM2/TBS bindings, DPAPI machine storage, C ABI header, demo client |
Prerequisites: Go 1.27.3+, Rust 1.99+ (for isolated verifier build).
# Build server binaries and tooling
mkdir -p bin
go build -o bin/eh-server ./cmd/eh-server
go build -o bin/ehctl ./cmd/ehctl
go build -o bin/eh-builder ./cmd/eh-builder
cargo build --release --manifest-path rust/Cargo.toml -p eh-trustd
export PATH="$PWD/bin:$PATH"
# Setup configuration (TLS mandatory by default)
cp deploy/config/server.example.yaml server.yaml
eh-server -config server.yamlConsume the single-use bootstrap token generated at <data_dir>/bootstrap.token to create the master administrator credential:
ehctl init --bootstrap-file /var/lib/eh/bootstrap.token \
--server https://127.0.0.1:8443 --ca /etc/eh/tls/ca.pem# Generate a new customer license key
ehctl license create --customer "Acme Corp" --channel manual
# Output: EH1-XXXXX-XXXXX-XXXXX-XXXXX
# Seal binary payload into protected distribution package
eh-builder pack --id demo-core --name "Demo Core" --in app.bin
# Output: demo-core.ehpkg (public) + demo-core.provision.json (secret)
ehctl packages import demo-core.provision.jsonPrerequisites: Windows 10/11, TPM 2.0 (optional fallback).
cd rust; cargo build --release -p eh-client
target\release\eh-demo.exe --server https://lic.example.com:8443 `
--license EH1-... --ca ca.pem --package-id demo-core `
--package-file demo-core.ehpkg --heartbeats 3Client machines generate an Endorsement Key (EK) and Attestation Key (AK) directly inside their hardware TPM 2.0 chip. During session validation, the client submits a cryptographic quote over hardware PCR registers. The eh-trustd daemon verifies the cryptographic signature without needing access to private secrets.
No. Matrix is completely private and self-hosted. It does not communicate with external analytics, license clouds, or third-party identity providers. All network communication remains strictly between your clients and your own server instance.
Yes. Clients can specify --no-tpm to register under the software-only trust tier. In environments lacking TPM chips, licenses and cryptographic heartbeats are still enforced via out-of-band verification and standard DPAPI storage.
Licenses support configurable lease windows. Client applications can continue operating for the duration of their active lease before requiring an online or out-of-band renewal.
- Protocol Specification — Normative wire protocol, endpoints, and client/admin state machines
- Architecture Overview — Subsystem boundaries, failure modes, and threat boundaries
- Architecture Decisions (ADR) — Design rationales and trade-offs
- VM Specification — EHVM1 bytecode format and execution semantics
- Threat Model — Threat landscape, residual risk, and hardware security assumptions
- Security Hardening — Cryptographic inventory and reporting procedures
- Operations Guide — Backup, restore, rotation, and day-2 operations
go test ./... # server: unit and HTTP integration test suite
go test -race ./... # race detector suite (requires gcc)
cd rust && cargo test # VM, client SDK, and trustd verifier suitesDual-licensed under either:
at your option.