Machine fingerprint in Tauri

The SDK computes the fingerprint it sends with each validation, and checks in each token. Each fingerprint LicenseManager hasn’t seen on a license is a new machine, which takes one of its places.

app.license().fingerprint().await
// "q3M0bVZ0…Hk=:Xk9fT2pB…w=:x7Kp2QaZ"

From JavaScript, getFingerprint() returns it too, but only in windows whose capability allows licensemanager:allow-get-fingerprint: it’s not part of licensemanager:default.

What it’s made of

Three parts, joined with ::

• The machine part makes the fingerprint stable, and different on each computer. It’s hashed, so the raw id is never sent.
• The install id makes it hard to fake: copying the machine id of another computer isn’t enough, the secret stored on it is needed too. Copying your app’s files to another computer doesn’t copy it.
• The product id makes the fingerprint different for each of your products on the same computer.

The fingerprint is computed the first time it’s needed, then kept in memory while the app runs. It’s about 100 characters long, within LicenseManager’s limit of 255.

It’s computed exactly like the Electron SDK’s: the same computer gets the same fingerprint with both. See migrating from Electron.

The machine id

The value is lower-cased, and spaces are removed. On macOS, the command has 5 seconds to answer.

When it can’t be read, the SDK falls back on the MAC address of the first network interface that isn’t internal, then on the hostname. Both are less stable: a MAC address can change with a new network adapter or a dock, and a hostname when the computer is renamed. Reading the machine id never fails.

Reinstalls and updates

A new fingerprint is a new machine. The old one keeps its place until it’s deactivated, by you, or by the customer from the customer portal.

Overriding the machine id

Pass fingerprint to choose the machine part yourself, like to license per user instead of per computer. It replaces the machine id only: the result is still hashed, and combined with the install id and product id.

use tauri_plugin_licensemanager::{Builder, MachineFingerprint};
 
// A fixed value:
Builder::new(PRODUCT_ID, PUBLIC_KEY).fingerprint(current_user_id());
 
// A function:
Builder::new(PRODUCT_ID, PUBLIC_KEY)
    .fingerprint(MachineFingerprint::from_sync_fn(|| read_my_device_id()));
 
// An async function:
Builder::new(PRODUCT_ID, PUBLIC_KEY)
    .fingerprint(MachineFingerprint::from_fn(|| async { read_my_device_id_async().await }));

• A function is called the first time the fingerprint is needed, and its result is kept while the app runs.
• It returns a String, so it can’t fail: return a fallback value yourself when your source is unavailable, and keep it stable.
• An empty string is accepted: every computer then has the same machine part, and only the install id tells them apart.

See choosing what a machine is for what to use.

Edge cases

Cloned virtual machines share the same machine id. A clone of a virtual machine where your app was already activated also copies the stored install id: both have the same fingerprint, and share one place. Clones made before the first launch of your app each generate their own install id.

Docker and CI, where the machine id file is often missing or shared: the SDK falls back on the MAC address or the hostname, which can change on each run. Pass fingerprint in those environments.

The keychain can’t be written and the file fallback fails too, like on a read-only home folder. The install id can’t be stored: a new one is generated on each launch, and each launch is a new machine. It’s very unlikely on a customer’s computer.

Two products on the same computer have two different fingerprints, and are two machines, one in each license.