检查“发布版本”在运行时

问题描述:

我正在为我开发的组件创建一个.framework(或静态库),并且我想向第三方销售。

I'm creating a .framework (or a static library) for a component that I developed and that I'd like to sell to third-parties.

我计划添加一些代码来保护框架免受未经授权的重新使用,重新分发或转售。

I was planning to add some code to protect the framework from unauthorised re-use, re-distribution or re-sale.

我认为实现这一目标的一个好方法是要求购买者告诉我将使用该框架的应用程序的包ID,将其作为NSString属性保存在框架中,并创建一个方法,在运行时检查使用该应用程序的应用程序的包ID框架匹配与否。

I think a good way to achieve this would be to ask to the purchaser to tell me what is the bundle ID of the app that will use the framework, save it in the framework as an NSString property and create a method that checks at runtime if the bundle ID of the app that is using the framework match or not.

但是我也想让框架可以免费试用。因此,我想启用捆绑ID检查,然后才能在发布模式下编译包含应用程序,或者在开发沙箱外部的最终用户设备上运行应用程序。

However I'd like also to make the framework available to try for free. Therefore I want to enable the bundle ID check only then the containing app is compiled in released mode, or when the app is running on the end user device, outside the development sandbox.

当然我不能使用任何依赖于项目文件中设置的变量或宏的方法,因为它们太容易被利用。我需要在运行时进行...并且购买者无需任何操作。

Of course I can't use any methods that relies on variables or macros set in the project file, because they would be too easy to exploit. I need to do it at runtime... and without any action needed by the purchaser.

有没有办法在运行时检查应用程序是否在开发人员中运行沙箱与否?或者,如果已使用发布版本配置文件构建应用程序?

Is there a way to check at runtime if an app is running in the developer sandbox or not? Or if an app has been built with the release build profile?

谢谢!

过去,我已经实现了一个简单的定时炸弹到期,可以免费进行eval但不能自由部署组件。该库将在某个日期X起作用,然后停止工作。用户只需重新下载最新位即可继续评估。一个付费订单,没有定时炸弹的下载链接或带有数字签名许可证的许可证文件一起禁用定时炸弹逻辑。依靠运行时的环境特性充其量是脆弱的。

In the past, I have implemented a simple time-bomb expiration in free to eval but not free to deploy components. The library would function up to certain date X, and then stop working. The user would just have to re-download the latest bits to continue evaluating. One paid order, a download link is provided without the the time-bomb or a license file with a digitally signed license disabled the time bomb logic all together. Relying on run-time environmental characteristics is fragile at best.