Device Identity
How Runtime identifies an installation for registration, activation, and lease binding — and how to deploy many identical machines safely.
Not just MachineGuid
Do not rely only on Windows MachineGuid, motherboard serial, or IP. Those can collide when you clone a golden image onto many identical PCs.
MyHoreca Licensing uses:
| Layer | Role |
|---|---|
| Installation key (key pair) | Strong identity of this install |
| Weighted fingerprint | Supporting signals (hostname, MachineGuid, …) with low weight alone |
| Clone assessment | Flags weak-only matches as likely clones |
Platform policy: ADR-0028 (private) · Wave 11 Devices.
Golden image — correct
- Put the app/SDK into the image without an installation private key and without already-activated local license material.
- On first boot / first run of each machine, generate (or enroll) a new installation key.
- Register the device and activate with the human license key.
- Cache the signed lease; refresh as usual. Local verify: Verify trust (JWKS).
Then 100 machines → 100 distinct identities (if your plan allows 100 node-locked seats).
If you baked the install key into the image
All clones look like one device. One node-locked activation can then be used across the fleet (“one ticket, many seats in the cinema”). Seat limits count identities, not physical boxes.
Treat that image line as compromised identity material: revoke/rotate affected devices and keys; ship a fixed image without the key; generate a new key per install. Continuing to distribute the baked key is conscious license sharing.