Changelog

Changes to the Magistrate module that affect your integration. Versions follow Semantic Versioning.

iOS

The first public release of Magistrate for iOS.

Magistrate(sdk).decide(license:) and decideMany(license:) answer a policy question for the device with YES, NO or UNKNOWN. An UNKNOWN answer carries a cause.
prove(license:nonce:), attestationEnrolment() and challengeEnv(license:) let your server start the check and send the decide itself.
Every answer comes with a signed receipt that your server can verify. See Verify and Enforce.
Each release's SHASUMS256.txt is signed with Sigstore by the repository's sign-release.yml (bundle SHASUMS256.txt.sigstore.json). See Verify the download.
How to report a vulnerability. See Security.
When the policy bundle can't be refreshed, Magistrate falls back to the last one it verified, but only for the same bundle URL and only while that bundle still verifies against your license's current keys.
Builds signed in with a sandbox token run sandbox checks; their receipts say env: "sandbox". Production receipts say env: "release".
Requires octet-sdk-ios 3.1.2, pinned exactly (see Add the packages), and iOS 16 or later.

The first public release of Magistrate for Android (com.octetproof:magistrate).

Magistrate(sdk).decide(license) and decideMany(license, …) answer a policy question for the device with YES, NO or UNKNOWN. An UNKNOWN answer carries a cause.
prove(license, nonce) and challengeEnv(license) let your server start the check and send the decide itself.
Every answer comes with a signed receipt that your server can verify. See Verify and Enforce.
Each release's SHASUMS256.txt is signed with Sigstore by the repository's sign-release.yml (bundle SHASUMS256.txt.sigstore.json). See Verify the download.
How to report a vulnerability. See Security.
When the policy bundle can't be refreshed, Magistrate falls back to the last one it verified, but only for the same bundle URL and only while that bundle still verifies against your license's current keys.
Builds signed in with a sandbox token run sandbox checks; their receipts say env: "sandbox". Production receipts say env: "release".
Brings in com.octetproof:sdk 3.1.2. Needs minSdk 30 and compileSdk 35 or later.