feat(wm): add a splash screen for mdm devices

LGUG2Z · LGUG2Z · commit 07b6367eab77 · 2025-10-28T17:48:48.000-07:00
A little nudge for people to do the right thing, 1990s vibes.
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/deny.toml b/deny.toml
@@ -22,6 +22,7 @@ ignore = [
 allow = [
     "0BSD",
     "Apache-2.0",
+    "Apache-2.0 WITH LLVM-exception",
     "Artistic-2.0",
     "BSD-2-Clause",
     "BSD-3-Clause",
diff --git a/dependencies.json b/dependencies.json
diff --git a/docs/cli/animation-style.md b/docs/cli/animation-style.md
@@ -10,8 +10,8 @@ Options:
           Desired ease function for animation
           
           [default: linear]
-          [possible values: linear, ease-in-sine, ease-out-sine, ease-in-out-sine, ease-in-quad, ease-out-quad, ease-in-out-quad, ease-in-cubic, ease-in-out-cubic, ease-in-quart, ease-out-quart, ease-in-out-quart, ease-in-quint, ease-out-quint, ease-in-out-quint,
-          ease-in-expo, ease-out-expo, ease-in-out-expo, ease-in-circ, ease-out-circ, ease-in-out-circ, ease-in-back, ease-out-back, ease-in-out-back, ease-in-elastic, ease-out-elastic, ease-in-out-elastic, ease-in-bounce, ease-out-bounce, ease-in-out-bounce]
+          [possible values: linear, ease-in-sine, ease-out-sine, ease-in-out-sine, ease-in-quad, ease-out-quad, ease-in-out-quad, ease-in-cubic, ease-in-out-cubic, ease-in-quart, ease-out-quart, ease-in-out-quart, ease-in-quint, ease-out-quint, ease-in-out-quint, ease-in-expo,
+          ease-out-expo, ease-in-out-expo, ease-in-circ, ease-out-circ, ease-in-out-circ, ease-in-back, ease-out-back, ease-in-out-back, ease-in-elastic, ease-out-elastic, ease-in-out-elastic, ease-in-bounce, ease-out-bounce, ease-in-out-bounce]
 
   -a, --animation-type <ANIMATION_TYPE>
           Animation type to apply the style to. If not specified, sets global style
diff --git a/docs/cli/enable-autostart.md b/docs/cli/enable-autostart.md
@@ -12,9 +12,6 @@ Options:
       --whkd
           Enable autostart of whkd
 
-      --ahk
-          Enable autostart of ahk
-
       --bar
           Enable autostart of komorebi-bar
 
diff --git a/docs/cli/kill.md b/docs/cli/kill.md
@@ -9,9 +9,6 @@ Options:
       --whkd
           Kill whkd if it is running as a background process
 
-      --ahk
-          Kill ahk if it is running as a background process
-
       --bar
           Kill komorebi-bar if it is running as a background process
 
diff --git a/docs/cli/license.md b/docs/cli/license.md
@@ -0,0 +1,16 @@
+# license
+
+```
+Specify an email associated with an Individual Commercial Use License
+
+Usage: komorebic.exe license <EMAIL>
+
+Arguments:
+  <EMAIL>
+          Email address associated with an Individual Commercial Use License
+
+Options:
+  -h, --help
+          Print help
+
+```
diff --git a/docs/cli/start.md b/docs/cli/start.md
@@ -18,9 +18,6 @@ Options:
       --whkd
           Start whkd in a background process
 
-      --ahk
-          Start autohotkey configuration file
-
       --bar
           Start komorebi-bar in a background process
 
diff --git a/docs/cli/stop.md b/docs/cli/stop.md
@@ -9,9 +9,6 @@ Options:
       --whkd
           Stop whkd if it is running as a background process
 
-      --ahk
-          Stop ahk if it is running as a background process
-
       --bar
           Stop komorebi-bar if it is running as a background process
 
diff --git a/docs/example-configurations.md b/docs/example-configurations.md
@@ -16,13 +16,29 @@ the example files have been downloaded. For most new users this will be in the
 komorebic quickstart
 ```
 
+## Corporate Devices Enrolled in MDM
+
+If you are using `komorebi` on a corporate device enrolled in mobile device
+management, you will receive a pop-up when you run `komorebic start` reminding
+you that the [Komorebi License](https://github.com/LGUG2Z/komorebi-license) does
+not permit any kind of commercial use.
+
+You can remove this pop-up by running `komorebic license <email>` with the email
+associated with your Individual Commercial Use License. A single HTTP request
+will be sent with the given email address to verify license validity.
+
+## Starting komorebi
+
 With the example configurations downloaded, you can now start `komorebi`,
 `komorebi-bar` and `whkd`.
 
 ```powershell
 komorebic start --whkd --bar
 ```
 
+If you don't want to use the komorebi status bar, you can remove the `--bar` option
+from the above command.
+
 ## komorebi.json
 
 The example window manager configuration sets some sane defaults and provides
diff --git a/justfile b/justfile
@@ -15,6 +15,9 @@ fmt:
     prettier --write .github/FUNDING.yml
     prettier --write .github/workflows/windows.yaml
 
+fix:
+    cargo clippy --fix --allow-dirty
+
 install-targets *targets:
     "{{ targets }}" -split ' ' | ForEach-Object { just install-target $_ }
 
@@ -90,4 +93,5 @@ schemagen:
     mv ./bar-config-docs/schema.bar.html ./bar-config-docs/schema.html
 
 depgen:
+    cargo deny check
     cargo deny list --format json | jq 'del(.unlicensed)' > dependencies.json
diff --git a/komorebi-client/src/lib.rs b/komorebi-client/src/lib.rs
@@ -66,6 +66,7 @@ pub use komorebi::core::replace_env_in_path;
 pub use komorebi::monitor::Monitor;
 pub use komorebi::monitor_reconciliator::MonitorNotification;
 pub use komorebi::ring::Ring;
+pub use komorebi::splash;
 pub use komorebi::state::GlobalState;
 pub use komorebi::state::State;
 pub use komorebi::win32_display_data;
diff --git a/komorebi/Cargo.toml b/komorebi/Cargo.toml
@@ -10,13 +10,16 @@ edition = "2024"
 [dependencies]
 komorebi-themes = { path = "../komorebi-themes" }
 
+base64 = "0.21"
 bitflags = { version = "2", features = ["serde"] }
 clap = { workspace = true }
+chrono = { workspace = true }
 color-eyre = { workspace = true }
 crossbeam-channel = { workspace = true }
 crossbeam-utils = { workspace = true }
 ctrlc = { version = "3", features = ["termination"] }
 dirs = { workspace = true }
+ed25519-dalek = "2"
 hotwatch = { workspace = true }
 lazy_static = { workspace = true }
 miow = "0.6"
@@ -27,9 +30,10 @@ parking_lot = { workspace = true }
 paste = { workspace = true }
 powershell_script = "1.0"
 regex = "1"
+reqwest = { version = "0.12", features = ["blocking"] }
 schemars = { workspace = true, optional = true }
 serde = { workspace = true }
-serde_json = { workspace = true }
+serde_json = { workspace = true, features = ["preserve_order"] }
 serde_yaml = { workspace = true }
 shadow-rs = { workspace = true }
 strum = { workspace = true }
diff --git a/komorebi/src/lib.rs b/komorebi/src/lib.rs
@@ -16,6 +16,7 @@ pub mod process_event;
 pub mod process_movement;
 pub mod reaper;
 pub mod set_window_position;
+pub mod splash;
 pub mod stackbar_manager;
 pub mod state;
 pub mod static_config;
@@ -255,6 +256,21 @@ pub static WINDOW_HANDLING_BEHAVIOUR: AtomicCell<WindowHandlingBehaviour> =
 
 shadow_rs::shadow!(build);
 
+pub const PUBLIC_KEY: [u8; 32] = [
+    0x5a, 0x69, 0x4a, 0xe1, 0x3c, 0x4b, 0xc8, 0x4e, 0xc3, 0x79, 0x0f, 0xab, 0x27, 0x6b, 0x7e, 0xdd,
+    0x6b, 0x39, 0x6f, 0xa2, 0xc3, 0x9f, 0x3d, 0x48, 0xf2, 0x72, 0x56, 0x41, 0x1b, 0xc8, 0x08, 0xdb,
+];
+
+#[derive(Default, Debug, Clone, PartialEq, Deserialize)]
+pub struct License {
+    #[serde(rename = "hasValidSubscription")]
+    pub has_valid_subscription: bool,
+    pub timestamp: i64,
+    #[serde(rename = "currentEndPeriod")]
+    pub current_end_period: Option<i64>,
+    pub signature: String,
+}
+
 /// A trait for types that can be marked as locked or unlocked.
 pub trait Lockable {
     /// Returns `true` if the item is locked.
diff --git a/komorebi/src/process_event.rs b/komorebi/src/process_event.rs
@@ -1,3 +1,4 @@
+use std::process::Command;
 use std::sync::Arc;
 use std::sync::atomic::Ordering;
 
@@ -27,6 +28,8 @@ use crate::border_manager::BORDER_OFFSET;
 use crate::border_manager::BORDER_WIDTH;
 use crate::current_virtual_desktop;
 use crate::notify_subscribers;
+use crate::splash;
+use crate::splash::mdm_enrollment;
 use crate::stackbar_manager;
 use crate::state::State;
 use crate::transparency_manager;
@@ -42,6 +45,24 @@ use crate::workspace::WorkspaceLayer;
 pub fn listen_for_events(wm: Arc<Mutex<WindowManager>>) {
     let receiver = wm.lock().incoming_events.clone();
 
+    std::thread::spawn(|| {
+        loop {
+            if let Ok((mdm, server)) = mdm_enrollment() {
+                #[allow(clippy::collapsible_if)]
+                if mdm && splash::should().unwrap_or(true) {
+                    let mut args = vec!["splash".to_string()];
+                    if let Some(server) = server {
+                        args.push(server);
+                    }
+
+                    let _ = Command::new("komorebic").args(&args).spawn();
+                }
+            }
+
+            std::thread::sleep(std::time::Duration::from_secs(14400));
+        }
+    });
+
     std::thread::spawn(move || {
         tracing::info!("listening");
         loop {
diff --git a/komorebi/src/splash.rs b/komorebi/src/splash.rs
@@ -0,0 +1,135 @@
+use crate::DATA_DIR;
+use crate::HOME_DIR;
+use crate::License;
+use crate::PUBLIC_KEY;
+use base64::Engine;
+use base64::engine::general_purpose;
+use chrono::Duration;
+use chrono::TimeZone;
+use chrono::Utc;
+use color_eyre::eyre;
+use color_eyre::eyre::OptionExt;
+use ed25519_dalek::Verifier;
+use ed25519_dalek::VerifyingKey;
+use std::process::Command;
+
+pub fn mdm_enrollment() -> eyre::Result<(bool, Option<String>)> {
+    let mut command = Command::new("dsregcmd");
+    command.args(["/status"]);
+    let stdout = command.output()?.stdout;
+    let output = std::str::from_utf8(&stdout)?;
+    if !output.contains("MdmUrl") {
+        return Ok((false, None));
+    }
+
+    let mut server = None;
+
+    for line in output.lines() {
+        if line.contains("MdmUrl") {
+            let line = line.trim().to_string();
+            server = Some(line.trim_start_matches("MdmUrl : ").to_string())
+        }
+    }
+
+    Ok((true, server))
+}
+
+fn is_valid_payload(raw: &str, fresh: bool) -> eyre::Result<bool> {
+    let mut validation_successful = false;
+
+    let payload = serde_json::from_str::<License>(raw)?;
+
+    let signature = ed25519_dalek::Signature::from_slice(
+        general_purpose::STANDARD
+            .decode(&payload.signature)?
+            .as_slice(),
+    )?;
+
+    let mut value: serde_json::Value = serde_json::from_str(raw)?;
+    if let serde_json::Value::Object(ref mut map) = value {
+        map.remove("signature");
+    }
+
+    let message_to_verify = serde_json::to_string(&value)?;
+    let verifying_key = VerifyingKey::from_bytes(&PUBLIC_KEY)?;
+
+    if verifying_key
+        .verify(message_to_verify.as_bytes(), &signature)
+        .is_ok()
+    {
+        if fresh {
+            let timestamp = Utc
+                .timestamp_opt(payload.timestamp, 0)
+                .single()
+                .ok_or_eyre("invalid timestamp")?;
+
+            let valid_duration = Utc::now() - Duration::minutes(5);
+
+            if timestamp <= valid_duration {
+                tracing::debug!("individual commercial use license verification payload was stale");
+                return Ok(true);
+            }
+        }
+
+        if payload.has_valid_subscription
+            && let Some(current_end_period) = payload.current_end_period
+        {
+            let subscription_valid_until = Utc
+                .timestamp_opt(current_end_period, 0)
+                .single()
+                .ok_or_eyre("invalid timestamp")?;
+
+            if Utc::now() <= subscription_valid_until {
+                tracing::debug!(
+                    "individual commercial use license verification - subscription valid until: {subscription_valid_until}",
+                );
+
+                validation_successful = true;
+            }
+        }
+    }
+
+    Ok(validation_successful)
+}
+
+pub fn should() -> eyre::Result<bool> {
+    let icul_validation = DATA_DIR.join("icul.validation");
+    if icul_validation.exists() {
+        tracing::debug!("found local individual commercial use license validation payload");
+        let raw_payload = std::fs::read_to_string(&icul_validation)?;
+        if is_valid_payload(&raw_payload, false)? {
+            return Ok(false);
+        } else {
+            std::fs::remove_file(&icul_validation)?;
+        }
+    }
+
+    let icul = DATA_DIR.join("icul");
+    if !icul.exists() {
+        return Ok(true);
+    }
+
+    let email = std::fs::read_to_string(icul)?;
+    tracing::debug!("found individual commercial use license email: {}", email);
+
+    let client = reqwest::blocking::Client::new();
+    let response = match client
+        .get("https://kw-icul.lgug2z.com")
+        .query(&[("email", email.trim())])
+        .send()
+    {
+        Ok(response) => response,
+        Err(error) => {
+            tracing::error!("{error}");
+            return Ok(true);
+        }
+    };
+
+    let raw_payload = response.text()?;
+    if is_valid_payload(&raw_payload, true)? {
+        std::fs::write(icul_validation, &raw_payload)?;
+        Ok(false)
+    } else {
+        Ok(true)
+    }
+}
diff --git a/komorebic/Cargo.toml b/komorebic/Cargo.toml
@@ -18,6 +18,7 @@ dunce = { workspace = true }
 fs-tail = "0.1"
 lazy_static = { workspace = true }
 miette = { version = "7", features = ["fancy"] }
+open = "5"
 paste = { workspace = true }
 powershell_script = "1.0"
 reqwest = { version = "0.12", features = ["blocking"] }
@@ -28,6 +29,7 @@ shadow-rs = { workspace = true }
 sysinfo = { workspace = true }
 thiserror = "2"
 which = { workspace = true }
+win-msgbox = "0.2"
 windows = { workspace = true }
 
 [build-dependencies]
diff --git a/komorebic/src/main.rs b/komorebic/src/main.rs
diff --git a/mkdocs.yml b/mkdocs.yml
