Some injected types collided with existing types.

Some combinations of generic parameters and method signatures are incorrectly optimized resulting in an invalid call signature.

When an assembly has a highly nested type with many methods that share the same signature (~1000+), the zero-width renaming algorithm can generate names that consume too many characters internally.

The encrypted license contents are cached and used when re-saving the license to optimize signature testing. However, changes to the domain name list were not propagated to the license and the cached contents were not invalidated. This has been corrected.

When the license is saved, and the only other change to the license is a domain name, then the changes are not saved - instead the original unmodified version of the license is re-saved.

WCF classes are excluded from anti-reflection. This makes sense as they are public contracts anyway and don't in themselves have any important implementation.

Some assemblies that implement events or interfaces from the COM interop assembly need full analysis. Turns out COMPLUS is a valid runtime for a .NET assembly and all the meta-data is still the same. So the COMPLUS target runtime was added as a supported runtime.

This can be raised when an assembly holds a reference to a COM assembly (not .NET) and CodeVeil attempts to load the referenced assembly. Assembly references are pre-loaded for performance and may not necessarily be used for reflection. Invalid assemblies will simply be ignored.

Already in place, just commented out by default. No enabled by default in debug builds.

The sales tools were accidentally copying the keys to the License folder instead of the Keys folder.

The Xheo.App.v5.dll is available in the main DeployLX application folder but was not included in the NLM redistributable folder.

Some fields marked as ThreadStatic require unique names and the field overloading used by CodeVeil interfered with the static initialization.

The sales tools use the Assembly Bundling and Encryption feature of DeployLX CodeVeil to package everything into a single EXE. When connecting to the web to verify the serial number, the XML Web Service class is compiled. CodeVeil bundles the XmlSerializers into the assembly, however they were not signed so they could not be used.

When the feed contents for the Getting Started feed are corrupt, the XML parsing fails. Added code to fall back to original feed content if downloaded content is invalid.

To maintain backwards compatibility with DeployLX 4.0 Network Certificates, DeployLX 5.0 embedded the old key in the DeployLX.Licensing.Nlm.v5.dll. However the key was not added to the .NET 4.0 build scripts.

a detailed example could be very useful

DeployLX uses system functions available from the .NET runtime to verify the authenticity of running assemblies. For some reason the .NET 4.0 versions of these system calls require .NET 2.0.

A simple .config file redirect would work like that used in the DeployLX.exe.config file. However that's not an ideal solution since it would require additional deployment requirements to the end user. Check on doing everything via reflection.

The timer resolution used to expire the checked out license was limited to Int32.MaxValue milliseconds which overflows just over 24 days. Updated to perform a infrequent but periodic check instead.

Project generation requires database setup. Providing a ready made project would be bare bones and would not remove any burden from the end user.

Changed so that any change to admin requirements propagate to all licenses in the license file.

The limits that copy to the clipboard already provide an email template that can be modified to provide a custom message or format to the clipboard.

This would be better handled by a dedicated feature tracking component to be release at a later date.

The code was left over from .NET 1.1 where DateTime did not provide an explicit method of setting the Kind to UTC. The calculation required obtaining the UTC offset for the current date and time and making two adjustments. When these two adjustments border a DST time change, the end result is off by an hour. The code has been updated to use the , DateTimeKind.Utc feature available in .NET 2.0 and later so no adjustments are required.

With support for the client profile (#DLX-92) rather than show a warning, DeployLX will pick the correct runtime.

SmartAssembly protected assemblies contain an invalid meta-data stream. Added support to ignore this stream.

The web deployment tool generates assemblies with references to core system assemblies using the full public key instead of the public key token. The cecil library was reading these as tokens and when passed to Assembly.Load resulted in the ArgumentException. Cecil library has been updated to load the full public key when present.

DeployLX manager can already generate database tables. No need to a second method.

Rejected, not enough demand for the added complexity it would bring. Custom error messages can be created using the existing translation tool.

DeployLX will now search for culture specific versions of an image by prefixing the extension with the current ui culture.

For example, when using en-US, and requesting the resource logo.png, DeployLX will try the following resources

• logo.en-US.png
  
• logo.en.png
  
• logo.png
  

No direct solution, little demand. Closing for now.

We also need this. I believe that on the licensing server there should be a way to set how many - desktop & laptop - activations can be done per serial number. This would really simplify serial number management.

Further research shows additional configuration settings can confine the runtime to the full version.

<supportedRuntime version="v4.0.30319" sku="Default" />

Running in the main domain does present a potential Out of Memory exception for exceptionally large projects. In such cases, developers can use a custom Exec task to run the cve.exe command line tool passing the path to the CodeVeil project to be processed. The primary drawback with this solution is that the MSBuild logging integration is lost and CodeVeil outputs it's own raw logging info to the console. This is still captured in the MSBuild log, it's just a bit less reader friendly when looking at the build log.

DeployLX CodeVeil assembly loading and caching has been migrated from a global static cache, to a per-project instance cache. This permits .NET to free the memory used during the veiling process when complete and should allow CodeVeil to run in the primary domain eliminating this problem.

The Veil and VeilProject tasks are loaded into their own AppDomain when run from within MSBuild. This is done to help manage the memory that CodeVeil uses when analyzing the assemblies in the project and free it up when CodeVeil is done using them. When run in an isolated AppDomain, MSBuild creates a remote object in the isolated domain and holds a handle to the Veil or VeilProject task. For some reason, .NET is freeing the remote object due to some timeout value. When CodeVeil completes, the handle held in the main domain is no longer valid and .NET throws this exception.

Added guards to prevent saving disposed licenses and added additional synchronization to prevent saving a disposed license. Removes license from the cache when disposed.

Requires .NET 2.0 SP2 for transparent security.

Only concrete generic calls can be shadowed. Calls to generic methods that use a generic parameter from the calling method or type cannot be resolved until the containing type/method is resolved. Each resolution would require a unique delegate which cannot be determined until runtime.

Too many dependencies on system information for even basic validation. Many system checks such as os version and process bitness require PInvoke which isn't allowed in Medium Trust.

Added a new ShowFormFilter property to LicenseValidationRequestInfo. Developers can now override the default form showing logic at runtime.

Won't implement because xTEA algorithm requires a minimum of 64-bits to encode data which results in much longer serial numbers once transposed to base 36.

Add a web service that will map license error ids to KB articles. If found, show to developer.

When the license is disposed, the time limit makes a final check to make sure it's counter's are up-to-date and synchronized. However, by this time, the validation context has expired and the DontPersistToStorage option is no longer present, resulting in all secure storage state being persisted.

The ability to provide a custom HttpEncoder was introduced in .NET 4.0. We've added code to detect if licensing is being validated under .NET 4.0 and use the default encoder instead.

The CRM Web.config defines a custom HTTP encoder which appears to be a bit more aggressive in escaping characters than actually required.

<httpRuntime executionTimeout="300" 
             maxRequestLength="32768" 
             requestValidationMode="3.0" 
             encoderType="Microsoft.Crm.CrmHttpEncoder, Microsoft.Crm" />

This encoder appears to encode anything but alpha-numeric values to their entity equivalent.

A short-circuit optimization meant to make the invalid serial number error more user friendly also invalidates the scenario where there are no licenses to unlock and registration is used simply to gather customer details.

Added workaround to use invariant culture. Still need to review other possible edge cases.