# `Aker.Issuer`
[🔗](https://github.com/udin-io/aker/blob/v0.1.0/lib/aker/issuer.ex#L1)

Signs a licence file from an activation request. A licensing server
calls it, and `mix aker.sign` calls it on a developer's machine.

It signs only with the keys its caller hands it, held as
`Aker.SigningKey`. A host may ship it in every release, which is
safe: a host trusts only the root public keys it passes, so nobody
without a trusted root's private key makes a licence the host accepts.

# `certificate`

```elixir
@spec certificate(Aker.SigningKey.t(), Aker.SigningKey.t(), keyword()) :: %{
  certificate: binary(),
  certificate_signature: binary()
}
```

The working key's certificate, signed by the root key: its public key,
`:key_id`, `:not_before` and `:not_after`.

# `issue`

```elixir
@spec issue(binary(), keyword()) ::
  {:ok, binary()} | {:error, :bad_request | {:invalid, atom()}}
```

The licence file for `request_bytes`, a request for `opts[:product]`.

Options: `:product`, `:root_key` and `:working_key`
(`Aker.SigningKey`), `:customer`, `:seats`, `:term_days`, and
optionally `:features` (`[]`), `:serial` (1), `:moves_per_term` (20),
`:key_id` (`"dev"`) and `:now`.

It signs only a licence `Aker.LicenceFile.verify/2` reads back, and
answers `{:error, {:invalid, option}}` for the first option outside the
reader's bounds, or `{:error, {:invalid, :size}}` when the licence would
be over the reader's 4 KB.

# `sign`

```elixir
@spec sign(map(), Aker.SigningKey.t(), map()) :: binary()
```

The licence file for `fields`, signed by `working_key`, carrying `certificate`.

# `uuid`

```elixir
@spec uuid() :: String.t()
```

A random UUID, version 4 (RFC 9562), as lowercase text.

---

*Consult [api-reference.md](api-reference.md) for complete listing*