# Beta install keys (Windows installer)

## What this is

Public beta **Setup.exe** builds include a wizard page that asks for an **install key**. Keys are **not** validated inside the OinkScape application — only in **Inno Setup** during installation.

## Format

- **32 unique keys** per wave (configurable in the generator).
- Each key is **16 random hexadecimal digits** (8 bytes from `secrets.token_bytes(8)`), shown as **eight pairs**: `XX-XX-XX-XX-XX-XX-XX-XX`.
- User input is **normalized**: non-hex characters are stripped; comparison is case-insensitive on A–F.

This is **not** encryption of a payload; it is **unguessable random material** suitable for a lightweight gate. Anyone with the installer and the validation include could extract the allowed values, so treat the `.inc` file as **secret** (see below).

## Generate keys and Inno include

From `apps/OinkScape`:

```powershell
python packaging\tools\gen_beta_install_keys.py --count 32 --label 4.5
```

Outputs under `packaging/private/`:

| File | Use |
|------|-----|
| `beta_install_keys_validation.inc` | `#include` target for `packaging/OinkScape_Beta4.5.iss` |
| `beta_install_keys_4.5_SECRET.txt` | One key per line — **email / CRM only** |

**Regenerating invalidates all prior keys** for that build. Rebuild the installer after any regeneration.

## Git and CI

By default, `.gitignore` excludes the `.inc` and `*_SECRET.txt` files so keys are not pushed accidentally. Your release machine (or secure CI secret) should hold the `.inc` that matches the keys you emailed.

`.\build_windows_beta.ps1 -Installer` checks that `beta_install_keys_validation.inc` exists before invoking ISCC.

## Rotating for a future beta

1. Bump version strings and `OutputBaseFilename` in the `.iss` file as needed.  
2. Run the generator with a new `--label` (e.g. `4.6`).  
3. Distribute new keys only to the new cohort.  
4. Optionally change `AppId` in the `.iss` file if you want a side-by-side install lineage (usually keep the same `AppId` for upgrades).