pixop-license

Operator-facing license status, JWT inspection, refresh, and diagnostics on the Pixop LIVE guest appliance.

Version note: CLI flags may differ by AMI recipe. Confirm on your appliance with pixop-version, command -v pixop-license, and pixop-license -h. Self-elevates to root unless PIXOP_LICENSE_NOSUDO is set.

This page covers operator commands only — not internal activation scripts (pixop-marketplace, pixop-instance-init implementation).

Usage

pixop-license {status|decode|refresh|doctor|token} [--json]
pixop-license -h|--help

--json applies to status, decode, and doctor (machine-readable). refresh with --json adds "refreshStarted": true to the status payload.

AWS Marketplace workflow

After launch:

pixop-license doctor

If license_manager_initialized fails (account-level License Manager service-linked role missing), initialize License Manager once per AWS account, then:

sudo systemctl restart pixop-instance-init.service
pixop-license doctor

Ongoing:

pixop-license status
pixop-license refresh    # kicks background refresh; may update cached state

status fields include Marketplace linkage, last AWS verification, Pulse refresh times, FLEX hour consumption (when contract data is present), license validity, and Pulse deployment/telemetry flags. Fields may vary by appliance release; verify on your build with pixop-license status.

KVM workflow

License installation and renewal happen on the Ubuntu KVM host (from the Pixop installer bundle directory), not via Marketplace APIs inside the guest:

cd /path/to/extracted-installer
GUEST_IP="203.0.113.10"   # replace with the guest LAN address
sudo ./scripts/pixop-install license status \
  --identity ~/.ssh/id_ed25519 \
  --guest-host "${GUEST_IP}"
sudo ./scripts/pixop-install license set /path/to/license.jwt \
  --identity ~/.ssh/id_ed25519 \
  --guest-host "${GUEST_IP}"

See KVM deployment guide and pixop-install.

Inside the guest you may still run:

pixop-license status
pixop-license decode

doctor on KVM typically reports Marketplace checks as skipped (classification=skipped) — treat AWS-specific rows as N/A, not failures.

See KVM quickstart.

Security and support hygiene

pixop-license token reads /etc/pixop-live/license.jwt and writes only the compact JWT string to stdout (no labels). Errors go to stderr. Prefer status (hashes) or decode (claims) for support workflows instead of exporting the JWT.

refresh may change cached license/commercial state after the refresh unit runs; it does not replace hypervisor pixop-install license set on KVM.

Command details

status

Reads local state files and contract cache. Safe for automation if you avoid leaking full JSON into public systems.

decode

Shows payload claims from /etc/pixop-live/license.jwt (path may vary by image). Signatures are not verified in this command.

refresh

1. systemctl start pixop-marketplace-refresh.service (or equivalent start helper).
2. Immediately prints current status (refresh may still be running asynchronously).

doctor

Structured checks include (when not skipped): IMDS, product code, License Manager access, FLEX checkout, pulse.env Basic Auth, JWT presence/decodability, Pulse HTTPS reachability, and agreement state. Exit 1 when ok is false in JSON or formatted output shows failures.

Troubleshooting

Related

• AWS Marketplace quickstart
• Monitoring and troubleshooting
• Configuration