fix update script failure when image tag is missing

* Update URL with version information

The previous URL is no longer working. Instead of the site redirect, switching directly to the official GitHub repository of Bitwarden to download the latest version information.

* Update update-bitwarden.sh

* Add prerequisite checks and switch JSON parsing to jq

The URL with the version of self-hosted Bitwarden is not working anymore. Now we're querying the official GitHub repository of Bitwarden and using jq to find the current released version. For simplification, we've moved to jq instead of sed/awk combinations and also added prerequisite checks for docker, openssl, and jq to avoid build failures.

* Add prerequisite checks and switch JSON parsing to jq

The URL with the version of self-hosted Bitwarden is not working anymore. Now we're querying the official GitHub repository of Bitwarden and using jq to find the current released version. For simplification, we've moved to jq instead of sed/awk combinations and also added prerequisite checks for docker, openssl, and jq to avoid build failures. The script was also changed to exit on failure (set -e).

* Update build.sh

Remove duplicate OpenSSL check

* Update update-bitwarden.sh

Remove duplicate OpenSSL check

* Apply suggestions from code review

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: captainhook <16797541+captainhook@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

.keys/generate-keys.sh

@@ -15,6 +15,6 @@ DIR=`exec 2>/dev/null;(cd -- "$DIR") && cd -- "$DIR"|| cd "$DIR"; unset PWD; /us
 # Generate new keys
 openssl	req -x509 -newkey rsa:4096 -keyout "$DIR/key.pem" -out "$DIR/cert.cert" -days 36500 -subj '/CN=www.mydom.com/O=My Company Name LTD./C=US'  -outform DER -passout pass:test
 openssl x509 -inform DER -in "$DIR/cert.cert" -out "$DIR/cert.pem"
-openssl pkcs12 -export -out "$DIR/cert.pfx" -inkey "$DIR/key.pem" -in "$DIR/cert.pem" -passin pass:test -passout pass:test
+openssl pkcs12 -export -out "$DIR/cert.pfx" -inkey "$DIR/key.pem" -in "$DIR/cert.pem" -passin pass:test -passout pass:test -certpbe AES-256-CBC -keypbe AES-256-CBC -macalg SHA256
 
 ls

README.md

@@ -68,15 +68,27 @@ From the BitBetter directory, simply run:
 
 This will create a new self-signed certificate in the `.keys` directory if one does not already exist and then create a modified version of the official `bitwarden/api` called `bitbetter/api` and a modified version of the `bitwarden/identity` called `bitbetter/identity`.
 
+By default, the build script runs in **fast patch mode**: it pulls the official Bitwarden images from the GitHub Container Registry and patches the license certificate directly inside them — no local compilation required.
+
+To instead **build from source**, set the `BITBETTER_BUILD_FROM_SOURCE` environment variable to `1` before running the script:
+
+```bash
+BITBETTER_BUILD_FROM_SOURCE=1 ./build.sh
+```
+
+In source build mode the script clones the Bitwarden server repository at the matching version tag, replaces the embedded license certificate, and compiles the `api` and `identity` images from scratch. This takes considerably longer but gives you full control over the build.
+
 You may now simply create the file `/path/to/bwdata/docker/docker-compose.override.yml` with the following contents to utilize the modified images.
 
 ```yaml
 services:
   api:
     image: bitbetter/api
+    pull_policy: never
 
   identity:
     image: bitbetter/identity
+    pull_policy: never
 ```
 
 You'll also want to edit the `/path/to/bwdata/scripts/run.sh` file. In the `function restart()` block, comment out the call to `dockerComposePull`.
@@ -91,6 +103,16 @@ You can now start or restart Bitwarden as normal and the modified api will be us
 
 To update Bitwarden, the provided `update-bitwarden.sh` script can be used. It will rebuild the BitBetter images and automatically update Bitwarden afterwards. Docker pull errors can be ignored for api and identity images.
 
+By default, the images are built in **fast patch mode**: the official Bitwarden images are pulled from the GitHub Container Registry and the license certificate are directly patched inside them.
+
+To instead **build from source**, set the `BITBETTER_BUILD_FROM_SOURCE` environment variable to `1` before running the script:
+
+```bash
+BITBETTER_BUILD_FROM_SOURCE=1 ./update-bitwarden.sh
+```
+
+In source build mode the script clones the Bitwarden server repository at the matching version tag, replaces the embedded license certificate, and compiles the `api` and `identity` images from scratch. This takes considerably longer but gives you full control over the build.
+
 You can either run this script without providing any parameters in interactive mode (`./update-bitwarden.sh`) or by setting the parameters as follows, to run the script in non-interactive mode:
 ```bash
 ./update-bitwarden.sh param1 param2 param3

build.sh

@@ -2,7 +2,15 @@
 set -e
 DIR=`dirname "$0"`
 DIR=`exec 2>/dev/null;(cd -- "$DIR") && cd -- "$DIR"|| cd "$DIR"; unset PWD; /usr/bin/pwd || /bin/pwd || pwd`
-BW_VERSION=$(curl -sL https://go.btwrdn.co/bw-sh-versions | grep '^ *"'coreVersion'":' | awk -F\: '{ print $2 }' | sed -e 's/,$//' -e 's/^"//' -e 's/"$//')
+
+# Check prerequisite libraries and executables
+for cmd in docker curl openssl jq; do
+    command -v "$cmd" >/dev/null 2>&1 || { echo "Error: '$cmd' is required but not installed." >&2; exit 1; }
+done
+if [ "${BITBETTER_BUILD_FROM_SOURCE:-0}" = "1" ]; then
+    command -v git >/dev/null 2>&1 || { echo "Error: 'git' is required for BITBETTER_BUILD_FROM_SOURCE=1 but not installed." >&2; exit 1; }
+fi
+BW_VERSION=$(curl -fsSL https://raw.githubusercontent.com/bitwarden/self-host/refs/heads/main/version.json | jq -er '.versions.coreVersion')
 
 echo "Building BitBetter for BitWarden version $BW_VERSION"
 
@@ -28,35 +36,66 @@ echo "Using BUILDPLATFORM=$BUILDPLATFORM TARGETPLATFORM=$TARGETPLATFORM"
 # If there aren't any keys, generate them first.
 [ -e "$DIR/.keys/cert.cert" ] || "$DIR/.keys/generate-keys.sh"
 
-# Prepare Bitwarden server repository
+if [ "${BITBETTER_BUILD_FROM_SOURCE:-0}" = "1" ]; then
-rm -rf $DIR/server
+	echo "--- Source build mode ---"
-git clone --branch "v${BW_VERSION}" --depth 1 https://github.com/bitwarden/server.git $DIR/server
 
-# Replace certificate file and thumbprint
+	# Prepare Bitwarden server repository
-old_thumbprint=$(openssl x509 -inform DER -fingerprint -noout -in $DIR/server/src/Core/licensing.cer | cut -d= -f2 | tr -d ':')
+	rm -rf $DIR/server
-new_thumbprint=$(openssl x509 -inform DER -fingerprint -noout -in $DIR/.keys/cert.cert | cut -d= -f2 | tr -d ':')
+	git clone --branch "v${BW_VERSION}" --depth 1 https://github.com/bitwarden/server.git $DIR/server
-sed -i -e "s/$old_thumbprint/$new_thumbprint/g" $DIR/server/src/Core/Billing/Services/Implementations/LicensingService.cs
-cp $DIR/.keys/cert.cert $DIR/server/src/Core/licensing.cer
 
-docker build \
+	# Replace certificate file and thumbprint
-	--no-cache \
+	old_thumbprint=$(openssl x509 -inform DER -fingerprint -noout -in $DIR/server/src/Core/licensing.cer | cut -d= -f2 | tr -d ':')
-	--platform "$TARGETPLATFORM" \
+	new_thumbprint=$(openssl x509 -inform DER -fingerprint -noout -in $DIR/.keys/cert.cert | cut -d= -f2 | tr -d ':')
-	--build-arg BUILDPLATFORM="$BUILDPLATFORM" \
+	sed -i -e "s/$old_thumbprint/$new_thumbprint/g" $DIR/server/src/Core/Billing/Services/Implementations/LicensingService.cs
-	--build-arg TARGETPLATFORM="$TARGETPLATFORM" \
+	cp $DIR/.keys/cert.cert $DIR/server/src/Core/licensing.cer
-	--label com.bitwarden.product="bitbetter" \
-	-f $DIR/server/src/Api/Dockerfile \
-	-t bitbetter/api \
-	$DIR/server
 
-docker build \
+	docker build \
-	--no-cache \
+		--no-cache \
-	--platform "$TARGETPLATFORM" \
+		--platform "$TARGETPLATFORM" \
-	--build-arg BUILDPLATFORM="$BUILDPLATFORM" \
+		--build-arg BUILDPLATFORM="$BUILDPLATFORM" \
-	--build-arg TARGETPLATFORM="$TARGETPLATFORM" \
+		--build-arg TARGETPLATFORM="$TARGETPLATFORM" \
-	--label com.bitwarden.product="bitbetter" \
+		--label com.bitwarden.product="bitbetter" \
-	-f $DIR/server/src/Identity/Dockerfile \
+		-f $DIR/server/src/Api/Dockerfile \
-	-t bitbetter/identity \
+		-t bitbetter/api \
-	$DIR/server
+		$DIR/server
+
+	docker build \
+		--no-cache \
+		--platform "$TARGETPLATFORM" \
+		--build-arg BUILDPLATFORM="$BUILDPLATFORM" \
+		--build-arg TARGETPLATFORM="$TARGETPLATFORM" \
+		--label com.bitwarden.product="bitbetter" \
+		-f $DIR/server/src/Identity/Dockerfile \
+		-t bitbetter/identity \
+		$DIR/server
+else
+	echo "--- Fast patch mode ---"
+
+	mkdir -p "$DIR/src/bitBetter/.keys"
+	cp "$DIR/.keys/cert.cert" "$DIR/src/bitBetter/.keys/cert.cert"
+
+	# Build the patcher tool inside the SDK container
+	docker run --rm \
+		-v "$DIR/src/bitBetter:/bitBetter" \
+		-w /bitBetter \
+		mcr.microsoft.com/dotnet/sdk:10.0 sh build.sh
+
+	docker build \
+		--no-cache \
+		--platform "$TARGETPLATFORM" \
+		--label com.bitwarden.product="bitbetter" \
+		--build-arg BITWARDEN_TAG="ghcr.io/bitwarden/api:$BW_VERSION" \
+		-t bitbetter/api \
+		"$DIR/src/bitBetter"
+
+	docker build \
+		--no-cache \
+		--platform "$TARGETPLATFORM" \
+		--label com.bitwarden.product="bitbetter" \
+		--build-arg BITWARDEN_TAG="ghcr.io/bitwarden/identity:$BW_VERSION" \
+		-t bitbetter/identity \
+		"$DIR/src/bitBetter"
+fi
 
 docker tag bitbetter/api bitbetter/api:latest
 docker tag bitbetter/identity bitbetter/identity:latest
@@ -64,5 +103,5 @@ docker tag bitbetter/api bitbetter/api:$BW_VERSION
 docker tag bitbetter/identity bitbetter/identity:$BW_VERSION
 
 # Remove old instances of the image after a successful build.
-ids=$( docker images bitbetter/* | grep -E -v -- "CREATED|latest|${BW_VERSION}" | awk '{ print $3 }' )
+ids=$( docker image ls --format="{{ .ID }} {{ .Tag }}" 'bitbetter/*' | grep -E -v -- "CREATED|latest|${BW_VERSION}" | awk '{ ids = (ids ? ids FS $1 : $1) } END { print ids }' )
 [ -n "$ids" ] && docker rmi $ids || true

src/bitBetter/Dockerfile

@@ -0,0 +1,13 @@
+ARG BITWARDEN_TAG
+FROM ${BITWARDEN_TAG}
+
+COPY bin/Release/net10.0/publish/* /bitBetter/
+COPY ./.keys/cert.cert /newLicensing.cer
+
+RUN set -e; set -x; \
+    if [ -f /app/Api ]; then EXEC=Api; else EXEC=Identity; fi && \
+    dotnet /bitBetter/bitBetter.dll /newLicensing.cer /app/$EXEC && \
+    rm -f /app/$EXEC && \
+    printf '#!/bin/sh\nexec dotnet /app/%s.dll "$@"\n' "$EXEC" > /app/$EXEC && \
+    chmod +x /app/$EXEC && \
+    rm -rf /bitBetter /newLicensing.cer

src/bitBetter/Program.cs

@@ -0,0 +1,154 @@
+using System;
+using System.IO;
+using System.Linq;
+using System.Security.Cryptography.X509Certificates;
+using System.Text.Json.Nodes;
+using Mono.Cecil;
+using Mono.Cecil.Cil;
+using Mono.Cecil.Rocks;
+using SingleFileExtractor.Core;
+
+namespace BitwardenSelfLicensor
+{
+    class Program
+    {
+        static int Main(string[] args)
+        {
+            string cerFile   = args.Length >= 1 ? args[0] : "/newLicensing.cer";
+            string inputPath = args.Length >= 2 ? args[1] : "/app/Api";
+
+            string coreDllPath;
+            string extractDir = Path.GetDirectoryName(Path.GetFullPath(inputPath));
+
+            if (string.Equals(Path.GetExtension(inputPath), ".dll", StringComparison.OrdinalIgnoreCase))
+            {
+                // Input is already a direct Core.dll path — skip bundle extraction
+                coreDllPath = inputPath;
+            }
+            else
+            {
+                try
+                {
+                    var reader = new ExecutableReader(inputPath);
+                    reader.ExtractToDirectory(extractDir);
+                    Console.WriteLine($"Extracted bundle to {extractDir}");
+                    coreDllPath = Path.Combine(extractDir, "Core.dll");
+
+                    // The extracted runtimeconfig.json is in self-contained format (no "framework" key).
+                    // Running "dotnet App.dll" requires framework-dependent format; without it .NET looks
+                    // for libhostpolicy.so in the app dir (which isn't there) and crashes.
+                    FixRuntimeConfig(extractDir, Path.GetFileNameWithoutExtension(inputPath));
+                }
+                catch (Exception ex)
+                {
+                    Console.Error.WriteLine($"ERROR: Failed to extract single-file bundle '{inputPath}': {ex.Message}");
+                    return 1;
+                }
+            }
+
+            Console.WriteLine($"Patching: {coreDllPath}");
+
+            var certBytes = File.ReadAllBytes(cerFile);
+            var module    = ModuleDefinition.ReadModule(new MemoryStream(File.ReadAllBytes(coreDllPath)));
+
+            // Replace embedded certificate resource
+            var existingRes = module.Resources
+                .OfType<EmbeddedResource>()
+                .FirstOrDefault(r => r.Name == "Bit.Core.licensing.cer");
+
+            if (existingRes == null)
+            {
+                Console.Error.WriteLine("ERROR: Embedded resource 'Bit.Core.licensing.cer' not found in Core.dll");
+                return 1;
+            }
+
+            Console.WriteLine($"Found resource: {existingRes.Name}");
+            module.Resources.Add(new EmbeddedResource("Bit.Core.licensing.cer", existingRes.Attributes, certBytes));
+            module.Resources.Remove(existingRes);
+
+            var existingCert = X509CertificateLoader.LoadCertificate(existingRes.GetResourceData());
+            var newCert      = X509CertificateLoader.LoadCertificate(certBytes);
+            Console.WriteLine($"Old thumbprint: {existingCert.Thumbprint}");
+            Console.WriteLine($"New thumbprint: {newCert.Thumbprint}");
+
+            // Find LicensingService by class name (namespace-agnostic to handle renames)
+            var type = module.Types.FirstOrDefault(t => t.Name == "LicensingService");
+            if (type == null)
+            {
+                Console.Error.WriteLine("ERROR: LicensingService not found in Core.dll");
+                return 1;
+            }
+            Console.WriteLine($"Found: {type.FullName}");
+
+            var ctor     = type.Resolve().GetConstructors().First();
+            var rewriter = ctor.Body.GetILProcessor();
+
+            // Use Contains() to handle the hidden Unicode LRM character (\u200E) that Bitwarden
+            // prepends to the production thumbprint string literal in LicensingService.cs
+            // Replace ALL occurrences since const fields are inlined at compile time and used in
+            // multiple validation checks (both _creationCertificate and _verificationCertificates)
+            var instructionsToReplace = ctor.Body.Instructions
+                .Where(i => i.OpCode == OpCodes.Ldstr)
+                .Where(i => ((string)i.Operand)
+                    .Contains(existingCert.Thumbprint, StringComparison.OrdinalIgnoreCase))
+                .ToList();
+
+            if (instructionsToReplace.Count > 0)
+            {
+                Console.WriteLine($"Found {instructionsToReplace.Count} thumbprint Ldstr instruction(s) to replace");
+                foreach (var inst in instructionsToReplace)
+                {
+                    Console.WriteLine($"  Replacing: '{inst.Operand}'");
+                    rewriter.Replace(inst, Instruction.Create(OpCodes.Ldstr, newCert.Thumbprint));
+                }
+            }
+            else
+            {
+                Console.WriteLine("WARNING: Thumbprint Ldstr not found — cert resource replaced anyway");
+            }
+
+            module.Write(coreDllPath);
+            Console.WriteLine("Done.");
+            return 0;
+        }
+
+        // Converts a self-contained runtimeconfig.json to framework-dependent so the app can be
+        // launched with "dotnet App.dll" using the system-installed ASP.NET Core runtime.
+        static void FixRuntimeConfig(string dir, string appName)
+        {
+            var path = Path.Combine(dir, $"{appName}.runtimeconfig.json");
+            if (!File.Exists(path))
+            {
+                Console.WriteLine($"runtimeconfig not found at {path}, skipping");
+                return;
+            }
+
+            var root = JsonNode.Parse(File.ReadAllText(path))!;
+            var opts = root["runtimeOptions"]!.AsObject();
+
+            // Derive framework name/version from the self-contained includedFrameworks before removing it
+            string fwName    = "Microsoft.AspNetCore.App";
+            string fwVersion = "10.0.0";
+            if (opts["includedFrameworks"] is JsonArray included && included.Count > 0)
+            {
+                var first = included[0]!.AsObject();
+                fwName    = first["name"]?.GetValue<string>()    ?? fwName;
+                fwVersion = first["version"]?.GetValue<string>() ?? fwVersion;
+            }
+
+            // Remove self-contained markers
+            opts.Remove("includedFrameworks");
+
+            // Add framework-dependent reference (LatestPatch allows compatibility across patch releases only)
+            opts["framework"] = new JsonObject
+            {
+                ["name"]    = fwName,
+                ["version"] = fwVersion
+            };
+            opts["rollForward"] = "LatestPatch";
+
+            File.WriteAllText(path, root.ToJsonString(new System.Text.Json.JsonSerializerOptions { WriteIndented = true }));
+            Console.WriteLine($"Fixed runtimeconfig: {path}");
+        }
+    }
+}

src/bitBetter/bitBetter.csproj

@@ -0,0 +1,13 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <OutputType>Exe</OutputType>
+    <TargetFramework>net10.0</TargetFramework>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Mono.Cecil" Version="0.11.2" />
+    <PackageReference Include="SingleFileExtractor.Core" Version="2.3.0" />
+  </ItemGroup>
+
+</Project>

src/bitBetter/build.sh

@@ -0,0 +1,7 @@
+#!/bin/bash
+
+set -e
+set -x
+
+dotnet restore
+dotnet publish -c Release -o bin/Release/net10.0/publish

src/licenseGen/Dockerfile

@@ -1,4 +1,4 @@
-FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
+FROM mcr.microsoft.com/dotnet/sdk:10.0 AS build
 
 WORKDIR /licenseGen
 
@@ -12,6 +12,6 @@ RUN set -e; set -x; \
 
 FROM bitbetter/api
 
-COPY --from=build /licenseGen/bin/Release/net8.0/publish/* /app/
+COPY --from=build /licenseGen/bin/Release/net10.0/publish/* /app/
 
 ENTRYPOINT [ "dotnet", "/app/licenseGen.dll", "--core", "/app/Core.dll", "--executable", "/app/Api", "--cert", "/cert.pfx" ]

src/licenseGen/Program.cs

@@ -1,11 +1,15 @@
 namespace BitwardenSelfLicensor
 {
     using Microsoft.Extensions.CommandLineUtils;
+    using Microsoft.IdentityModel.Tokens;
     using Newtonsoft.Json;
     using SingleFileExtractor.Core;
     using System;
+    using System.Collections.Generic;
+    using System.IdentityModel.Tokens.Jwt;
     using System.IO;
     using System.Runtime.Loader;
+    using System.Security.Claims;
     using System.Security.Cryptography.X509Certificates;
 
     public static class Program
@@ -20,7 +24,7 @@ namespace BitwardenSelfLicensor
             bool ExecExists() => File.Exists(exec.Value());
             bool CertExists() => File.Exists(cert.Value());
             bool CoreExists() => File.Exists(coreDll.Value());
-            bool VerifyTopOptions() => 
+            bool VerifyTopOptions() =>
                 !string.IsNullOrWhiteSpace(cert.Value()) &&
                 (!string.IsNullOrWhiteSpace(coreDll.Value()) || !string.IsNullOrWhiteSpace(exec.Value())) &&
                 CertExists() &&
@@ -34,7 +38,7 @@ namespace BitwardenSelfLicensor
                 return fileInfo.FullName;
             }
             string GetCoreDllPath() => CoreExists() ? coreDll.Value() : GetExtractedDll();
-            
+
             app.Command("interactive", config =>
             {
                 string buff="", licensetype="", name="", email="", businessname="";
@@ -137,7 +141,7 @@ namespace BitwardenSelfLicensor
                         buff = Console.ReadLine();
                         if ( buff == "" || buff == "y" || buff == "Y" )
                         {
-                            GenerateUserLicense(new X509Certificate2(cert.Value(), "test"), GetCoreDllPath(), name, email, storage, guid, null);
+                            GenerateUserLicense(X509CertificateLoader.LoadPkcs12FromFile(cert.Value(), "test"), GetCoreDllPath(), name, email, storage, guid, null);
                         }
                         else
                         {
@@ -151,7 +155,7 @@ namespace BitwardenSelfLicensor
                         buff = Console.ReadLine();
                         if ( buff == "" || buff == "y" || buff == "Y" )
                         {
-                            GenerateOrgLicense(new X509Certificate2(cert.Value(), "test"), GetCoreDllPath(), name, email, storage, installid, businessname, null);
+                            GenerateOrgLicense(X509CertificateLoader.LoadPkcs12FromFile(cert.Value(), "test"), GetCoreDllPath(), name, email, storage, installid, businessname, null);
                         }
                         else
                         {
@@ -210,7 +214,7 @@ namespace BitwardenSelfLicensor
                         storageShort = (short) parsedStorage;
                     }
 
-                    GenerateUserLicense(new X509Certificate2(cert.Value(), "test"), GetCoreDllPath(), name.Value, email.Value, storageShort, userId, key.Value);
+                    GenerateUserLicense(X509CertificateLoader.LoadPkcs12FromFile(cert.Value(), "test"), GetCoreDllPath(), name.Value, email.Value, storageShort, userId, key.Value);
 
                     return 0;
                 });
@@ -265,7 +269,7 @@ namespace BitwardenSelfLicensor
                         storageShort = (short) parsedStorage;
                     }
 
-                    GenerateOrgLicense(new X509Certificate2(cert.Value(), "test"), GetCoreDllPath(), name.Value, email.Value, storageShort, installationId, businessName.Value, key.Value);
+                    GenerateOrgLicense(X509CertificateLoader.LoadPkcs12FromFile(cert.Value(), "test"), GetCoreDllPath(), name.Value, email.Value, storageShort, installationId, businessName.Value, key.Value);
 
                     return 0;
                 });
@@ -360,19 +364,23 @@ namespace BitwardenSelfLicensor
                 type.GetProperty(name).SetValue(license, value);
             }
 
-            set("LicenseKey", string.IsNullOrWhiteSpace(key) ? Guid.NewGuid().ToString("n") : key);
+            var licenseKey = string.IsNullOrWhiteSpace(key) ? Guid.NewGuid().ToString("n") : key;
+
+            set("LicenseKey", licenseKey);
             set("Id", userId);
             set("Name", userName);
             set("Email", email);
             set("Premium", true);
             set("MaxStorageGb", storage == 0 ? short.MaxValue : storage);
             set("Version", 1);
-            set("Issued", DateTime.UtcNow);
+            var now = DateTime.UtcNow;
-            set("Refresh", DateTime.UtcNow.AddYears(100).AddMonths(-1));
+            set("Issued", now);
-            set("Expires", DateTime.UtcNow.AddYears(100));
+            set("Refresh", now.AddYears(100).AddMonths(-1));
+            set("Expires", now.AddYears(100));
             set("Trial", false);
             set("LicenseType", Enum.Parse(licenseTypeEnum, "User"));
 
+            set("Token", GenerateUserToken(cert, userId, licenseKey, userName, email, storage, now));
             set("Hash", Convert.ToBase64String((byte[])type.GetMethod("ComputeHash").Invoke(license, new object[0])));
             set("Signature", Convert.ToBase64String((byte[])type.GetMethod("Sign").Invoke(license, new object[] { cert })));
 
@@ -394,12 +402,15 @@ namespace BitwardenSelfLicensor
                 type.GetProperty(name).SetValue(license, value);
             }
 
-            set("LicenseKey", string.IsNullOrWhiteSpace(key) ? Guid.NewGuid().ToString("n") : key);
+            var licenseKey = string.IsNullOrWhiteSpace(key) ? Guid.NewGuid().ToString("n") : key;
+            var businessNameFinal = string.IsNullOrWhiteSpace(businessName) ? "BitBetter" : businessName;
+
+            set("LicenseKey", licenseKey);
             set("InstallationId", instalId);
             set("Id", Guid.NewGuid());
             set("Name", userName);
             set("BillingEmail", email);
-            set("BusinessName", string.IsNullOrWhiteSpace(businessName) ? "BitBetter" : businessName);
+            set("BusinessName", businessNameFinal);
             set("Enabled", true);
             set("Plan", "Enterprise (Annually)");
             set("PlanType", Enum.Parse(planTypeEnum, "EnterpriseAnnually"));
@@ -424,22 +435,134 @@ namespace BitwardenSelfLicensor
             set("UseSecretsManager", true);
             set("SmSeats", int.MaxValue);
             set("SmServiceAccounts", int.MaxValue);
-            set("Version", 15); //This is set to 15 to use AllowAdminAccessToAllCollectionItems can be changed to 13 to just use Secrets Manager
+            set("Version", 16);
-            set("Issued", DateTime.UtcNow);
+            var now = DateTime.UtcNow;
-            set("Refresh", DateTime.UtcNow.AddYears(100).AddMonths(-1));
+            set("Issued", now);
-            set("Expires", DateTime.UtcNow.AddYears(100));
+            set("Refresh", now.AddYears(100).AddMonths(-1));
+            set("Expires", now.AddYears(100));
+            set("ExpirationWithoutGracePeriod", now.AddYears(100));
             set("Trial", false);
             set("LicenseType", Enum.Parse(licenseTypeEnum, "Organization"));
-            set("LimitCollectionCreationDeletion", true); //This will be used in the new version of BitWarden but can be applied now
+            set("LimitCollectionCreationDeletion", true);
             set("AllowAdminAccessToAllCollectionItems", true);
             set("UseRiskInsights", true);
             set("UseOrganizationDomains", true);
             set("UseAdminSponsoredFamilies", true);
+            set("UseAutomaticUserConfirmation", true);
+            set("UsePhishingBlocker", true);
+            set("UseDisableSmAdsForUsers", true);
+            set("UseMyItems", true);
 
+            var orgId = (Guid)type.GetProperty("Id").GetValue(license);
+
+            set("Token", GenerateOrgToken(cert, orgId, instalId, licenseKey, email, businessNameFinal, userName, storage, planTypeEnum, now));
             set("Hash", Convert.ToBase64String((byte[])type.GetMethod("ComputeHash").Invoke(license, new object[0])));
             set("Signature", Convert.ToBase64String((byte[])type.GetMethod("Sign").Invoke(license, new object[] { cert })));
 
             Console.WriteLine(JsonConvert.SerializeObject(license, Formatting.Indented));
         }
+
+        private static string GenerateUserToken(X509Certificate2 cert, Guid userId, string licenseKey, string name, string email, short maxStorageGb, DateTime now)
+        {
+            var secKey  = new X509SecurityKey(cert);
+            var creds   = new SigningCredentials(secKey, SecurityAlgorithms.RsaSha256);
+            var expires = now.AddYears(100);
+
+            var claims = new List<Claim>
+            {
+                new Claim("LicenseType",  "User"),
+                new Claim("LicenseKey",   licenseKey),
+                new Claim("Id",           userId.ToString()),
+                new Claim("Name",         name),
+                new Claim("Email",        email),
+                new Claim("Premium",      "true"),
+                new Claim("MaxStorageGb", (maxStorageGb == 0 ? short.MaxValue : maxStorageGb).ToString()),
+                new Claim("Trial",        "false"),
+                new Claim("Issued",       now.ToString("o")),
+                new Claim("Expires",      expires.ToString("o")),
+                new Claim("Refresh",      now.AddYears(100).AddMonths(-1).ToString("o")),
+            };
+
+            var handler = new JwtSecurityTokenHandler();
+            var token = new JwtSecurityToken(
+                issuer:             "bitwarden",
+                audience:           $"user:{userId}",
+                claims:             claims,
+                notBefore:          now,
+                expires:            expires,
+                signingCredentials: creds);
+
+            return handler.WriteToken(token);
+        }
+
+        private static string GenerateOrgToken(X509Certificate2 cert, Guid orgId, Guid installationId, string licenseKey, string billingEmail, string businessName, string name, short maxStorageGb, Type planTypeEnum, DateTime now)
+        {
+            var secKey  = new X509SecurityKey(cert);
+            var creds   = new SigningCredentials(secKey, SecurityAlgorithms.RsaSha256);
+            var expires = now.AddYears(100);
+
+            // Resolve the integer value of EnterpriseAnnually from the runtime enum
+            var planTypeInt = Convert.ToInt32(Enum.Parse(planTypeEnum, "EnterpriseAnnually"));
+
+            var claims = new List<Claim>
+            {
+                new Claim("LicenseType",                          "Organization"),
+                new Claim("LicenseKey",                           licenseKey),
+                new Claim("InstallationId",                       installationId.ToString()),
+                new Claim("Id",                                   orgId.ToString()),
+                new Claim("Name",                                 name),
+                new Claim("BillingEmail",                         billingEmail),
+                new Claim("BusinessName",                         businessName),
+                new Claim("Enabled",                              "true"),
+                new Claim("Plan",                                 "Enterprise (Annually)"),
+                new Claim("PlanType",                             planTypeInt.ToString()),
+                new Claim("Seats",                                int.MaxValue.ToString()),
+                new Claim("MaxCollections",                       short.MaxValue.ToString()),
+                new Claim("MaxStorageGb",                         (maxStorageGb == 0 ? short.MaxValue : maxStorageGb).ToString()),
+                new Claim("SelfHost",                             "true"),
+                new Claim("UsersGetPremium",                      "true"),
+                new Claim("UseGroups",                            "true"),
+                new Claim("UseDirectory",                         "true"),
+                new Claim("UseEvents",                            "true"),
+                new Claim("UseTotp",                              "true"),
+                new Claim("Use2fa",                               "true"),
+                new Claim("UseApi",                               "true"),
+                new Claim("UsePolicies",                          "true"),
+                new Claim("UseSso",                               "true"),
+                new Claim("UseResetPassword",                     "true"),
+                new Claim("UseKeyConnector",                      "true"),
+                new Claim("UseScim",                              "true"),
+                new Claim("UseCustomPermissions",                 "true"),
+                new Claim("UsePasswordManager",                   "true"),
+                new Claim("UseSecretsManager",                    "true"),
+                new Claim("SmSeats",                              int.MaxValue.ToString()),
+                new Claim("SmServiceAccounts",                    int.MaxValue.ToString()),
+                new Claim("UseRiskInsights",                      "true"),
+                new Claim("UseAdminSponsoredFamilies",            "true"),
+                new Claim("UseOrganizationDomains",               "true"),
+                new Claim("UseAutomaticUserConfirmation",         "true"),
+                new Claim("UseDisableSmAdsForUsers",              "true"),
+                new Claim("UsePhishingBlocker",                   "true"),
+                new Claim("UseMyItems",                           "true"),
+                new Claim("LimitCollectionCreationDeletion",      "true"),
+                new Claim("AllowAdminAccessToAllCollectionItems", "true"),
+                new Claim("Trial",                                "false"),
+                new Claim("Issued",                               now.ToString("o")),
+                new Claim("Expires",                              expires.ToString("o")),
+                new Claim("Refresh",                              now.AddYears(100).AddMonths(-1).ToString("o")),
+                new Claim("ExpirationWithoutGracePeriod",         expires.ToString("o")),
+            };
+
+            var handler = new JwtSecurityTokenHandler();
+            var token = new JwtSecurityToken(
+                issuer:             "bitwarden",
+                audience:           $"organization:{orgId}",
+                claims:             claims,
+                notBefore:          now,
+                expires:            expires,
+                signingCredentials: creds);
+
+            return handler.WriteToken(token);
+        }
     }
 }

src/licenseGen/licenseGen.csproj

@@ -2,7 +2,7 @@
 
   <PropertyGroup>
     <OutputType>Exe</OutputType>
-    <TargetFramework>net8.0</TargetFramework>
+    <TargetFramework>net10.0</TargetFramework>
   </PropertyGroup>
 
   <ItemGroup>
@@ -10,6 +10,7 @@
     <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
     <PackageReference Include="SingleFileExtractor.Core" Version="2.3.0" />
     <PackageReference Include="System.Runtime.Loader" Version="4.3.0" />
+    <PackageReference Include="System.IdentityModel.Tokens.Jwt" Version="8.17.0" />
   </ItemGroup>
 
 </Project>

update-bitwarden.sh

@@ -1,4 +1,6 @@
 #!/bin/bash
+set -e
+
 ask () {
   local __resultVar=$1
   local __result="$2"
@@ -9,7 +11,13 @@ ask () {
 }
 
 SCRIPT_BASE="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
-BW_VERSION=$(curl -sL https://go.btwrdn.co/bw-sh-versions | grep '^ *"'coreVersion'":' | awk -F\: '{ print $2 }' | sed -e 's/,$//' -e 's/^"//' -e 's/"$//')
+
+# Check prerequisite libraries and executables
+for cmd in docker curl openssl jq; do
+    command -v "$cmd" >/dev/null 2>&1 || { echo "Error: '$cmd' is required but not installed." >&2; exit 1; }
+done
+
+BW_VERSION=$(curl -fsSL https://raw.githubusercontent.com/bitwarden/self-host/refs/heads/main/version.json | jq -er '.versions.coreVersion')
 
 echo "Starting Bitwarden update, newest server version: $BW_VERSION"
 
@@ -48,11 +56,9 @@ else
 fi
 
 # Check if user wants to rebuild the bitbetter images
-docker images bitbetter/api --format="{{ .Tag }}" | grep -F -- "${BW_VERSION}" > /dev/null
-retval=$?
 REBUILD_BB="n"
 REBUILD_BB_DESCR="[y/N]"
-if [ $retval -ne 0 ]; then
+if ! docker images bitbetter/api --format="{{ .Tag }}" | grep -F -- "${BW_VERSION}" > /dev/null; then
     REBUILD_BB="y"
     REBUILD_BB_DESCR="[Y/n]"
 fi