fix update script failure when image tag is missing

* Update URL with version information

The previous URL is no longer working. Instead of the site redirect, switching directly to the official GitHub repository of Bitwarden to download the latest version information.

* Update update-bitwarden.sh

* Add prerequisite checks and switch JSON parsing to jq

The URL with the version of self-hosted Bitwarden is not working anymore. Now we're querying the official GitHub repository of Bitwarden and using jq to find the current released version. For simplification, we've moved to jq instead of sed/awk combinations and also added prerequisite checks for docker, openssl, and jq to avoid build failures.

* Add prerequisite checks and switch JSON parsing to jq

The URL with the version of self-hosted Bitwarden is not working anymore. Now we're querying the official GitHub repository of Bitwarden and using jq to find the current released version. For simplification, we've moved to jq instead of sed/awk combinations and also added prerequisite checks for docker, openssl, and jq to avoid build failures. The script was also changed to exit on failure (set -e).

* Update build.sh

Remove duplicate OpenSSL check

* Update update-bitwarden.sh

Remove duplicate OpenSSL check

* Apply suggestions from code review

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: captainhook <16797541+captainhook@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

.circleci/config.yml

@@ -13,3 +13,12 @@ jobs:
       - run:
           name: Build script
           command: ./build.sh
+      - run:
+          name: Build licenseGen
+          command: ./src/licenseGen/build.sh
+      - run:
+          name: Test generating user license
+          command: ./src/licenseGen/run.sh ./.keys/cert.pfx user TestName TestEmail@example.com 4a619d4a-522d-4c70-8596-affb5b607c23
+      - run:
+          name: Test generating organization license
+          command: ./src/licenseGen/run.sh ./.keys/cert.pfx org TestName TestEmail@example.com 4a619d4a-522d-4c70-8596-affb5b607c23

.keys/generate-keys.sh

@@ -15,6 +15,6 @@ DIR=`exec 2>/dev/null;(cd -- "$DIR") && cd -- "$DIR"|| cd "$DIR"; unset PWD; /us
 # Generate new keys
 openssl	req -x509 -newkey rsa:4096 -keyout "$DIR/key.pem" -out "$DIR/cert.cert" -days 36500 -subj '/CN=www.mydom.com/O=My Company Name LTD./C=US'  -outform DER -passout pass:test
 openssl x509 -inform DER -in "$DIR/cert.cert" -out "$DIR/cert.pem"
-openssl pkcs12 -export -out "$DIR/cert.pfx" -inkey "$DIR/key.pem" -in "$DIR/cert.pem" -passin pass:test -passout pass:test
+openssl pkcs12 -export -out "$DIR/cert.pfx" -inkey "$DIR/key.pem" -in "$DIR/cert.pem" -passin pass:test -passout pass:test -certpbe AES-256-CBC -keypbe AES-256-CBC -macalg SHA256
 
 ls

README.md

@@ -4,6 +4,8 @@ BitBetter is is a tool to modify Bitwarden's core dll to allow you to generate y
 
 Please see the FAQ below for details on why this software was created.
 
+Looking for a solution to the Lite (formerly unified) version of bitwarden, [go to the Lite branch](../../tree/lite).
+
 _Beware! BitBetter does janky stuff to rewrite the bitwarden core dll and allow the installation of a self signed certificate. Use at your own risk!_
 
 Credit to https://github.com/h44z/BitBetter and https://github.com/jakeswenson/BitBetter
@@ -66,15 +68,27 @@ From the BitBetter directory, simply run:
 
 This will create a new self-signed certificate in the `.keys` directory if one does not already exist and then create a modified version of the official `bitwarden/api` called `bitbetter/api` and a modified version of the `bitwarden/identity` called `bitbetter/identity`.
 
+By default, the build script runs in **fast patch mode**: it pulls the official Bitwarden images from the GitHub Container Registry and patches the license certificate directly inside them — no local compilation required.
+
+To instead **build from source**, set the `BITBETTER_BUILD_FROM_SOURCE` environment variable to `1` before running the script:
+
+```bash
+BITBETTER_BUILD_FROM_SOURCE=1 ./build.sh
+```
+
+In source build mode the script clones the Bitwarden server repository at the matching version tag, replaces the embedded license certificate, and compiles the `api` and `identity` images from scratch. This takes considerably longer but gives you full control over the build.
+
 You may now simply create the file `/path/to/bwdata/docker/docker-compose.override.yml` with the following contents to utilize the modified images.
 
 ```yaml
 services:
   api:
     image: bitbetter/api
+    pull_policy: never
 
   identity:
     image: bitbetter/identity
+    pull_policy: never
 ```
 
 You'll also want to edit the `/path/to/bwdata/scripts/run.sh` file. In the `function restart()` block, comment out the call to `dockerComposePull`.
@@ -89,6 +103,16 @@ You can now start or restart Bitwarden as normal and the modified api will be us
 
 To update Bitwarden, the provided `update-bitwarden.sh` script can be used. It will rebuild the BitBetter images and automatically update Bitwarden afterwards. Docker pull errors can be ignored for api and identity images.
 
+By default, the images are built in **fast patch mode**: the official Bitwarden images are pulled from the GitHub Container Registry and the license certificate are directly patched inside them.
+
+To instead **build from source**, set the `BITBETTER_BUILD_FROM_SOURCE` environment variable to `1` before running the script:
+
+```bash
+BITBETTER_BUILD_FROM_SOURCE=1 ./update-bitwarden.sh
+```
+
+In source build mode the script clones the Bitwarden server repository at the matching version tag, replaces the embedded license certificate, and compiles the `api` and `identity` images from scratch. This takes considerably longer but gives you full control over the build.
+
 You can either run this script without providing any parameters in interactive mode (`./update-bitwarden.sh`) or by setting the parameters as follows, to run the script in non-interactive mode:
 ```bash
 ./update-bitwarden.sh param1 param2 param3

build.sh

@@ -2,26 +2,100 @@
 set -e
 DIR=`dirname "$0"`
 DIR=`exec 2>/dev/null;(cd -- "$DIR") && cd -- "$DIR"|| cd "$DIR"; unset PWD; /usr/bin/pwd || /bin/pwd || pwd`
-BW_VERSION=$(curl -sL https://go.btwrdn.co/bw-sh-versions | grep '^ *"'coreVersion'":' | awk -F\: '{ print $2 }' | sed -e 's/,$//' -e 's/^"//' -e 's/"$//')
+
+# Check prerequisite libraries and executables
+for cmd in docker curl openssl jq; do
+    command -v "$cmd" >/dev/null 2>&1 || { echo "Error: '$cmd' is required but not installed." >&2; exit 1; }
+done
+if [ "${BITBETTER_BUILD_FROM_SOURCE:-0}" = "1" ]; then
+    command -v git >/dev/null 2>&1 || { echo "Error: 'git' is required for BITBETTER_BUILD_FROM_SOURCE=1 but not installed." >&2; exit 1; }
+fi
+BW_VERSION=$(curl -fsSL https://raw.githubusercontent.com/bitwarden/self-host/refs/heads/main/version.json | jq -er '.versions.coreVersion')
 
 echo "Building BitBetter for BitWarden version $BW_VERSION"
 
+# Enable BuildKit for better build experience and to ensure platform args are populated
+export DOCKER_BUILDKIT=1
+export COMPOSE_DOCKER_CLI_BUILD=1
+
+# Determine host architecture to use as default BUILDPLATFORM / TARGETPLATFORM if not supplied.
+# Allow override via environment variables when invoking the script.
+HOST_UNAME_ARCH=$(uname -m 2>/dev/null || echo unknown)
+case "$HOST_UNAME_ARCH" in
+    x86_64|amd64)   DEFAULT_ARCH=amd64 ;;
+    aarch64|arm64)  DEFAULT_ARCH=arm64 ;;
+    armv7l|armv7)   DEFAULT_ARCH=arm/v7 ;;
+    *)              DEFAULT_ARCH=amd64 ;;
+esac
+
+: "${BUILDPLATFORM:=linux/${DEFAULT_ARCH}}"
+: "${TARGETPLATFORM:=linux/${DEFAULT_ARCH}}"
+
+echo "Using BUILDPLATFORM=$BUILDPLATFORM TARGETPLATFORM=$TARGETPLATFORM"
+
 # If there aren't any keys, generate them first.
 [ -e "$DIR/.keys/cert.cert" ] || "$DIR/.keys/generate-keys.sh"
 
-# Prepare Bitwarden repository
-rm -rf $DIR/server
-git clone --branch "v${BW_VERSION}" --depth 1 https://github.com/bitwarden/server.git $DIR/server
-old_thumbprint=$(openssl x509 -fingerprint -noout -in $DIR/server/src/Core/licensing.cer | cut -d= -f2 | tr -d ':')
-new_thumbprint=$(openssl x509 -fingerprint -noout -in $DIR/.keys/cert.cert | cut -d= -f2 | tr -d ':')
-cp $DIR/.keys/cert.cert $DIR/server/src/Core/licensing.cer
-# Optional, has actually no effect
-sed -i -e "s/$old_thumbprint/$new_thumbprint/g" $DIR/server/src/Core/Services/Implementations/LicensingService.cs
-# Enable loose files for API, so Core.dll is accessible
-sed -i -e 's/PublishSingleFile=true/PublishSingleFile=false/g' $DIR/server/src/Api/Dockerfile
+if [ "${BITBETTER_BUILD_FROM_SOURCE:-0}" = "1" ]; then
+	echo "--- Source build mode ---"
 
-docker build --no-cache --label com.bitwarden.product="bitbetter" $DIR/server -f $DIR/server/src/Api/Dockerfile -t bitbetter/api
-docker build --no-cache --label com.bitwarden.product="bitbetter" $DIR/server -f $DIR/server/src/Identity/Dockerfile -t bitbetter/identity
+	# Prepare Bitwarden server repository
+	rm -rf $DIR/server
+	git clone --branch "v${BW_VERSION}" --depth 1 https://github.com/bitwarden/server.git $DIR/server
+
+	# Replace certificate file and thumbprint
+	old_thumbprint=$(openssl x509 -inform DER -fingerprint -noout -in $DIR/server/src/Core/licensing.cer | cut -d= -f2 | tr -d ':')
+	new_thumbprint=$(openssl x509 -inform DER -fingerprint -noout -in $DIR/.keys/cert.cert | cut -d= -f2 | tr -d ':')
+	sed -i -e "s/$old_thumbprint/$new_thumbprint/g" $DIR/server/src/Core/Billing/Services/Implementations/LicensingService.cs
+	cp $DIR/.keys/cert.cert $DIR/server/src/Core/licensing.cer
+
+	docker build \
+		--no-cache \
+		--platform "$TARGETPLATFORM" \
+		--build-arg BUILDPLATFORM="$BUILDPLATFORM" \
+		--build-arg TARGETPLATFORM="$TARGETPLATFORM" \
+		--label com.bitwarden.product="bitbetter" \
+		-f $DIR/server/src/Api/Dockerfile \
+		-t bitbetter/api \
+		$DIR/server
+
+	docker build \
+		--no-cache \
+		--platform "$TARGETPLATFORM" \
+		--build-arg BUILDPLATFORM="$BUILDPLATFORM" \
+		--build-arg TARGETPLATFORM="$TARGETPLATFORM" \
+		--label com.bitwarden.product="bitbetter" \
+		-f $DIR/server/src/Identity/Dockerfile \
+		-t bitbetter/identity \
+		$DIR/server
+else
+	echo "--- Fast patch mode ---"
+
+	mkdir -p "$DIR/src/bitBetter/.keys"
+	cp "$DIR/.keys/cert.cert" "$DIR/src/bitBetter/.keys/cert.cert"
+
+	# Build the patcher tool inside the SDK container
+	docker run --rm \
+		-v "$DIR/src/bitBetter:/bitBetter" \
+		-w /bitBetter \
+		mcr.microsoft.com/dotnet/sdk:10.0 sh build.sh
+
+	docker build \
+		--no-cache \
+		--platform "$TARGETPLATFORM" \
+		--label com.bitwarden.product="bitbetter" \
+		--build-arg BITWARDEN_TAG="ghcr.io/bitwarden/api:$BW_VERSION" \
+		-t bitbetter/api \
+		"$DIR/src/bitBetter"
+
+	docker build \
+		--no-cache \
+		--platform "$TARGETPLATFORM" \
+		--label com.bitwarden.product="bitbetter" \
+		--build-arg BITWARDEN_TAG="ghcr.io/bitwarden/identity:$BW_VERSION" \
+		-t bitbetter/identity \
+		"$DIR/src/bitBetter"
+fi
 
 docker tag bitbetter/api bitbetter/api:latest
 docker tag bitbetter/identity bitbetter/identity:latest
@@ -29,5 +103,5 @@ docker tag bitbetter/api bitbetter/api:$BW_VERSION
 docker tag bitbetter/identity bitbetter/identity:$BW_VERSION
 
 # Remove old instances of the image after a successful build.
-ids=$( docker images bitbetter/* | grep -E -v -- "CREATED|latest|${BW_VERSION}" | awk '{ print $3 }' )
+ids=$( docker image ls --format="{{ .ID }} {{ .Tag }}" 'bitbetter/*' | grep -E -v -- "CREATED|latest|${BW_VERSION}" | awk '{ ids = (ids ? ids FS $1 : $1) } END { print ids }' )
 [ -n "$ids" ] && docker rmi $ids || true

src/bitBetter/Dockerfile

@@ -0,0 +1,13 @@
+ARG BITWARDEN_TAG
+FROM ${BITWARDEN_TAG}
+
+COPY bin/Release/net10.0/publish/* /bitBetter/
+COPY ./.keys/cert.cert /newLicensing.cer
+
+RUN set -e; set -x; \
+    if [ -f /app/Api ]; then EXEC=Api; else EXEC=Identity; fi && \
+    dotnet /bitBetter/bitBetter.dll /newLicensing.cer /app/$EXEC && \
+    rm -f /app/$EXEC && \
+    printf '#!/bin/sh\nexec dotnet /app/%s.dll "$@"\n' "$EXEC" > /app/$EXEC && \
+    chmod +x /app/$EXEC && \
+    rm -rf /bitBetter /newLicensing.cer

src/bitBetter/Program.cs

@@ -0,0 +1,154 @@
+using System;
+using System.IO;
+using System.Linq;
+using System.Security.Cryptography.X509Certificates;
+using System.Text.Json.Nodes;
+using Mono.Cecil;
+using Mono.Cecil.Cil;
+using Mono.Cecil.Rocks;
+using SingleFileExtractor.Core;
+
+namespace BitwardenSelfLicensor
+{
+    class Program
+    {
+        static int Main(string[] args)
+        {
+            string cerFile   = args.Length >= 1 ? args[0] : "/newLicensing.cer";
+            string inputPath = args.Length >= 2 ? args[1] : "/app/Api";
+
+            string coreDllPath;
+            string extractDir = Path.GetDirectoryName(Path.GetFullPath(inputPath));
+
+            if (string.Equals(Path.GetExtension(inputPath), ".dll", StringComparison.OrdinalIgnoreCase))
+            {
+                // Input is already a direct Core.dll path — skip bundle extraction
+                coreDllPath = inputPath;
+            }
+            else
+            {
+                try
+                {
+                    var reader = new ExecutableReader(inputPath);
+                    reader.ExtractToDirectory(extractDir);
+                    Console.WriteLine($"Extracted bundle to {extractDir}");
+                    coreDllPath = Path.Combine(extractDir, "Core.dll");
+
+                    // The extracted runtimeconfig.json is in self-contained format (no "framework" key).
+                    // Running "dotnet App.dll" requires framework-dependent format; without it .NET looks
+                    // for libhostpolicy.so in the app dir (which isn't there) and crashes.
+                    FixRuntimeConfig(extractDir, Path.GetFileNameWithoutExtension(inputPath));
+                }
+                catch (Exception ex)
+                {
+                    Console.Error.WriteLine($"ERROR: Failed to extract single-file bundle '{inputPath}': {ex.Message}");
+                    return 1;
+                }
+            }
+
+            Console.WriteLine($"Patching: {coreDllPath}");
+
+            var certBytes = File.ReadAllBytes(cerFile);
+            var module    = ModuleDefinition.ReadModule(new MemoryStream(File.ReadAllBytes(coreDllPath)));
+
+            // Replace embedded certificate resource
+            var existingRes = module.Resources
+                .OfType<EmbeddedResource>()
+                .FirstOrDefault(r => r.Name == "Bit.Core.licensing.cer");
+
+            if (existingRes == null)
+            {
+                Console.Error.WriteLine("ERROR: Embedded resource 'Bit.Core.licensing.cer' not found in Core.dll");
+                return 1;
+            }
+
+            Console.WriteLine($"Found resource: {existingRes.Name}");
+            module.Resources.Add(new EmbeddedResource("Bit.Core.licensing.cer", existingRes.Attributes, certBytes));
+            module.Resources.Remove(existingRes);
+
+            var existingCert = X509CertificateLoader.LoadCertificate(existingRes.GetResourceData());
+            var newCert      = X509CertificateLoader.LoadCertificate(certBytes);
+            Console.WriteLine($"Old thumbprint: {existingCert.Thumbprint}");
+            Console.WriteLine($"New thumbprint: {newCert.Thumbprint}");
+
+            // Find LicensingService by class name (namespace-agnostic to handle renames)
+            var type = module.Types.FirstOrDefault(t => t.Name == "LicensingService");
+            if (type == null)
+            {
+                Console.Error.WriteLine("ERROR: LicensingService not found in Core.dll");
+                return 1;
+            }
+            Console.WriteLine($"Found: {type.FullName}");
+
+            var ctor     = type.Resolve().GetConstructors().First();
+            var rewriter = ctor.Body.GetILProcessor();
+
+            // Use Contains() to handle the hidden Unicode LRM character (\u200E) that Bitwarden
+            // prepends to the production thumbprint string literal in LicensingService.cs
+            // Replace ALL occurrences since const fields are inlined at compile time and used in
+            // multiple validation checks (both _creationCertificate and _verificationCertificates)
+            var instructionsToReplace = ctor.Body.Instructions
+                .Where(i => i.OpCode == OpCodes.Ldstr)
+                .Where(i => ((string)i.Operand)
+                    .Contains(existingCert.Thumbprint, StringComparison.OrdinalIgnoreCase))
+                .ToList();
+
+            if (instructionsToReplace.Count > 0)
+            {
+                Console.WriteLine($"Found {instructionsToReplace.Count} thumbprint Ldstr instruction(s) to replace");
+                foreach (var inst in instructionsToReplace)
+                {
+                    Console.WriteLine($"  Replacing: '{inst.Operand}'");
+                    rewriter.Replace(inst, Instruction.Create(OpCodes.Ldstr, newCert.Thumbprint));
+                }
+            }
+            else
+            {
+                Console.WriteLine("WARNING: Thumbprint Ldstr not found — cert resource replaced anyway");
+            }
+
+            module.Write(coreDllPath);
+            Console.WriteLine("Done.");
+            return 0;
+        }
+
+        // Converts a self-contained runtimeconfig.json to framework-dependent so the app can be
+        // launched with "dotnet App.dll" using the system-installed ASP.NET Core runtime.
+        static void FixRuntimeConfig(string dir, string appName)
+        {
+            var path = Path.Combine(dir, $"{appName}.runtimeconfig.json");
+            if (!File.Exists(path))
+            {
+                Console.WriteLine($"runtimeconfig not found at {path}, skipping");
+                return;
+            }
+
+            var root = JsonNode.Parse(File.ReadAllText(path))!;
+            var opts = root["runtimeOptions"]!.AsObject();
+
+            // Derive framework name/version from the self-contained includedFrameworks before removing it
+            string fwName    = "Microsoft.AspNetCore.App";
+            string fwVersion = "10.0.0";
+            if (opts["includedFrameworks"] is JsonArray included && included.Count > 0)
+            {
+                var first = included[0]!.AsObject();
+                fwName    = first["name"]?.GetValue<string>()    ?? fwName;
+                fwVersion = first["version"]?.GetValue<string>() ?? fwVersion;
+            }
+
+            // Remove self-contained markers
+            opts.Remove("includedFrameworks");
+
+            // Add framework-dependent reference (LatestPatch allows compatibility across patch releases only)
+            opts["framework"] = new JsonObject
+            {
+                ["name"]    = fwName,
+                ["version"] = fwVersion
+            };
+            opts["rollForward"] = "LatestPatch";
+
+            File.WriteAllText(path, root.ToJsonString(new System.Text.Json.JsonSerializerOptions { WriteIndented = true }));
+            Console.WriteLine($"Fixed runtimeconfig: {path}");
+        }
+    }
+}

src/bitBetter/bitBetter.csproj

@@ -0,0 +1,13 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <OutputType>Exe</OutputType>
+    <TargetFramework>net10.0</TargetFramework>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Mono.Cecil" Version="0.11.2" />
+    <PackageReference Include="SingleFileExtractor.Core" Version="2.3.0" />
+  </ItemGroup>
+
+</Project>

src/bitBetter/build.sh

@@ -0,0 +1,7 @@
+#!/bin/bash
+
+set -e
+set -x
+
+dotnet restore
+dotnet publish -c Release -o bin/Release/net10.0/publish

src/licenseGen/Dockerfile

@@ -1,4 +1,4 @@
-FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
+FROM mcr.microsoft.com/dotnet/sdk:10.0 AS build
 
 WORKDIR /licenseGen
 
@@ -12,6 +12,6 @@ RUN set -e; set -x; \
 
 FROM bitbetter/api
 
-COPY --from=build /licenseGen/bin/Release/net8.0/publish/* /app/
+COPY --from=build /licenseGen/bin/Release/net10.0/publish/* /app/
 
-ENTRYPOINT [ "dotnet", "/app/licenseGen.dll", "--core", "/app/Core.dll", "--cert", "/cert.pfx" ]
+ENTRYPOINT [ "dotnet", "/app/licenseGen.dll", "--core", "/app/Core.dll", "--executable", "/app/Api", "--cert", "/cert.pfx" ]

src/licenseGen/Program.cs

@@ -1,37 +1,43 @@
-using System;
-using System.IO;
-using System.Linq;
-using System.Runtime.Loader;
-using System.Security.Cryptography.X509Certificates;
-using Microsoft.Extensions.CommandLineUtils;
-using Newtonsoft.Json;
-
-namespace bitwardenSelfLicensor
+namespace BitwardenSelfLicensor
 {
-    class Program
+    using Microsoft.Extensions.CommandLineUtils;
+    using Microsoft.IdentityModel.Tokens;
+    using Newtonsoft.Json;
+    using SingleFileExtractor.Core;
+    using System;
+    using System.Collections.Generic;
+    using System.IdentityModel.Tokens.Jwt;
+    using System.IO;
+    using System.Runtime.Loader;
+    using System.Security.Claims;
+    using System.Security.Cryptography.X509Certificates;
+
+    public static class Program
     {
-        static int Main(string[] args)
+        public static int Main(string[] args)
         {
-            var app = new Microsoft.Extensions.CommandLineUtils.CommandLineApplication();
+            var app = new CommandLineApplication();
             var cert = app.Option("--cert", "cert file", CommandOptionType.SingleValue);
             var coreDll = app.Option("--core", "path to core dll", CommandOptionType.SingleValue);
+            var exec = app.Option("--executable", "path to Bitwarden single file executable", CommandOptionType.SingleValue);
 
-            bool certExists()
+            bool ExecExists() => File.Exists(exec.Value());
+            bool CertExists() => File.Exists(cert.Value());
+            bool CoreExists() => File.Exists(coreDll.Value());
+            bool VerifyTopOptions() =>
+                !string.IsNullOrWhiteSpace(cert.Value()) &&
+                (!string.IsNullOrWhiteSpace(coreDll.Value()) || !string.IsNullOrWhiteSpace(exec.Value())) &&
+                CertExists() &&
+                (CoreExists() || ExecExists());
+            string GetExtractedDll()
             {
-                return File.Exists(cert.Value());
-            }
-
-            bool coreExists()
-            {
-                return File.Exists(coreDll.Value());
-            }
-
-            bool verifyTopOptions()
-            {
-                return !string.IsNullOrWhiteSpace(cert.Value()) &&
-                       !string.IsNullOrWhiteSpace(coreDll.Value()) &&
-                       certExists() && coreExists();
+                var coreDllPath = Path.Combine("extract", "Core.dll");
+                var reader = new ExecutableReader(exec.Value());
+                reader.ExtractToDirectory("extract");
+                var fileInfo = new FileInfo(coreDllPath);
+                return fileInfo.FullName;
             }
+            string GetCoreDllPath() => CoreExists() ? coreDll.Value() : GetExtractedDll();
 
             app.Command("interactive", config =>
             {
@@ -43,11 +49,11 @@ namespace bitwardenSelfLicensor
 
                 config.OnExecute(() =>
                 {
-                    if (!verifyTopOptions())
+                    if (!VerifyTopOptions())
                     {
-                        if (!coreExists()) config.Error.WriteLine($"Cant find core dll at: {coreDll.Value()}");
-                        if (!certExists()) config.Error.WriteLine($"Cant find certificate at: {cert.Value()}");
-
+                        if (!ExecExists() && !string.IsNullOrWhiteSpace(exec.Value())) config.Error.WriteLine($"Cant find single file executable at: {exec.Value()}");
+                        if (!CoreExists() && !string.IsNullOrWhiteSpace(coreDll.Value())) config.Error.WriteLine($"Cant find core dll at: {coreDll.Value()}");
+                        if (!CertExists()) config.Error.WriteLine($"Cant find certificate at: {cert.Value()}");
                         config.ShowHelp();
                         return 1;
                     }
@@ -92,7 +98,7 @@ namespace bitwardenSelfLicensor
                                 WriteLineOver("Please enter a business name, default is BitBetter. [Business Name]:");
                                 buff = Console.ReadLine();
                                 if (buff == "")                     businessname = "BitBetter";
-                                else if (checkBusinessName(buff))   businessname = buff;
+                                else if (CheckBusinessName(buff))   businessname = buff;
                             }
                         }
                         else
@@ -105,14 +111,14 @@ namespace bitwardenSelfLicensor
                     {
                         WriteLineOver("Please provide the username this license will be registered to. [username]:");
                         buff = Console.ReadLine();
-                        if ( checkUsername(buff) )   name = buff;
+                        if ( CheckUsername(buff) )   name = buff;
                     }
 
                     while (email == "")
                     {
                         WriteLineOver("Please provide the email address for the user " + name + ". [email]");
                         buff = Console.ReadLine();
-                        if ( checkEmail(buff) )   email = buff;
+                        if ( CheckEmail(buff) )   email = buff;
                     }
 
                     while (storage == 0)
@@ -125,7 +131,7 @@ namespace bitwardenSelfLicensor
                         }
                         else
                         {
-                            if (checkStorage(buff)) storage = short.Parse(buff);
+                            if (CheckStorage(buff)) storage = short.Parse(buff);
                         }
                     }
 
@@ -135,7 +141,7 @@ namespace bitwardenSelfLicensor
                         buff = Console.ReadLine();
                         if ( buff == "" || buff == "y" || buff == "Y" )
                         {
-                            GenerateUserLicense(new X509Certificate2(cert.Value(), "test"), coreDll.Value(), name, email, storage, guid, null);
+                            GenerateUserLicense(X509CertificateLoader.LoadPkcs12FromFile(cert.Value(), "test"), GetCoreDllPath(), name, email, storage, guid, null);
                         }
                         else
                         {
@@ -149,7 +155,7 @@ namespace bitwardenSelfLicensor
                         buff = Console.ReadLine();
                         if ( buff == "" || buff == "y" || buff == "Y" )
                         {
-                            GenerateOrgLicense(new X509Certificate2(cert.Value(), "test"), coreDll.Value(), name, email, storage, installid, businessname, null);
+                            GenerateOrgLicense(X509CertificateLoader.LoadPkcs12FromFile(cert.Value(), "test"), GetCoreDllPath(), name, email, storage, installid, businessname, null);
                         }
                         else
                         {
@@ -173,17 +179,11 @@ namespace bitwardenSelfLicensor
 
                 config.OnExecute(() =>
                 {
-                    if (!verifyTopOptions())
+                    if (!VerifyTopOptions())
                     {
-                        if (!coreExists())
-                        {
-                            config.Error.WriteLine($"Cant find core dll at: {coreDll.Value()}");
-                        }
-                        if (!certExists())
-                        {
-                            config.Error.WriteLine($"Cant find certificate at: {cert.Value()}");
-                        }
-
+                        if (!ExecExists() && !string.IsNullOrWhiteSpace(exec.Value())) config.Error.WriteLine($"Cant find single file executable at: {exec.Value()}");
+                        if (!CoreExists() && !string.IsNullOrWhiteSpace(coreDll.Value())) config.Error.WriteLine($"Cant find core dll at: {coreDll.Value()}");
+                        if (!CertExists()) config.Error.WriteLine($"Cant find certificate at: {cert.Value()}");
                         config.ShowHelp();
                         return 1;
                     }
@@ -214,7 +214,7 @@ namespace bitwardenSelfLicensor
                         storageShort = (short) parsedStorage;
                     }
 
-                    GenerateUserLicense(new X509Certificate2(cert.Value(), "test"), coreDll.Value(), name.Value, email.Value, storageShort, userId, key.Value);
+                    GenerateUserLicense(X509CertificateLoader.LoadPkcs12FromFile(cert.Value(), "test"), GetCoreDllPath(), name.Value, email.Value, storageShort, userId, key.Value);
 
                     return 0;
                 });
@@ -231,17 +231,11 @@ namespace bitwardenSelfLicensor
 
                 config.OnExecute(() =>
                 {
-                    if (!verifyTopOptions())
+                    if (!VerifyTopOptions())
                     {
-                        if (!coreExists())
-                        {
-                            config.Error.WriteLine($"Cant find core dll at: {coreDll.Value()}");
-                        }
-                        if (!certExists())
-                        {
-                            config.Error.WriteLine($"Cant find certificate at: {cert.Value()}");
-                        }
-
+                        if (!ExecExists() && !string.IsNullOrWhiteSpace(exec.Value())) config.Error.WriteLine($"Cant find single file executable at: {exec.Value()}");
+                        if (!CoreExists() && !string.IsNullOrWhiteSpace(coreDll.Value())) config.Error.WriteLine($"Cant find core dll at: {coreDll.Value()}");
+                        if (!CertExists()) config.Error.WriteLine($"Cant find certificate at: {cert.Value()}");
                         config.ShowHelp();
                         return 1;
                     }
@@ -275,7 +269,7 @@ namespace bitwardenSelfLicensor
                         storageShort = (short) parsedStorage;
                     }
 
-                    GenerateOrgLicense(new X509Certificate2(cert.Value(), "test"), coreDll.Value(), name.Value, email.Value, storageShort, installationId, businessName.Value, key.Value);
+                    GenerateOrgLicense(X509CertificateLoader.LoadPkcs12FromFile(cert.Value(), "test"), GetCoreDllPath(), name.Value, email.Value, storageShort, installationId, businessName.Value, key.Value);
 
                     return 0;
                 });
@@ -301,7 +295,7 @@ namespace bitwardenSelfLicensor
         }
 
         // checkUsername Checks that the username is a valid username
-        static bool checkUsername(string s)
+        private static bool CheckUsername(string s)
         {
             if ( string.IsNullOrWhiteSpace(s) ) {
                 WriteLineOver("The username provided doesn't appear to be valid.\n");
@@ -311,7 +305,7 @@ namespace bitwardenSelfLicensor
         }
 
         // checkBusinessName Checks that the Business Name is a valid username
-        static bool checkBusinessName(string s)
+        private static bool CheckBusinessName(string s)
         {
             if ( string.IsNullOrWhiteSpace(s) ) {
                 WriteLineOver("The Business Name provided doesn't appear to be valid.\n");
@@ -321,7 +315,7 @@ namespace bitwardenSelfLicensor
         }
 
         // checkEmail Checks that the email address is a valid email address
-        static bool checkEmail(string s)
+        private static bool CheckEmail(string s)
         {
             if ( string.IsNullOrWhiteSpace(s) ) {
                 WriteLineOver("The email provided doesn't appear to be valid.\n");
@@ -331,7 +325,7 @@ namespace bitwardenSelfLicensor
         }
 
         // checkStorage Checks that the storage is in a valid range
-        static bool checkStorage(string s)
+        private static bool CheckStorage(string s)
         {
             if (string.IsNullOrWhiteSpace(s))
             {
@@ -347,23 +341,20 @@ namespace bitwardenSelfLicensor
         }
 
         // WriteLineOver Writes a new line to console over last line.
-        static void WriteLineOver(string s)
+        private static void WriteLineOver(string s)
         {
             Console.SetCursorPosition(0, Console.CursorTop -1);
             Console.WriteLine(s);
         }
 
         // WriteLine This wrapper is just here so that console writes all look similar.
-        static void WriteLine(string s)
-        {
-            Console.WriteLine(s);
-        }
+        private static void WriteLine(string s) => Console.WriteLine(s);
 
-        static void GenerateUserLicense(X509Certificate2 cert, string corePath, string userName, string email, short storage, Guid userId, string key)
+        private static void GenerateUserLicense(X509Certificate2 cert, string corePath, string userName, string email, short storage, Guid userId, string key)
         {
             var core = AssemblyLoadContext.Default.LoadFromAssemblyPath(corePath);
 
-            var type = core.GetType("Bit.Core.Models.Business.UserLicense");
+            var type = core.GetType("Bit.Core.Billing.Models.Business.UserLicense");
             var licenseTypeEnum = core.GetType("Bit.Core.Enums.LicenseType");
 
             var license = Activator.CreateInstance(type);
@@ -373,30 +364,34 @@ namespace bitwardenSelfLicensor
                 type.GetProperty(name).SetValue(license, value);
             }
 
-            set("LicenseKey", string.IsNullOrWhiteSpace(key) ? Guid.NewGuid().ToString("n") : key);
+            var licenseKey = string.IsNullOrWhiteSpace(key) ? Guid.NewGuid().ToString("n") : key;
+
+            set("LicenseKey", licenseKey);
             set("Id", userId);
             set("Name", userName);
             set("Email", email);
             set("Premium", true);
             set("MaxStorageGb", storage == 0 ? short.MaxValue : storage);
             set("Version", 1);
-            set("Issued", DateTime.UtcNow);
-            set("Refresh", DateTime.UtcNow.AddYears(100).AddMonths(-1));
-            set("Expires", DateTime.UtcNow.AddYears(100));
+            var now = DateTime.UtcNow;
+            set("Issued", now);
+            set("Refresh", now.AddYears(100).AddMonths(-1));
+            set("Expires", now.AddYears(100));
             set("Trial", false);
             set("LicenseType", Enum.Parse(licenseTypeEnum, "User"));
 
+            set("Token", GenerateUserToken(cert, userId, licenseKey, userName, email, storage, now));
             set("Hash", Convert.ToBase64String((byte[])type.GetMethod("ComputeHash").Invoke(license, new object[0])));
             set("Signature", Convert.ToBase64String((byte[])type.GetMethod("Sign").Invoke(license, new object[] { cert })));
 
             Console.WriteLine(JsonConvert.SerializeObject(license, Formatting.Indented));
         }
 
-        static void GenerateOrgLicense(X509Certificate2 cert, string corePath, string userName, string email, short storage, Guid instalId, string businessName, string key)
+        private static void GenerateOrgLicense(X509Certificate2 cert, string corePath, string userName, string email, short storage, Guid instalId, string businessName, string key)
         {
             var core = AssemblyLoadContext.Default.LoadFromAssemblyPath(corePath);
 
-            var type = core.GetType("Bit.Core.Models.Business.OrganizationLicense");
+            var type = core.GetType("Bit.Core.Billing.Organizations.Models.OrganizationLicense");
             var licenseTypeEnum = core.GetType("Bit.Core.Enums.LicenseType");
             var planTypeEnum = core.GetType("Bit.Core.Billing.Enums.PlanType");
 
@@ -407,12 +402,15 @@ namespace bitwardenSelfLicensor
                 type.GetProperty(name).SetValue(license, value);
             }
 
-            set("LicenseKey", string.IsNullOrWhiteSpace(key) ? Guid.NewGuid().ToString("n") : key);
+            var licenseKey = string.IsNullOrWhiteSpace(key) ? Guid.NewGuid().ToString("n") : key;
+            var businessNameFinal = string.IsNullOrWhiteSpace(businessName) ? "BitBetter" : businessName;
+
+            set("LicenseKey", licenseKey);
             set("InstallationId", instalId);
             set("Id", Guid.NewGuid());
             set("Name", userName);
             set("BillingEmail", email);
-            set("BusinessName", string.IsNullOrWhiteSpace(businessName) ? "BitBetter" : businessName);
+            set("BusinessName", businessNameFinal);
             set("Enabled", true);
             set("Plan", "Enterprise (Annually)");
             set("PlanType", Enum.Parse(planTypeEnum, "EnterpriseAnnually"));
@@ -437,19 +435,134 @@ namespace bitwardenSelfLicensor
             set("UseSecretsManager", true);
             set("SmSeats", int.MaxValue);
             set("SmServiceAccounts", int.MaxValue);
-            set("Version", 15); //This is set to 15 to use AllowAdminAccessToAllCollectionItems can be changed to 13 to just use Secrets Manager
-            set("Issued", DateTime.UtcNow);
-            set("Refresh", DateTime.UtcNow.AddYears(100).AddMonths(-1));
-            set("Expires", DateTime.UtcNow.AddYears(100));
+            set("Version", 16);
+            var now = DateTime.UtcNow;
+            set("Issued", now);
+            set("Refresh", now.AddYears(100).AddMonths(-1));
+            set("Expires", now.AddYears(100));
+            set("ExpirationWithoutGracePeriod", now.AddYears(100));
             set("Trial", false);
             set("LicenseType", Enum.Parse(licenseTypeEnum, "Organization"));
-            set("LimitCollectionCreationDeletion", true); //This will be used in the new version of BitWarden but can be applied now
+            set("LimitCollectionCreationDeletion", true);
             set("AllowAdminAccessToAllCollectionItems", true);
+            set("UseRiskInsights", true);
+            set("UseOrganizationDomains", true);
+            set("UseAdminSponsoredFamilies", true);
+            set("UseAutomaticUserConfirmation", true);
+            set("UsePhishingBlocker", true);
+            set("UseDisableSmAdsForUsers", true);
+            set("UseMyItems", true);
 
+            var orgId = (Guid)type.GetProperty("Id").GetValue(license);
+
+            set("Token", GenerateOrgToken(cert, orgId, instalId, licenseKey, email, businessNameFinal, userName, storage, planTypeEnum, now));
             set("Hash", Convert.ToBase64String((byte[])type.GetMethod("ComputeHash").Invoke(license, new object[0])));
             set("Signature", Convert.ToBase64String((byte[])type.GetMethod("Sign").Invoke(license, new object[] { cert })));
 
             Console.WriteLine(JsonConvert.SerializeObject(license, Formatting.Indented));
         }
+
+        private static string GenerateUserToken(X509Certificate2 cert, Guid userId, string licenseKey, string name, string email, short maxStorageGb, DateTime now)
+        {
+            var secKey  = new X509SecurityKey(cert);
+            var creds   = new SigningCredentials(secKey, SecurityAlgorithms.RsaSha256);
+            var expires = now.AddYears(100);
+
+            var claims = new List<Claim>
+            {
+                new Claim("LicenseType",  "User"),
+                new Claim("LicenseKey",   licenseKey),
+                new Claim("Id",           userId.ToString()),
+                new Claim("Name",         name),
+                new Claim("Email",        email),
+                new Claim("Premium",      "true"),
+                new Claim("MaxStorageGb", (maxStorageGb == 0 ? short.MaxValue : maxStorageGb).ToString()),
+                new Claim("Trial",        "false"),
+                new Claim("Issued",       now.ToString("o")),
+                new Claim("Expires",      expires.ToString("o")),
+                new Claim("Refresh",      now.AddYears(100).AddMonths(-1).ToString("o")),
+            };
+
+            var handler = new JwtSecurityTokenHandler();
+            var token = new JwtSecurityToken(
+                issuer:             "bitwarden",
+                audience:           $"user:{userId}",
+                claims:             claims,
+                notBefore:          now,
+                expires:            expires,
+                signingCredentials: creds);
+
+            return handler.WriteToken(token);
+        }
+
+        private static string GenerateOrgToken(X509Certificate2 cert, Guid orgId, Guid installationId, string licenseKey, string billingEmail, string businessName, string name, short maxStorageGb, Type planTypeEnum, DateTime now)
+        {
+            var secKey  = new X509SecurityKey(cert);
+            var creds   = new SigningCredentials(secKey, SecurityAlgorithms.RsaSha256);
+            var expires = now.AddYears(100);
+
+            // Resolve the integer value of EnterpriseAnnually from the runtime enum
+            var planTypeInt = Convert.ToInt32(Enum.Parse(planTypeEnum, "EnterpriseAnnually"));
+
+            var claims = new List<Claim>
+            {
+                new Claim("LicenseType",                          "Organization"),
+                new Claim("LicenseKey",                           licenseKey),
+                new Claim("InstallationId",                       installationId.ToString()),
+                new Claim("Id",                                   orgId.ToString()),
+                new Claim("Name",                                 name),
+                new Claim("BillingEmail",                         billingEmail),
+                new Claim("BusinessName",                         businessName),
+                new Claim("Enabled",                              "true"),
+                new Claim("Plan",                                 "Enterprise (Annually)"),
+                new Claim("PlanType",                             planTypeInt.ToString()),
+                new Claim("Seats",                                int.MaxValue.ToString()),
+                new Claim("MaxCollections",                       short.MaxValue.ToString()),
+                new Claim("MaxStorageGb",                         (maxStorageGb == 0 ? short.MaxValue : maxStorageGb).ToString()),
+                new Claim("SelfHost",                             "true"),
+                new Claim("UsersGetPremium",                      "true"),
+                new Claim("UseGroups",                            "true"),
+                new Claim("UseDirectory",                         "true"),
+                new Claim("UseEvents",                            "true"),
+                new Claim("UseTotp",                              "true"),
+                new Claim("Use2fa",                               "true"),
+                new Claim("UseApi",                               "true"),
+                new Claim("UsePolicies",                          "true"),
+                new Claim("UseSso",                               "true"),
+                new Claim("UseResetPassword",                     "true"),
+                new Claim("UseKeyConnector",                      "true"),
+                new Claim("UseScim",                              "true"),
+                new Claim("UseCustomPermissions",                 "true"),
+                new Claim("UsePasswordManager",                   "true"),
+                new Claim("UseSecretsManager",                    "true"),
+                new Claim("SmSeats",                              int.MaxValue.ToString()),
+                new Claim("SmServiceAccounts",                    int.MaxValue.ToString()),
+                new Claim("UseRiskInsights",                      "true"),
+                new Claim("UseAdminSponsoredFamilies",            "true"),
+                new Claim("UseOrganizationDomains",               "true"),
+                new Claim("UseAutomaticUserConfirmation",         "true"),
+                new Claim("UseDisableSmAdsForUsers",              "true"),
+                new Claim("UsePhishingBlocker",                   "true"),
+                new Claim("UseMyItems",                           "true"),
+                new Claim("LimitCollectionCreationDeletion",      "true"),
+                new Claim("AllowAdminAccessToAllCollectionItems", "true"),
+                new Claim("Trial",                                "false"),
+                new Claim("Issued",                               now.ToString("o")),
+                new Claim("Expires",                              expires.ToString("o")),
+                new Claim("Refresh",                              now.AddYears(100).AddMonths(-1).ToString("o")),
+                new Claim("ExpirationWithoutGracePeriod",         expires.ToString("o")),
+            };
+
+            var handler = new JwtSecurityTokenHandler();
+            var token = new JwtSecurityToken(
+                issuer:             "bitwarden",
+                audience:           $"organization:{orgId}",
+                claims:             claims,
+                notBefore:          now,
+                expires:            expires,
+                signingCredentials: creds);
+
+            return handler.WriteToken(token);
+        }
     }
 }

src/licenseGen/licenseGen.csproj

@@ -1,14 +1,16 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
     <OutputType>Exe</OutputType>
-    <TargetFramework>net8.0</TargetFramework>
+    <TargetFramework>net10.0</TargetFramework>
   </PropertyGroup>
 
   <ItemGroup>
     <PackageReference Include="Microsoft.Extensions.CommandLineUtils" Version="1.1.1" />
-    <PackageReference Include="Newtonsoft.Json" Version="13.0.1" />
+    <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
+    <PackageReference Include="SingleFileExtractor.Core" Version="2.3.0" />
     <PackageReference Include="System.Runtime.Loader" Version="4.3.0" />
+    <PackageReference Include="System.IdentityModel.Tokens.Jwt" Version="8.17.0" />
   </ItemGroup>
 
 </Project>

update-bitwarden.sh

@@ -1,4 +1,6 @@
 #!/bin/bash
+set -e
+
 ask () {
   local __resultVar=$1
   local __result="$2"
@@ -9,7 +11,13 @@ ask () {
 }
 
 SCRIPT_BASE="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
-BW_VERSION=$(curl -sL https://go.btwrdn.co/bw-sh-versions | grep '^ *"'coreVersion'":' | awk -F\: '{ print $2 }' | sed -e 's/,$//' -e 's/^"//' -e 's/"$//')
+
+# Check prerequisite libraries and executables
+for cmd in docker curl openssl jq; do
+    command -v "$cmd" >/dev/null 2>&1 || { echo "Error: '$cmd' is required but not installed." >&2; exit 1; }
+done
+
+BW_VERSION=$(curl -fsSL https://raw.githubusercontent.com/bitwarden/self-host/refs/heads/main/version.json | jq -er '.versions.coreVersion')
 
 echo "Starting Bitwarden update, newest server version: $BW_VERSION"
 
@@ -48,11 +56,9 @@ else
 fi
 
 # Check if user wants to rebuild the bitbetter images
-docker images bitbetter/api --format="{{ .Tag }}" | grep -F -- "${BW_VERSION}" > /dev/null
-retval=$?
 REBUILD_BB="n"
 REBUILD_BB_DESCR="[y/N]"
-if [ $retval -ne 0 ]; then
+if ! docker images bitbetter/api --format="{{ .Tag }}" | grep -F -- "${BW_VERSION}" > /dev/null; then
     REBUILD_BB="y"
     REBUILD_BB_DESCR="[Y/n]"
 fi