pyconcrete

In the Django example, pyconcrete is used to protect the application source code within a Docker container.

Key Integration Details:

• Encryption: The Django source code located in /code/ is encrypted within the Docker image.
• Entrypoint Requirements: To ensure the encrypted files are handled correctly, specific entrypoint files must remain as .py files and must include import pyconcrete at the very beginning of the file:
  • /code/pye_web/wsgi.py
  • /code/manage.py
• Production Warning: The example uses Docker image layers to cache the source code. For production deployments, you must ensure that the Docker build process does not inadvertently cache the original, unencrypted .py source code in any image layers.

# Example of required entrypoint modification
import pyconcrete
# ... rest of the file

pyconcrete protects Python workflows by encrypting .py files into .pye files (which contain encrypted .pyc content).

Workflow:

1. Encryption: You use pyecli to compile .py files into .pye files using a passphrase-derived secret key.
2. Execution: Since .pye files cannot be run by the standard Python interpreter, you must use the pyconcrete executable to launch them. pyconcrete decrypts the file in memory and then hands control to the Python interpreter.
3. Import Hooking: pyconcrete hooks the Python import mechanism. When a script calls import MODULE, the hook searches for MODULE.pye, decrypts it via the _pyconcrete.pyd binary extension, and executes the decrypted data.
4. Binary Security: The secret key is embedded within the _pyconcrete.pyd binary (similar to a DLL or SO), making it difficult to extract via simple HEX inspection.

You can install pyconcrete in mode=lib to use it within a standard Python script. Note: This mode is less secure than the full exe mode.

Setup:

1. Install with mode=lib: pip install pyconcrete --config-settings=setup-args="-Dmode=lib" ...
2. Import pyconcrete in your entry point script.

Project Layout Example:

project_root/
├── main.py           # Standard Python script that imports pyconcrete
├── pyconcrete/       # The pyconcrete library files
└── src/
    └── module.pye    # Encrypted modules

# main.py
import pyconcrete
import my_encrypted_module  # This will be loaded from src/*.pye

To see a working demonstration of pyconcrete integrated with Django, you can use the provided Docker setup. This will build and run a containerized environment containing an encrypted Django application.

Prerequisites:

• Docker installed and running.

Steps:

1. Execute the provided shell script to build and start the environment:

   ./bin/run-example-django.sh

2. Once running, access the application at http://127.0.0.1:5151.
3. Access the Django admin interface at http://127.0.0.1:5151/admin using the following credentials:
   • Username: admin
   • Password: 1234

$ ./bin/run-example-django.sh

Once your files are encrypted (e.g., main.pye and src/*.pye), you cannot use the standard python command. You must use the pyconcrete executable.

Project Layout Example:

project_root/
├── pyconcrete (executable)
├── main.pye
└── src/
    └── module.pye

Execution:

$ pyconcrete main.pye

The PyeZipImporter is a PEP-451 compliant finder and loader that allows you to treat encrypted .pye files inside a ZIP archive as standard Python modules.

Key behaviors:

• Hybrid Support: It uses a fallback mechanism (zipimport.zipimporter) to allow standard, unencrypted .py or .pyc files to coexist within the same ZIP archive.
• Thread-Safe Caching: It maintains a directory cache of ZIP contents to speed up lookups and uses a lock to ensure thread safety during cache population.
• Encrypted Execution: When a module is requested, it locates the .pye file inside the ZIP, decrypts it in memory, and executes the resulting bytecode within the module's dictionary.

# Conceptual usage
import pyconcrete
pyconcrete.install()

# If 'my_app.pyz' contains 'secret.pye'
import my_app.secret

When installing via pip, you can pass several configuration arguments to the Meson build backend using the --config-settings=setup-args="-D<arg>=<value>" syntax:

OpenAES is a portable C library. To compile it, you must compile the source files in ./src and add ./inc to your include paths.

If OAES_HAVE_ISAAC is defined (which is the default), you must also link the source files in ./src/isaac and add ./src/isaac to your include paths.

Build options can be modified by editing ./inc/oaes_config.h.

To build the test programs using CMake:

# Linux
cmake .
make

# Windows (Visual Studio command line)
cmake . -G "NMake Makefiles"
nmake

OpenAES provides both a library interface and a command-line application:

• Library Usage: For programmatic integration, refer to the header file ./inc/oaes_lib.h for the oaes_lib API definitions.
• CLI Usage: The oaes command-line application can be accessed via the terminal. Use the --help flag to view the manual and available options.
• Windows Integration: The oaes_setup Windows installer allows you to interact with files via the Windows shell by right-clicking a file in Windows Explorer and selecting an OpenAES menu subcommand.