bexar 0.1.0__tar.gz

bexar-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 BEXAR contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

bexar-0.1.0/PKG-INFO

@@ -0,0 +1,167 @@
+Metadata-Version: 2.4
+Name: bexar
+Version: 0.1.0
+Summary: An independent Python source protection and compilation toolkit.
+Author: BEXAR contributors
+License: MIT License
+        
+        Copyright (c) 2026 BEXAR contributors
+        
+        Permission is hereby granted, free of charge, to any person obtaining a copy
+        of this software and associated documentation files (the "Software"), to deal
+        in the Software without restriction, including without limitation the rights
+        to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+        copies of the Software, and to permit persons to whom the Software is
+        furnished to do so, subject to the following conditions:
+        
+        The above copyright notice and this permission notice shall be included in all
+        copies or substantial portions of the Software.
+        
+        THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+        IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+        FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+        AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+        LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+        OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+        SOFTWARE.
+        
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Software Development :: Build Tools
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# BEXAR
+
+BEXAR is an independent Python source protection and compilation toolkit. It is
+designed to make casual source inspection harder through documented,
+semantics-conscious transformations; it does not promise perfect secrecy.
+Obfuscation, compilation, packaging, and encryption are different techniques.
+
+## Status
+
+Version `0.1.0` provides an initial source-protection engine, static Python
+source inspection, non-executing source verification, bounded static
+project-import analysis, SHA-256 file integrity manifests, and a reproducible
+`.pyz` packaging workflow.
+
+`bexar -p FILE.py` applies the strongest **implemented** protection profile and
+writes one protected `.py` file (default `FILE_bexar.py`). Today that means:
+
+- **scope-aware identifier renaming** — locals, closure cells, comprehension
+  targets and unambiguous import aliases are renamed to opaque generated names
+  (built only from `I` and `l`, so they read as noise), while parameters,
+  module-level names and class attributes are left intact;
+- **string and bytes literal protection** — eligible literals are replaced by
+  calls to a generated decoder that rebuilds them from a masked payload, so
+  URLs, SQL, tokens and messages no longer appear as plain text. When the four
+  section names are free the payload pool is carried by the `BEXAR-PROTECTED`
+  data header (`magic`, `love`, `god`, `destiny` plus descriptive metadata) and
+  each literal becomes a lookup into that pool;
+- **numeric constant protection** — eligible integer and float literals are
+  replaced by equivalent arithmetic that the interpreter folds back to the same
+  value, so ports, timeouts and protocol constants are no longer readable as
+  literals.
+
+The generated part of a protected file contains no readable keywords, no
+imports and no builtin names. The decoder is a single lambda assignment, every
+name it needs (`__import__`, `base64`, `b85decode`, `zlib`, `decompress`,
+`len`, `ValueError`, `enumerate`, `join`, `zip_longest`, `itertools`, ...) is
+carried as a masked `%c` literal rather than as an identifier, builtins are
+reached through a frame object instead of the `builtins` module, and the
+generated lambda takes unused junk parameters so its signature does not match
+the decoder it actually implements. Every protected module is stamped with the
+`" Bexar made by Bashar "` watermark inside a generated tuple statement, which
+also carries deterministic filler strings that lengthen the output in
+proportion to the encoded payload. The banner comments at the top of a
+protected file are four lines — format name and version, section names, pool
+checksum, watermark — and no longer describe the pool layout, the distribution
+rule or the decoder signature. Only the statements of the *original* program —
+including its own `def`, `class` and `return` — are reproduced verbatim,
+because the verifier requires the protected output to re-parse to the same
+statement and node shape as the input.
+
+Control-flow transformation, runtime integrity and native compilation are
+declared stages that are **not implemented**; every protection report lists
+them explicitly rather than implying coverage. `bexar doctor` prints the same
+stage list, the selected interpreter and any detected optional backend.
+
+Protection is not a security guarantee. Renaming, literal masking and constant
+rewriting make casual source reading harder; they do not make code
+unrecoverable — the generated decoder ships in the output, so anyone who reads
+it can recover every payload, and every constant is recoverable by evaluating
+its expression. The engine refuses to transform any file whose behavior it
+cannot reason about statically. See
+[`docs/commands.md`](docs/commands.md) for the transformation scope, refusal
+rules and measured performance, and the [roadmap](docs/roadmap.md) for the gap
+analysis and engineering plan.
+
+## Install for development
+
+```powershell
+python -m pip install -e .
+bexar --version
+bexar help
+bexar -p main.py
+bexar inspect main.py
+bexar package main.py --output dist
+python .\dist\main.pyz
+```
+
+Requires Python 3.11 or newer. BEXAR currently has no runtime dependencies.
+
+## Safety
+
+BEXAR's static-analysis and protection commands do not execute input programs.
+Behavioral comparison of original and protected code happens only in the test
+suite, against fixtures BEXAR itself controls, in separate subprocesses.
+
+`bexar -p FILE.py` parses the input, rewrites the AST, re-parses and compiles
+the generated module, checks that the output has the same AST node-type
+histogram and binds the same module-level names, and only then writes the result
+atomically. If any check fails, nothing is written and the run exits non-zero.
+The input file is never overwritten unless `--in-place` is given explicitly.
+
+`bexar inspect` reads source with Python's encoding-cookie detection, rejects
+files above 64 MiB by default, and reports syntax errors without executing the
+file. The limit can be adjusted with `--max-bytes`.
+
+`bexar verify FILE` additionally checks Python compile-time constraints by
+building and discarding a code object. It never evaluates that object or runs
+the inspected file. This is a source-validity check, not a protection or
+generated-output integrity guarantee.
+
+`bexar analyze DIRECTORY` scans Python source statically. It reports project,
+standard-library, external-or-unresolved, and dynamic import references. It
+does not install dependencies, import project modules, or prove that a project
+can be bundled into a single file.
+
+`bexar integrity create FILE` creates a deterministic `.bexar.json` sidecar;
+`bexar integrity verify FILE` checks the file against it. A hash manifest is
+not signed, so it only detects tampering when the manifest itself comes from a
+trusted source.
+
+`bexar package ENTRY.py --output DIRECTORY` creates one `.pyz` ZIP application
+containing the entry point and statically reachable local Python modules.
+Detected external or unresolved imports and dynamic imports are reported.
+Native extensions and non-Python resources are not bundled or scanned, and the
+report therefore does not claim the result is self-contained. Optional
+`--signature SIGNATURE --public-key KEY` checks an OpenSSL SHA-256 detached
+signature over the completed `.pyz` archive before publishing it. The public
+key must be trusted independently; BEXAR does not generate keys or signatures.
+See
+[`docs/commands.md`](docs/commands.md) for limits and examples.
+
+## License
+
+MIT; see [LICENSE](LICENSE).

bexar-0.1.0/README.md

@@ -0,0 +1,124 @@
+# BEXAR
+
+BEXAR is an independent Python source protection and compilation toolkit. It is
+designed to make casual source inspection harder through documented,
+semantics-conscious transformations; it does not promise perfect secrecy.
+Obfuscation, compilation, packaging, and encryption are different techniques.
+
+## Status
+
+Version `0.1.0` provides an initial source-protection engine, static Python
+source inspection, non-executing source verification, bounded static
+project-import analysis, SHA-256 file integrity manifests, and a reproducible
+`.pyz` packaging workflow.
+
+`bexar -p FILE.py` applies the strongest **implemented** protection profile and
+writes one protected `.py` file (default `FILE_bexar.py`). Today that means:
+
+- **scope-aware identifier renaming** — locals, closure cells, comprehension
+  targets and unambiguous import aliases are renamed to opaque generated names
+  (built only from `I` and `l`, so they read as noise), while parameters,
+  module-level names and class attributes are left intact;
+- **string and bytes literal protection** — eligible literals are replaced by
+  calls to a generated decoder that rebuilds them from a masked payload, so
+  URLs, SQL, tokens and messages no longer appear as plain text. When the four
+  section names are free the payload pool is carried by the `BEXAR-PROTECTED`
+  data header (`magic`, `love`, `god`, `destiny` plus descriptive metadata) and
+  each literal becomes a lookup into that pool;
+- **numeric constant protection** — eligible integer and float literals are
+  replaced by equivalent arithmetic that the interpreter folds back to the same
+  value, so ports, timeouts and protocol constants are no longer readable as
+  literals.
+
+The generated part of a protected file contains no readable keywords, no
+imports and no builtin names. The decoder is a single lambda assignment, every
+name it needs (`__import__`, `base64`, `b85decode`, `zlib`, `decompress`,
+`len`, `ValueError`, `enumerate`, `join`, `zip_longest`, `itertools`, ...) is
+carried as a masked `%c` literal rather than as an identifier, builtins are
+reached through a frame object instead of the `builtins` module, and the
+generated lambda takes unused junk parameters so its signature does not match
+the decoder it actually implements. Every protected module is stamped with the
+`" Bexar made by Bashar "` watermark inside a generated tuple statement, which
+also carries deterministic filler strings that lengthen the output in
+proportion to the encoded payload. The banner comments at the top of a
+protected file are four lines — format name and version, section names, pool
+checksum, watermark — and no longer describe the pool layout, the distribution
+rule or the decoder signature. Only the statements of the *original* program —
+including its own `def`, `class` and `return` — are reproduced verbatim,
+because the verifier requires the protected output to re-parse to the same
+statement and node shape as the input.
+
+Control-flow transformation, runtime integrity and native compilation are
+declared stages that are **not implemented**; every protection report lists
+them explicitly rather than implying coverage. `bexar doctor` prints the same
+stage list, the selected interpreter and any detected optional backend.
+
+Protection is not a security guarantee. Renaming, literal masking and constant
+rewriting make casual source reading harder; they do not make code
+unrecoverable — the generated decoder ships in the output, so anyone who reads
+it can recover every payload, and every constant is recoverable by evaluating
+its expression. The engine refuses to transform any file whose behavior it
+cannot reason about statically. See
+[`docs/commands.md`](docs/commands.md) for the transformation scope, refusal
+rules and measured performance, and the [roadmap](docs/roadmap.md) for the gap
+analysis and engineering plan.
+
+## Install for development
+
+```powershell
+python -m pip install -e .
+bexar --version
+bexar help
+bexar -p main.py
+bexar inspect main.py
+bexar package main.py --output dist
+python .\dist\main.pyz
+```
+
+Requires Python 3.11 or newer. BEXAR currently has no runtime dependencies.
+
+## Safety
+
+BEXAR's static-analysis and protection commands do not execute input programs.
+Behavioral comparison of original and protected code happens only in the test
+suite, against fixtures BEXAR itself controls, in separate subprocesses.
+
+`bexar -p FILE.py` parses the input, rewrites the AST, re-parses and compiles
+the generated module, checks that the output has the same AST node-type
+histogram and binds the same module-level names, and only then writes the result
+atomically. If any check fails, nothing is written and the run exits non-zero.
+The input file is never overwritten unless `--in-place` is given explicitly.
+
+`bexar inspect` reads source with Python's encoding-cookie detection, rejects
+files above 64 MiB by default, and reports syntax errors without executing the
+file. The limit can be adjusted with `--max-bytes`.
+
+`bexar verify FILE` additionally checks Python compile-time constraints by
+building and discarding a code object. It never evaluates that object or runs
+the inspected file. This is a source-validity check, not a protection or
+generated-output integrity guarantee.
+
+`bexar analyze DIRECTORY` scans Python source statically. It reports project,
+standard-library, external-or-unresolved, and dynamic import references. It
+does not install dependencies, import project modules, or prove that a project
+can be bundled into a single file.
+
+`bexar integrity create FILE` creates a deterministic `.bexar.json` sidecar;
+`bexar integrity verify FILE` checks the file against it. A hash manifest is
+not signed, so it only detects tampering when the manifest itself comes from a
+trusted source.
+
+`bexar package ENTRY.py --output DIRECTORY` creates one `.pyz` ZIP application
+containing the entry point and statically reachable local Python modules.
+Detected external or unresolved imports and dynamic imports are reported.
+Native extensions and non-Python resources are not bundled or scanned, and the
+report therefore does not claim the result is self-contained. Optional
+`--signature SIGNATURE --public-key KEY` checks an OpenSSL SHA-256 detached
+signature over the completed `.pyz` archive before publishing it. The public
+key must be trusted independently; BEXAR does not generate keys or signatures.
+See
+[`docs/commands.md`](docs/commands.md) for limits and examples.
+
+## License
+
+MIT; see [LICENSE](LICENSE).

bexar-0.1.0/pyproject.toml

@@ -0,0 +1,34 @@
+[build-system]
+requires = ["setuptools>=68"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "bexar"
+version = "0.1.0"
+description = "An independent Python source protection and compilation toolkit."
+readme = "README.md"
+requires-python = ">=3.11"
+license = { file = "LICENSE" }
+authors = [{ name = "BEXAR contributors" }]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Environment :: Console",
+    "Intended Audience :: Developers",
+    "License :: OSI Approved :: MIT License",
+    "Operating System :: OS Independent",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
+    "Topic :: Software Development :: Build Tools",
+]
+
+[project.scripts]
+bexar = "bexar.cli:main"
+
+[tool.setuptools]
+package-dir = { "" = "src" }
+
+[tool.setuptools.packages.find]
+where = ["src"]

bexar-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

bexar-0.1.0/src/bexar/__init__.py

@@ -0,0 +1,3 @@
+"""BEXAR Python source protection and compilation toolkit."""
+
+__version__ = "0.1.0"

bexar-0.1.0/src/bexar/__main__.py

@@ -0,0 +1,6 @@
+"""Run BEXAR as a module."""
+
+from bexar.cli import main
+
+if __name__ == "__main__":
+    raise SystemExit(main())

bexar-0.1.0/src/bexar/analysis/__init__.py

@@ -0,0 +1 @@
+"""Static analysis helpers for Python source code."""