ms-python-utils 1.0.1__cp311-cp311-macosx_11_0_arm64.whl

ms_python_utils/__init__.py

@@ -0,0 +1,260 @@
+# -*- coding: utf-8 -*-
+"""
+ms_python_utils - Universal Encrypted Payload Loader
+
+Provides transparent loading of AES-256-GCM encrypted Python modules via import hook.
+Odoo-compatible version: does NOT auto-install on import.
+
+Usage:
+    import ms_python_utils
+    ms_python_utils.bootstrap()
+
+    # 密钥通过 key 文件交付（原生层直接读取，不经过 Python、不出现在代码里）：
+    # 把 ms_python_utils.key 放在加密模块目录内 —— 与 .ylp 同目录，
+    # 即引导 __init__.py 所在的当前目录，import 加密模块时自动发现。
+    # 也可放上级目录（addons 根，一个 key 管全部模块），或用环境变量
+    # MSPU_KEY_FILE 指定 key 文件路径。
+
+    # 兼容旧契约：显式传入密钥（原生可用时密钥仍只存 C++ 层）
+    ms_python_utils.YlpLoader.set_master_secret(b"your-secret")
+"""
+
+import importlib
+import sys
+import zlib
+from importlib.machinery import SOURCE_SUFFIXES, FileFinder, SourceFileLoader
+from typing import Any, Dict
+
+__version__ = "1.0.1"
+import ms_python_utils_core  # 原生加密内核：YLP 解密 + 密钥托管（必须在其它导入之前执行）
+
+# ------------------------------------------------------------------
+# C++ API wrappers (with pure-Python fallback)
+# ------------------------------------------------------------------
+
+try:
+    from ms_python_utils._core import (
+        encrypt_payload as _encrypt_payload,
+        decrypt_payload as _decrypt_payload,
+        derive_key as _derive_key,
+        exec_payload as _exec_payload,
+        decrypt_ylp_native as _decrypt_ylp_native,
+        set_master_secret as _set_master_secret_native,
+    )
+except ImportError:
+    _encrypt_payload = None
+    _decrypt_payload = None
+    _derive_key = None
+    _exec_payload = None
+    _decrypt_ylp_native = None
+    _set_master_secret_native = None
+
+
+def _get_fallback():
+    """Lazy import pure-Python fallback."""
+    from .crypto_fallback import encrypt_payload, decrypt_payload, derive_key, exec_payload
+    return encrypt_payload, decrypt_payload, derive_key, exec_payload
+
+
+def encrypt_payload(plaintext: bytes, key: bytes, nonce: bytes) -> bytes:
+    """Encrypt plaintext with AES-256-GCM."""
+    if _encrypt_payload is not None:
+        return _encrypt_payload(plaintext, key, nonce)
+    ep, _, _, _ = _get_fallback()
+    return ep(plaintext, key, nonce)
+
+
+def decrypt_payload(ciphertext: bytes, key: bytes, nonce: bytes) -> bytes:
+    """Decrypt an AES-256-GCM payload."""
+    if _decrypt_payload is not None:
+        return _decrypt_payload(ciphertext, key, nonce)
+    _, dp, _, _ = _get_fallback()
+    return dp(ciphertext, key, nonce)
+
+
+def derive_key(master_secret: bytes, module_name: str, salt: bytes) -> bytes:
+    """Derive a per-module key via PBKDF2-HMAC-SHA256."""
+    if _derive_key is not None:
+        return _derive_key(master_secret, module_name, salt)
+    _, _, dk, _ = _get_fallback()
+    return dk(master_secret, module_name, salt)
+
+
+def exec_payload(source: str, globals_dict: Dict[str, Any], locals_dict: Dict[str, Any]) -> Any:
+    """Execute Python source code in the given globals/locals."""
+    if _exec_payload is not None:
+        return _exec_payload(source, globals_dict, locals_dict)
+    _, _, _, ep = _get_fallback()
+    return ep(source, globals_dict, locals_dict)
+
+
+# ------------------------------------------------------------------
+# YLP file parsing
+# ------------------------------------------------------------------
+
+YLP_MAGIC = b"YLP\x01"
+YLP_VERSION = 1
+YLP_HEADER_SIZE = 4 + 1 + 32 + 12  # magic + version + salt + nonce
+YLP_PAYLOAD_MAGIC = b"YSRC\x01"  # 载荷魔数：'YSRC' + 1 字节格式版本（与 payload_generator 一致）
+
+
+def parse_ylp(data: bytes) -> tuple:
+    """Parse a .ylp file header and return (salt, nonce, ciphertext).
+
+    Raises:
+        ValueError: If the file is invalid.
+    """
+    if len(data) < YLP_HEADER_SIZE + 16:
+        raise ValueError("YLP file too small")
+
+    magic = data[:4]
+    if magic != YLP_MAGIC:
+        raise ValueError(f"Invalid YLP magic: {magic!r}")
+
+    version = data[4]
+    if version != YLP_VERSION:
+        raise ValueError(f"Unsupported YLP version: {version}")
+
+    salt = data[5:37]
+    nonce = data[37:49]
+    ciphertext = data[49:]
+    return salt, nonce, ciphertext
+
+
+def decrypt_ylp(data: bytes, master_secret: bytes, module_name: str) -> bytes:
+    """Fully decrypt a .ylp payload and return the plaintext payload.
+
+    Args:
+        data: Raw .ylp file contents.
+        master_secret: Master secret for key derivation.
+        module_name: Module name for key derivation context.
+
+    Returns:
+        Decrypted plaintext payload bytes (YLP_PAYLOAD_MAGIC + zlib-compressed source).
+    """
+    salt, nonce, ciphertext = parse_ylp(data)
+    key = derive_key(master_secret, module_name, salt)
+    return decrypt_payload(ciphertext, key, nonce)
+
+
+# ------------------------------------------------------------------
+# Import Hook (inspired by pyconcrete's PyeLoader)
+# ------------------------------------------------------------------
+
+class YlpLoader(SourceFileLoader):
+    """Import loader for .ylp encrypted files.
+
+    When Python tries to import a module and finds a .ylp file, this loader
+    decrypts it, compiles the embedded (zlib-compressed) source with the
+    running interpreter, and returns the code object for execution.
+    """
+
+    _master_secret: bytes = None
+
+    @classmethod
+    def set_master_secret(cls, secret: bytes):
+        """Set the master secret used for decrypting all .ylp files.
+
+        With the native core available the secret is handed to the C++ layer
+        and is not retained on the Python side.
+        """
+        if _set_master_secret_native is not None:
+            _set_master_secret_native(secret)
+            cls._master_secret = None
+        else:
+            cls._master_secret = secret
+
+    def get_code(self, fullname):
+        path = self.get_filename(fullname)
+        if not path.endswith(".ylp"):
+            return super().get_code(fullname)
+
+        data = self.get_data(path)
+        if _decrypt_ylp_native is not None:
+            # 原生路径：master secret 存在 C++ 核心内，不回流 Python；
+            # 传 path 供原生侧 key 文件自动发现（MSPU_KEY_FILE → 同目录 → 上级目录）。
+            try:
+                plaintext = _decrypt_ylp_native(data, fullname, path)
+            except TypeError as sig_error:
+                # 旧版原生核心无 source_path 参数（无 key 文件自动发现）
+                try:
+                    plaintext = _decrypt_ylp_native(data, fullname)
+                except Exception:
+                    raise sig_error
+            except Exception as first_error:
+                # Backward compatibility: payloads generated before the __init__
+                # key-derivation fix used '<pkg>.__init__' as the module name for a
+                # package's __init__.py. Retry with that name; if it also fails,
+                # re-raise the original error.
+                try:
+                    plaintext = _decrypt_ylp_native(data, fullname + '.__init__', path)
+                except Exception:
+                    raise first_error
+        else:
+            if self._master_secret is None:
+                raise RuntimeError(
+                    "ms_python_utils master secret not set. "
+                    "Call ms_python_utils.YlpLoader.set_master_secret(secret) before importing encrypted modules."
+                )
+            try:
+                plaintext = decrypt_ylp(data, self._master_secret, fullname)
+            except Exception as first_error:
+                # Backward compatibility: payloads generated before the __init__
+                # key-derivation fix used '<pkg>.__init__' as the module name for a
+                # package's __init__.py. Retry with that name; if it also fails,
+                # re-raise the original error.
+                try:
+                    plaintext = decrypt_ylp(data, self._master_secret, fullname + '.__init__')
+                except Exception:
+                    raise first_error
+
+        # 载荷为解释器无关格式：YSRC 魔数 + zlib 压缩的 UTF-8 源码，
+        # 用当前解释器现场 compile —— 因此一个 .ylp 任何 Python 3.x 都能导入
+        if not plaintext.startswith(YLP_PAYLOAD_MAGIC):
+            raise ValueError(f"Unsupported YLP payload format in encrypted module {fullname}")
+        source = zlib.decompress(plaintext[len(YLP_PAYLOAD_MAGIC):]).decode("utf-8")
+        return compile(source, path, "exec")
+
+    def get_source(self, fullname):
+        path = self.get_filename(fullname)
+        if path.endswith(".ylp"):
+            return None
+        return super().get_source(fullname)
+
+
+# ------------------------------------------------------------------
+# Install hook into sys.path_hooks
+# ------------------------------------------------------------------
+
+_bootstrapped = False
+
+
+def bootstrap():
+    """Bootstrap ms_python_utils: install the YlpLoader into Python's import machinery.
+
+    This makes .ylp files importable alongside .py files.
+    Call this before importing encrypted modules. The master secret comes
+    from native key-file auto-discovery (ms_python_utils.key next to the
+    module or in its parent directory, or the MSPU_KEY_FILE env var), or
+    from a legacy explicit set_master_secret call.
+
+    Safe to call multiple times — only bootstraps once.
+    """
+    global _bootstrapped
+    if _bootstrapped:
+        return
+
+    from importlib._bootstrap_external import _get_supported_file_loaders
+
+    # Register .ylp as a source suffix so inspect.getmodulename recognises it
+    if ".ylp" not in SOURCE_SUFFIXES:
+        SOURCE_SUFFIXES.append(".ylp")
+
+    loader_details = [(YlpLoader, [".ylp"])] + _get_supported_file_loaders()
+
+    sys.path_importer_cache.clear()
+    sys.path_hooks.insert(0, FileFinder.path_hook(*loader_details))
+    # Drop directory-listing caches too: a .ylp written after a previous
+    # finder pass would otherwise stay invisible on the same sys.path entry.
+    importlib.invalidate_caches()
+    _bootstrapped = True

ms_python_utils-1.0.1.dist-info/METADATA

@@ -0,0 +1,11 @@
+Metadata-Version: 2.4
+Name: ms_python_utils
+Version: 1.0.1
+Summary: Universal YLP encrypted payload loader (C++ protected)
+Author: YLHC Technology, co., ltd.
+Author-email: ylhc@gmail.com
+Requires-Python: >=3.10
+Dynamic: author
+Dynamic: author-email
+Dynamic: requires-python
+Dynamic: summary

ms_python_utils-1.0.1.dist-info/RECORD

@@ -0,0 +1,6 @@
+ms_python_utils_core.cpython-311-darwin.so,sha256=9xSvSYrXbv8cuuki1SwY3rLLrkDyjHw1YkWEPCVNh20,254008
+ms_python_utils/__init__.py,sha256=xmsbUYwZHd3eTmU68YJZvJD_jZPADD59w6KcPyAr3XU,10160
+ms_python_utils-1.0.1.dist-info/RECORD,,
+ms_python_utils-1.0.1.dist-info/WHEEL,sha256=wdaoK8uQV7re3GGdks5HutT8_E2ub-nE_Mj1xJPmf6w,136
+ms_python_utils-1.0.1.dist-info/top_level.txt,sha256=YDf0lufiRjwwG9fllpxG4ezlD5YMUsAJbxHGElwpcSQ,37
+ms_python_utils-1.0.1.dist-info/METADATA,sha256=5lcnppqXBLPbBfeXv9UUt_0lavWO4VIXwAOLGsf2Qb4,291

ms_python_utils-1.0.1.dist-info/WHEEL

@@ -0,0 +1,6 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.0.0)
+Root-Is-Purelib: false
+Tag: cp311-cp311-macosx_11_0_arm64
+Generator: delocate 0.13.0
+

ms_python_utils-1.0.1.dist-info/top_level.txt

@@ -0,0 +1,2 @@
+ms_python_utils
+ms_python_utils_core