pyencode-protector 0.3.0__py3-none-any.whl

pyencode/opaque.py

@@ -0,0 +1,574 @@
+"""Opaque PYE2 artifacts and encrypted protected-module indexes.
+
+This module contains the format-independent core used by a future builder and
+runtime.  PYE2 deliberately stores no semantic header on disk: module names,
+package flags, Python compatibility metadata, and artifact tokens are supplied
+as authenticated context after the encrypted module index has been opened.
+
+The wire format for one artifact is exactly::
+
+    b"PYE2" || nonce[12] || aes_gcm_ciphertext_and_tag
+
+All key derivations are domain-separated HKDF-SHA256 operations.  Callers are
+expected to pass the support-bound root key produced by
+``derive_bound_master_key`` when encrypting an index, then derive a module root
+from that encrypted index before packing artifacts.
+
+The protocol derivations are::
+
+    K_index = HKDF(K_support, salt=build_id,
+                   info=b"pyencode-module-index-v1\\0")
+    C_index = SHA256(b"pyencode-module-index-commitment-v1\\0"
+                     + index_aad + nonce + ciphertext)
+    K_modules = HKDF(K_support, salt=build_id,
+                     info=b"pyencode-module-root-v2\\0" + C_index)
+    K_artifact = HKDF(K_modules, salt=build_id,
+                      info=b"pyencode-artifact-v2\\0" + token_bytes
+                           + b"\\0" + module_utf8)
+
+Here ``HKDF`` means HKDF-SHA256 with a 32-byte output.  Index plaintext and all
+associated data use the canonical JSON helpers in this module.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import re
+import zlib
+from dataclasses import dataclass
+from typing import Any, Mapping, TypedDict, cast
+
+from cryptography.hazmat.primitives import hashes
+from cryptography.hazmat.primitives.kdf.hkdf import HKDF
+
+from .crypto import (
+    KEY_SIZE,
+    NONCE_SIZE,
+    TAG_SIZE,
+    BytesLike,
+    decrypt_payload,
+    encrypt_payload,
+)
+from .errors import (
+    ContainerError,
+    CryptoError,
+    InvalidKeyError,
+    ManifestError,
+)
+
+
+MAGIC_PYE2 = b"PYE2"
+OPAQUE_ARTIFACT_FORMAT = 2
+MODULE_INDEX_FORMAT = 1
+TOKEN_SIZE = 16
+INDEX_COMMITMENT_SIZE = 32
+
+INDEX_KEY_INFO = b"pyencode-module-index-v1\0"
+INDEX_COMMITMENT_DOMAIN = b"pyencode-module-index-commitment-v1\0"
+MODULE_ROOT_KEY_INFO = b"pyencode-module-root-v2\0"
+ARTIFACT_KEY_INFO = b"pyencode-artifact-v2\0"
+
+_BUILD_ID_RE = re.compile(r"[0-9a-f]{32}\Z")
+_TOKEN_RE = re.compile(r"[0-9a-f]{32}\Z")
+_PYTHON_TAG_RE = re.compile(r"cp[0-9]{2,}\Z")
+_MAX_MODULE_INDEX_SIZE = 16 * 1024 * 1024
+_MAX_ARTIFACT_PLAINTEXT_SIZE = 256 * 1024 * 1024
+
+
+class ModuleIndexEntry(TypedDict):
+    """One normalized entry in a decrypted module index."""
+
+    artifact: str
+    package: bool
+
+
+class ModuleIndex(TypedDict):
+    """Canonical plaintext schema encrypted into a module index."""
+
+    format: int
+    entry_module: str
+    modules: dict[str, ModuleIndexEntry]
+
+
+@dataclass(frozen=True, slots=True)
+class OpaqueModuleContext:
+    """Authenticated context required to encrypt or open one PYE2 artifact."""
+
+    build_id: str
+    python_tag: str
+    module: str
+    package: bool
+    token: str
+    marshal_version: int
+
+    def __post_init__(self) -> None:
+        _validate_build_id(self.build_id, ContainerError)
+        _validate_python_tag(self.python_tag, ContainerError)
+        _validate_module_name(self.module, ContainerError)
+        _validate_token(self.token, ContainerError)
+        if type(self.package) is not bool:
+            raise ContainerError("opaque module package flag must be a boolean")
+        if type(self.marshal_version) is not int or self.marshal_version < 0:
+            raise ContainerError(
+                "opaque module marshal_version must be a non-negative integer"
+            )
+
+
+@dataclass(frozen=True, slots=True)
+class ParsedOpaqueArtifact:
+    """The structural fields of a still-encrypted PYE2 artifact."""
+
+    nonce: bytes
+    ciphertext: bytes
+
+
+@dataclass(frozen=True, slots=True)
+class EncryptedModuleIndex:
+    """AES-GCM fields stored by a signed outer manifest."""
+
+    nonce: bytes
+    ciphertext: bytes
+
+
+def _as_bytes(value: BytesLike, *, name: str, error: type[Exception]) -> bytes:
+    if not isinstance(value, (bytes, bytearray, memoryview)):
+        raise error(f"{name} must be bytes-like")
+    return bytes(value)
+
+
+def _validate_key(value: BytesLike, name: str = "root_key") -> bytes:
+    key = _as_bytes(value, name=name, error=InvalidKeyError)
+    if len(key) != KEY_SIZE:
+        raise InvalidKeyError(f"{name} must be exactly {KEY_SIZE} bytes")
+    return key
+
+
+def _validate_build_id(value: object, error: type[Exception]) -> str:
+    if not isinstance(value, str) or _BUILD_ID_RE.fullmatch(value) is None:
+        raise error("build_id must be exactly 32 lowercase hexadecimal characters")
+    return value
+
+
+def _build_id_bytes(value: object, error: type[Exception]) -> bytes:
+    return bytes.fromhex(_validate_build_id(value, error))
+
+
+def _validate_python_tag(value: object, error: type[Exception]) -> str:
+    if not isinstance(value, str) or _PYTHON_TAG_RE.fullmatch(value) is None:
+        raise error("python_tag must be a canonical CPython tag such as 'cp314'")
+    return value
+
+
+def _validate_module_name(value: object, error: type[Exception]) -> str:
+    if not isinstance(value, str) or not value:
+        raise error("module name must be a non-empty string")
+    if any(not part or not part.isidentifier() for part in value.split(".")):
+        raise error(f"invalid protected module name {value!r}")
+    return value
+
+
+def _validate_token(value: object, error: type[Exception]) -> str:
+    if not isinstance(value, str) or _TOKEN_RE.fullmatch(value) is None:
+        raise error("artifact token must be exactly 32 lowercase hexadecimal characters")
+    return value
+
+
+def _canonical_json(value: Any, error: type[Exception]) -> bytes:
+    try:
+        return json.dumps(
+            value,
+            sort_keys=True,
+            separators=(",", ":"),
+            ensure_ascii=False,
+            allow_nan=False,
+        ).encode("utf-8")
+    except (TypeError, ValueError, UnicodeEncodeError) as exc:
+        raise error("metadata cannot be encoded as canonical JSON") from exc
+
+
+def _hkdf(root_key: BytesLike, build_id: str, info: bytes, *, name: str) -> bytes:
+    key = _validate_key(root_key, name)
+    salt = _build_id_bytes(build_id, CryptoError)
+    return HKDF(
+        algorithm=hashes.SHA256(),
+        length=KEY_SIZE,
+        salt=salt,
+        info=info,
+    ).derive(key)
+
+
+def module_index_aad(build_id: str, python_tag: str) -> bytes:
+    """Return the canonical public context authenticated with an index."""
+
+    validated_build_id = _validate_build_id(build_id, ManifestError)
+    validated_python_tag = _validate_python_tag(python_tag, ManifestError)
+    return _canonical_json(
+        {
+            "build_id": validated_build_id,
+            "cipher": "aes-256-gcm",
+            "compression": "zlib",
+            "format": MODULE_INDEX_FORMAT,
+            "python_tag": validated_python_tag,
+        },
+        ManifestError,
+    )
+
+
+def derive_module_index_key(support_root_key: BytesLike, build_id: str) -> bytes:
+    """Derive the AES-256 key used only for the encrypted module index."""
+
+    return _hkdf(
+        support_root_key,
+        build_id,
+        INDEX_KEY_INFO,
+        name="support_root_key",
+    )
+
+
+def module_index_commitment(
+    encrypted_index: EncryptedModuleIndex,
+    *,
+    build_id: str,
+    python_tag: str,
+) -> bytes:
+    """Commit to the exact encrypted index and its authenticated context."""
+
+    nonce, ciphertext = _encrypted_index_parts(encrypted_index)
+    aad = module_index_aad(build_id, python_tag)
+    return hashlib.sha256(
+        INDEX_COMMITMENT_DOMAIN + aad + nonce + ciphertext
+    ).digest()
+
+
+def derive_module_root_key(
+    support_root_key: BytesLike,
+    build_id: str,
+    index_commitment: BytesLike,
+) -> bytes:
+    """Derive the root used by all PYE2 artifacts in one encrypted index."""
+
+    commitment = _as_bytes(
+        index_commitment,
+        name="index_commitment",
+        error=CryptoError,
+    )
+    if len(commitment) != INDEX_COMMITMENT_SIZE:
+        raise CryptoError(
+            f"index_commitment must be exactly {INDEX_COMMITMENT_SIZE} bytes"
+        )
+    return _hkdf(
+        support_root_key,
+        build_id,
+        MODULE_ROOT_KEY_INFO + commitment,
+        name="support_root_key",
+    )
+
+
+def opaque_artifact_aad(context: OpaqueModuleContext) -> bytes:
+    """Return semantic artifact metadata authenticated but never stored."""
+
+    if not isinstance(context, OpaqueModuleContext):
+        raise ContainerError("context must be an OpaqueModuleContext")
+    return _canonical_json(
+        {
+            "artifact": context.token,
+            "build_id": context.build_id,
+            "compression": "zlib",
+            "format": OPAQUE_ARTIFACT_FORMAT,
+            "marshal_version": context.marshal_version,
+            "module": context.module,
+            "package": context.package,
+            "python_tag": context.python_tag,
+        },
+        ContainerError,
+    )
+
+
+def derive_opaque_artifact_key(
+    module_root_key: BytesLike,
+    context: OpaqueModuleContext,
+) -> bytes:
+    """Derive one artifact key from its opaque token and protected fullname."""
+
+    if not isinstance(context, OpaqueModuleContext):
+        raise ContainerError("context must be an OpaqueModuleContext")
+    info = (
+        ARTIFACT_KEY_INFO
+        + bytes.fromhex(context.token)
+        + b"\0"
+        + context.module.encode("utf-8")
+    )
+    return _hkdf(
+        module_root_key,
+        context.build_id,
+        info,
+        name="module_root_key",
+    )
+
+
+def pack_opaque_artifact(
+    payload: BytesLike,
+    module_root_key: BytesLike,
+    context: OpaqueModuleContext,
+    *,
+    nonce: BytesLike | None = None,
+    compression_level: int = 9,
+) -> bytes:
+    """Compress and encrypt bytes into the headerless PYE2 wire format."""
+
+    plaintext = _as_bytes(payload, name="payload", error=ContainerError)
+    if len(plaintext) > _MAX_ARTIFACT_PLAINTEXT_SIZE:
+        raise ContainerError("PYE2 artifact payload exceeds the safety limit")
+    if type(compression_level) is not int or not -1 <= compression_level <= 9:
+        raise ContainerError("zlib compression_level must be between -1 and 9")
+    aad = opaque_artifact_aad(context)
+    key = derive_opaque_artifact_key(module_root_key, context)
+    encrypted = encrypt_payload(
+        zlib.compress(plaintext, level=compression_level),
+        key,
+        aad=aad,
+        nonce=nonce,
+    )
+    return MAGIC_PYE2 + encrypted.nonce + encrypted.ciphertext
+
+
+def parse_opaque_artifact(data: BytesLike) -> ParsedOpaqueArtifact:
+    """Validate PYE2 framing without decrypting its ciphertext."""
+
+    artifact = _as_bytes(data, name="data", error=ContainerError)
+    minimum = len(MAGIC_PYE2) + NONCE_SIZE + TAG_SIZE
+    if len(artifact) < minimum:
+        raise ContainerError("PYE2 artifact is truncated")
+    if artifact[: len(MAGIC_PYE2)] != MAGIC_PYE2:
+        raise ContainerError("invalid PYE2 artifact magic")
+    nonce_start = len(MAGIC_PYE2)
+    ciphertext_start = nonce_start + NONCE_SIZE
+    return ParsedOpaqueArtifact(
+        nonce=artifact[nonce_start:ciphertext_start],
+        ciphertext=artifact[ciphertext_start:],
+    )
+
+
+def unpack_opaque_artifact(
+    data: BytesLike,
+    module_root_key: BytesLike,
+    context: OpaqueModuleContext,
+) -> bytes:
+    """Authenticate, decrypt, and decompress one PYE2 artifact."""
+
+    parsed = parse_opaque_artifact(data)
+    aad = opaque_artifact_aad(context)
+    key = derive_opaque_artifact_key(module_root_key, context)
+    compressed = decrypt_payload(
+        parsed.ciphertext,
+        key,
+        parsed.nonce,
+        aad=aad,
+    )
+    return _decompress_strict(
+        compressed,
+        maximum=_MAX_ARTIFACT_PLAINTEXT_SIZE,
+        description="PYE2 artifact payload",
+        error=ContainerError,
+    )
+
+
+def normalize_module_index(value: Mapping[str, Any]) -> ModuleIndex:
+    """Validate and return the exact canonical plaintext index schema."""
+
+    if not isinstance(value, Mapping):
+        raise ManifestError("module index must be a JSON object")
+    required = {"format", "entry_module", "modules"}
+    raw_fields = set(value)
+    if raw_fields != required:
+        missing = sorted(required.difference(raw_fields))
+        extra = sorted(raw_fields.difference(required), key=repr)
+        details: list[str] = []
+        if missing:
+            details.append("missing " + ", ".join(missing))
+        if extra:
+            details.append("unknown " + ", ".join(repr(item) for item in extra))
+        raise ManifestError(
+            "module index has invalid fields (" + "; ".join(details) + ")"
+        )
+    if type(value["format"]) is not int or value["format"] != MODULE_INDEX_FORMAT:
+        raise ManifestError("unsupported module index format")
+    entry_module = _validate_module_name(value["entry_module"], ManifestError)
+    raw_modules = value["modules"]
+    if not isinstance(raw_modules, Mapping) or not raw_modules:
+        raise ManifestError("module index modules must be a non-empty object")
+
+    modules: dict[str, ModuleIndexEntry] = {}
+    tokens: set[str] = set()
+    for raw_name, raw_metadata in raw_modules.items():
+        name = _validate_module_name(raw_name, ManifestError)
+        if name in modules:
+            raise ManifestError(f"duplicate protected module {name!r}")
+        if not isinstance(raw_metadata, Mapping):
+            raise ManifestError(f"metadata for module {name!r} must be an object")
+        if set(raw_metadata) != {"artifact", "package"}:
+            raise ManifestError(
+                f"metadata for module {name!r} must contain only "
+                "'artifact' and 'package'"
+            )
+        token = _validate_token(raw_metadata["artifact"], ManifestError)
+        if token in tokens:
+            raise ManifestError(f"duplicate artifact token {token!r}")
+        package = raw_metadata["package"]
+        if type(package) is not bool:
+            raise ManifestError(f"package flag for module {name!r} must be boolean")
+        tokens.add(token)
+        modules[name] = {"artifact": token, "package": package}
+
+    if entry_module not in modules:
+        raise ManifestError("module index does not contain its configured entry module")
+    return cast(
+        ModuleIndex,
+        {
+            "format": MODULE_INDEX_FORMAT,
+            "entry_module": entry_module,
+            "modules": dict(sorted(modules.items())),
+        },
+    )
+
+
+def canonical_module_index_bytes(value: Mapping[str, Any]) -> bytes:
+    """Return canonical UTF-8 JSON for a strictly normalized module index."""
+
+    return _canonical_json(normalize_module_index(value), ManifestError)
+
+
+def decode_module_index(data: BytesLike) -> ModuleIndex:
+    """Decode only canonical JSON matching the strict module-index schema."""
+
+    raw = _as_bytes(data, name="module index", error=ManifestError)
+    try:
+        decoded = json.loads(raw.decode("utf-8"))
+    except (UnicodeDecodeError, json.JSONDecodeError) as exc:
+        raise ManifestError("module index is not valid UTF-8 JSON") from exc
+    normalized = normalize_module_index(decoded)
+    if _canonical_json(normalized, ManifestError) != raw:
+        raise ManifestError("module index JSON is not canonical")
+    return normalized
+
+
+def encrypt_module_index(
+    value: Mapping[str, Any],
+    support_root_key: BytesLike,
+    *,
+    build_id: str,
+    python_tag: str,
+    nonce: BytesLike | None = None,
+    compression_level: int = 9,
+) -> EncryptedModuleIndex:
+    """Canonicalize, compress, and encrypt a protected-module index."""
+
+    if type(compression_level) is not int or not -1 <= compression_level <= 9:
+        raise ManifestError("zlib compression_level must be between -1 and 9")
+    plaintext = canonical_module_index_bytes(value)
+    if len(plaintext) > _MAX_MODULE_INDEX_SIZE:
+        raise ManifestError("module index exceeds the safety limit")
+    key = derive_module_index_key(support_root_key, build_id)
+    aad = module_index_aad(build_id, python_tag)
+    encrypted = encrypt_payload(
+        zlib.compress(plaintext, level=compression_level),
+        key,
+        aad=aad,
+        nonce=nonce,
+    )
+    return EncryptedModuleIndex(encrypted.nonce, encrypted.ciphertext)
+
+
+def decrypt_module_index(
+    encrypted_index: EncryptedModuleIndex,
+    support_root_key: BytesLike,
+    *,
+    build_id: str,
+    python_tag: str,
+) -> ModuleIndex:
+    """Authenticate, decrypt, and strictly decode a protected-module index."""
+
+    nonce, ciphertext = _encrypted_index_parts(encrypted_index)
+    key = derive_module_index_key(support_root_key, build_id)
+    aad = module_index_aad(build_id, python_tag)
+    compressed = decrypt_payload(ciphertext, key, nonce, aad=aad)
+    plaintext = _decompress_strict(
+        compressed,
+        maximum=_MAX_MODULE_INDEX_SIZE,
+        description="module index",
+        error=ManifestError,
+    )
+    return decode_module_index(plaintext)
+
+
+def _encrypted_index_parts(
+    value: EncryptedModuleIndex,
+) -> tuple[bytes, bytes]:
+    if not isinstance(value, EncryptedModuleIndex):
+        raise ManifestError("encrypted index must be an EncryptedModuleIndex")
+    nonce = _as_bytes(value.nonce, name="module index nonce", error=ManifestError)
+    ciphertext = _as_bytes(
+        value.ciphertext,
+        name="module index ciphertext",
+        error=ManifestError,
+    )
+    if len(nonce) != NONCE_SIZE:
+        raise ManifestError(f"module index nonce must be exactly {NONCE_SIZE} bytes")
+    if len(ciphertext) < TAG_SIZE:
+        raise ManifestError("module index ciphertext is shorter than its GCM tag")
+    return nonce, ciphertext
+
+
+def _decompress_strict(
+    compressed: bytes,
+    *,
+    maximum: int,
+    description: str,
+    error: type[Exception],
+) -> bytes:
+    decompressor = zlib.decompressobj()
+    try:
+        value = decompressor.decompress(compressed, maximum + 1)
+        if len(value) > maximum or decompressor.unconsumed_tail:
+            raise error(f"{description} exceeds the safety limit")
+        value += decompressor.flush()
+    except zlib.error as exc:
+        raise error(f"{description} is not valid zlib data") from exc
+    if len(value) > maximum:
+        raise error(f"{description} exceeds the safety limit")
+    if not decompressor.eof or decompressor.unused_data:
+        raise error(f"{description} contains incomplete or trailing compressed data")
+    return value
+
+
+__all__ = [
+    "ARTIFACT_KEY_INFO",
+    "EncryptedModuleIndex",
+    "INDEX_COMMITMENT_DOMAIN",
+    "INDEX_COMMITMENT_SIZE",
+    "INDEX_KEY_INFO",
+    "MAGIC_PYE2",
+    "MODULE_INDEX_FORMAT",
+    "MODULE_ROOT_KEY_INFO",
+    "ModuleIndex",
+    "ModuleIndexEntry",
+    "OPAQUE_ARTIFACT_FORMAT",
+    "OpaqueModuleContext",
+    "ParsedOpaqueArtifact",
+    "TOKEN_SIZE",
+    "canonical_module_index_bytes",
+    "decode_module_index",
+    "decrypt_module_index",
+    "derive_module_index_key",
+    "derive_module_root_key",
+    "derive_opaque_artifact_key",
+    "encrypt_module_index",
+    "module_index_aad",
+    "module_index_commitment",
+    "normalize_module_index",
+    "opaque_artifact_aad",
+    "pack_opaque_artifact",
+    "parse_opaque_artifact",
+    "unpack_opaque_artifact",
+]

pyencode/runtime_template/__init__.py

@@ -0,0 +1,99 @@
+"""Public runtime interface copied into every protected distribution."""
+
+import os as _os
+import sys as _sys
+
+
+_sys.dont_write_bytecode = True
+_runtime_directory = _os.path.dirname(_os.path.realpath(__file__))
+_distribution_root = _os.path.dirname(_runtime_directory)
+_expected_runtime_files = {"__init__.py", "_mp_main.py", "_runtime.py", "_build.py"}
+try:
+    with _os.scandir(_runtime_directory) as _runtime_iterator:
+        _runtime_entries = tuple(_runtime_iterator)
+except OSError as exc:
+    raise ImportError("pyencode runtime directory is missing or unreadable") from exc
+_runtime_names = {entry.name for entry in _runtime_entries}
+_runtime_problems = []
+if _expected_runtime_files - _runtime_names:
+    _runtime_problems.append("missing " + ", ".join(sorted(_expected_runtime_files - _runtime_names)))
+if _runtime_names - _expected_runtime_files:
+    _runtime_problems.append("unexpected " + ", ".join(sorted(_runtime_names - _expected_runtime_files)))
+_non_files = sorted(
+    entry.name
+    for entry in _runtime_entries
+    if entry.is_symlink() or not entry.is_file(follow_symlinks=False)
+)
+if _non_files:
+    _runtime_problems.append("not regular files " + ", ".join(_non_files))
+if _runtime_problems:
+    raise ImportError(
+        "pyencode runtime directory contains unsigned files or directories ("
+        + "; ".join(_runtime_problems)
+        + ")"
+    )
+
+from . import _build as _bootstrap_build
+
+_raw_bootstrap_paths = getattr(_bootstrap_build, "BOOTSTRAP_PATHS", ())
+if not isinstance(_raw_bootstrap_paths, (tuple, list)):
+    raise ImportError("pyencode runtime bootstrap path configuration is invalid")
+_bootstrap_roots = set()
+for _relative in _raw_bootstrap_paths:
+    if _relative != "_vendor":
+        raise ImportError("pyencode runtime bootstrap path configuration is invalid")
+    _bootstrap_roots.add(
+        _os.path.normcase(_os.path.realpath(_os.path.join(_distribution_root, _relative)))
+    )
+
+
+def _is_distribution_path(_entry):
+    if not isinstance(_entry, str):
+        return False
+    _candidate = _entry or _os.getcwd()
+    try:
+        _root = _os.path.normcase(_os.path.realpath(_distribution_root))
+        _resolved = _os.path.normcase(_os.path.realpath(_candidate))
+        if _resolved in _bootstrap_roots:
+            return False
+        return _os.path.commonpath((_root, _resolved)) == _root
+    except (OSError, TypeError, ValueError):
+        return False
+
+
+# Do not let an injected top-level module beside the bundle shadow stdlib or
+# cryptography while the verifier itself is importing. Relative imports from
+# this already-located package continue to resolve through ``__path__``.
+_original_sys_path = list(_sys.path)
+_sys.path[:] = [_entry for _entry in _sys.path if not _is_distribution_path(_entry)]
+try:
+    from cryptography.exceptions import InvalidSignature as _InvalidSignature
+    from cryptography.exceptions import InvalidTag as _InvalidTag
+    from cryptography.hazmat.primitives import hashes as _crypto_hashes
+    from cryptography.hazmat.primitives.asymmetric.ed25519 import (
+        Ed25519PublicKey as _Ed25519PublicKey,
+    )
+    from cryptography.hazmat.primitives.ciphers.aead import AESGCM as _AESGCM
+    from cryptography.hazmat.primitives.kdf.hkdf import HKDF as _HKDF
+
+    from ._runtime import (
+        CompatibilityError,
+        IntegrityError,
+        PolicyError,
+        PyEncodeRuntimeError,
+        install,
+        load_entry,
+        run,
+    )
+finally:
+    _sys.path[:] = _original_sys_path
+
+__all__ = [
+    "CompatibilityError",
+    "IntegrityError",
+    "PolicyError",
+    "PyEncodeRuntimeError",
+    "install",
+    "load_entry",
+    "run",
+]

pyencode/runtime_template/_build.py

@@ -0,0 +1,15 @@
+"""Build-specific values replaced by :mod:`pyencode` in protected output.
+
+This file deliberately contains no usable defaults.  Keeping the names here
+makes the runtime template importable while it is part of the pyencode source
+tree; a build must replace every value except ``MANIFEST_NAME``.
+"""
+
+BUILD_ID = ""
+PYTHON_TAG = ""
+PUBLIC_KEY_B64 = ""
+KEY_PARTS = ()
+KEY_ORDER = ()
+MANIFEST_NAME = "pyencode-manifest.json"
+LAUNCHER_NAME = "run.py"
+BOOTSTRAP_PATHS = []

pyencode/runtime_template/_mp_main.py

@@ -0,0 +1,7 @@
+"""Multiprocessing-spawn trampoline for an encrypted application entry."""
+
+from ._runtime import _multiprocessing_bootstrap
+
+
+_multiprocessing_bootstrap(globals())
+del _multiprocessing_bootstrap