pyfernet-payload 0.2.4__tar.gz

pyfernet_payload-0.2.4/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 shunyaoyin
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

pyfernet_payload-0.2.4/PKG-INFO

@@ -0,0 +1,151 @@
+Metadata-Version: 2.4
+Name: pyfernet-payload
+Version: 0.2.4
+Summary: Encrypt a Python source directory into one .enc file and run it from memory (Fernet AES, stdlib-only).
+Home-page: https://github.com/yinshunyao/PyFernet
+Author: shunyaoyin
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/yinshunyao/PyFernet
+Project-URL: Issues, https://github.com/yinshunyao/PyFernet/issues
+Project-URL: Documentation, https://github.com/yinshunyao/PyFernet#readme
+Keywords: fernet,aes,encrypt,source-protection,in-memory,training
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security :: Cryptography
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Classifier: Typing :: Typed
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: home-page
+Dynamic: license-file
+Dynamic: requires-python
+
+# PyFernet (`pyfernet-payload`)
+
+[中文说明](README.zh-CN.md)
+
+Pack a training source directory into a single `.enc` blob; on the client, decrypt and run from an **in-memory VFS**. Only an **empty directory tree** is created on disk (for `Path(__file__)` / `chdir`); `.py` / config **contents are never written**. Removed on exit.
+
+- **Zero third-party runtime deps** (stdlib AES-128-CBC + Fernet-compatible format)
+- **PyPI name**: `pyfernet-payload` (`pyfernet` is already taken)
+- **CLI / import**: `pyfernet` / `import pyfernet`
+- **Relative paths work**: `Path(__file__).parent / "train_config.json"`, `open`, `spec_from_file_location` via VFS hooks
+
+## Install
+
+```bash
+pip install pyfernet-payload
+```
+
+From a local clone:
+
+```bash
+# preferred on older pip / mirrors (no editable hook needed)
+python3 -m pip install .
+
+# or editable (dev); if this fails, upgrade pip first:
+python3 -m pip install -U pip setuptools wheel
+python3 -m pip install -e .
+```
+## CLI
+
+### Encrypt
+
+```bash
+pyfernet encrypt ./my_train -o train_payload.enc -e train.py
+# passphrase via prompt; or:
+export PYFERNET_PASSWORD='your-secret'
+pyfernet encrypt ./my_train -o train_payload.enc -e train.py --password-env PYFERNET_PASSWORD
+```
+
+### Run
+
+```bash
+pyfernet run train_payload.enc
+# forward args to the training entry (after --):
+pyfernet run train_payload.enc -- --epochs 50 --batch 8
+```
+
+Equivalent:
+
+```bash
+python -m pyfernet encrypt ./my_train -o train_payload.enc -e train.py
+python -m pyfernet run train_payload.enc
+```
+
+## Workflow
+
+1. **Local**: write training code → `pyfernet encrypt` → `train_payload.enc`
+2. **SFTP**: upload the ciphertext only (client already has `pip install pyfernet-payload`)
+3. **SSH**: `pyfernet run train_payload.enc`, enter passphrase
+4. Decrypt into memory → empty dir anchors + VFS hooks → start training; write weights to a normal disk path
+5. On exit, remove empty dirs; durable disk still has only ciphertext
+
+If the entry uses sibling dirs (e.g. `train_detect_rtdetrv2/` + `train_detect_cfg/` + `train_detect_yolo/`), **encrypt the parent folder** and set `-e train_detect_rtdetrv2/train_insect.py`.
+
+Inference code, datasets, and weights can stay plaintext on the client.
+
+## IDE variable mode (optional)
+
+With no CLI args, modules use the variables at the bottom of the file:
+
+```bash
+python -m pyfernet.encryptor   # no args → SOURCE_DIR / OUTPUT_PATH / ENTRY_POINT
+python -m pyfernet.loader      # no args → PAYLOAD_PATH / TRAIN_ARGV
+```
+
+With args, they use the CLI, e.g. `python -m pyfernet.encryptor ./src -o out.enc -e train.py`.
+
+## Library API
+
+```python
+from pyfernet import encrypt_directory, run_payload
+
+encrypt_directory("examples/demo_train", "dist/train_payload.enc", "train.py", "secret")
+run_payload("dist/train_payload.enc", "secret", argv=["train.py", "--epochs", "1"])
+```
+
+## Payload format
+
+```text
+PYFE1\0  +  16B salt  +  Fernet(token)
+```
+
+Fernet plaintext is a zip (sources + `_pyfernet_manifest.json`). The passphrase is stretched with PBKDF2-HMAC-SHA256 (390000 iterations).
+
+## Notes
+
+- Source file **bytes never hit disk**; only empty directories exist briefly (often under `/dev/shm` on Linux)
+- Process memory / debuggers can still see plaintext; a leaked passphrase decrypts the blob
+- By default only `.py` and a few config suffixes are packed—do not put datasets or weights in the blob
+- The client still needs training deps installed (torch, ultralytics, etc.)
+
+## Publish to PyPI
+
+See [docs/PUBLISH.md](docs/PUBLISH.md) ([中文](docs/PUBLISH.zh-CN.md)).
+
+## Layout
+
+```text
+PyFernet/
+  pyproject.toml
+  README.md              # English (PyPI)
+  README.zh-CN.md        # Chinese
+  src/pyfernet/
+    cli.py
+    encryptor.py
+    loader.py
+    fernet_lite.py
+  examples/demo_train/
+  docs/PUBLISH.md
+  docs/PUBLISH.zh-CN.md
+```

pyfernet_payload-0.2.4/README.md

@@ -0,0 +1,120 @@
+# PyFernet (`pyfernet-payload`)
+
+[中文说明](README.zh-CN.md)
+
+Pack a training source directory into a single `.enc` blob; on the client, decrypt and run from an **in-memory VFS**. Only an **empty directory tree** is created on disk (for `Path(__file__)` / `chdir`); `.py` / config **contents are never written**. Removed on exit.
+
+- **Zero third-party runtime deps** (stdlib AES-128-CBC + Fernet-compatible format)
+- **PyPI name**: `pyfernet-payload` (`pyfernet` is already taken)
+- **CLI / import**: `pyfernet` / `import pyfernet`
+- **Relative paths work**: `Path(__file__).parent / "train_config.json"`, `open`, `spec_from_file_location` via VFS hooks
+
+## Install
+
+```bash
+pip install pyfernet-payload
+```
+
+From a local clone:
+
+```bash
+# preferred on older pip / mirrors (no editable hook needed)
+python3 -m pip install .
+
+# or editable (dev); if this fails, upgrade pip first:
+python3 -m pip install -U pip setuptools wheel
+python3 -m pip install -e .
+```
+## CLI
+
+### Encrypt
+
+```bash
+pyfernet encrypt ./my_train -o train_payload.enc -e train.py
+# passphrase via prompt; or:
+export PYFERNET_PASSWORD='your-secret'
+pyfernet encrypt ./my_train -o train_payload.enc -e train.py --password-env PYFERNET_PASSWORD
+```
+
+### Run
+
+```bash
+pyfernet run train_payload.enc
+# forward args to the training entry (after --):
+pyfernet run train_payload.enc -- --epochs 50 --batch 8
+```
+
+Equivalent:
+
+```bash
+python -m pyfernet encrypt ./my_train -o train_payload.enc -e train.py
+python -m pyfernet run train_payload.enc
+```
+
+## Workflow
+
+1. **Local**: write training code → `pyfernet encrypt` → `train_payload.enc`
+2. **SFTP**: upload the ciphertext only (client already has `pip install pyfernet-payload`)
+3. **SSH**: `pyfernet run train_payload.enc`, enter passphrase
+4. Decrypt into memory → empty dir anchors + VFS hooks → start training; write weights to a normal disk path
+5. On exit, remove empty dirs; durable disk still has only ciphertext
+
+If the entry uses sibling dirs (e.g. `train_detect_rtdetrv2/` + `train_detect_cfg/` + `train_detect_yolo/`), **encrypt the parent folder** and set `-e train_detect_rtdetrv2/train_insect.py`.
+
+Inference code, datasets, and weights can stay plaintext on the client.
+
+## IDE variable mode (optional)
+
+With no CLI args, modules use the variables at the bottom of the file:
+
+```bash
+python -m pyfernet.encryptor   # no args → SOURCE_DIR / OUTPUT_PATH / ENTRY_POINT
+python -m pyfernet.loader      # no args → PAYLOAD_PATH / TRAIN_ARGV
+```
+
+With args, they use the CLI, e.g. `python -m pyfernet.encryptor ./src -o out.enc -e train.py`.
+
+## Library API
+
+```python
+from pyfernet import encrypt_directory, run_payload
+
+encrypt_directory("examples/demo_train", "dist/train_payload.enc", "train.py", "secret")
+run_payload("dist/train_payload.enc", "secret", argv=["train.py", "--epochs", "1"])
+```
+
+## Payload format
+
+```text
+PYFE1\0  +  16B salt  +  Fernet(token)
+```
+
+Fernet plaintext is a zip (sources + `_pyfernet_manifest.json`). The passphrase is stretched with PBKDF2-HMAC-SHA256 (390000 iterations).
+
+## Notes
+
+- Source file **bytes never hit disk**; only empty directories exist briefly (often under `/dev/shm` on Linux)
+- Process memory / debuggers can still see plaintext; a leaked passphrase decrypts the blob
+- By default only `.py` and a few config suffixes are packed—do not put datasets or weights in the blob
+- The client still needs training deps installed (torch, ultralytics, etc.)
+
+## Publish to PyPI
+
+See [docs/PUBLISH.md](docs/PUBLISH.md) ([中文](docs/PUBLISH.zh-CN.md)).
+
+## Layout
+
+```text
+PyFernet/
+  pyproject.toml
+  README.md              # English (PyPI)
+  README.zh-CN.md        # Chinese
+  src/pyfernet/
+    cli.py
+    encryptor.py
+    loader.py
+    fernet_lite.py
+  examples/demo_train/
+  docs/PUBLISH.md
+  docs/PUBLISH.zh-CN.md
+```

pyfernet_payload-0.2.4/pyproject.toml

@@ -0,0 +1,59 @@
+[build-system]
+# setuptools>=64 才有 PEP 660 editable；旧 pip 会回退读同目录 setup.py
+requires = ["setuptools>=68", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "pyfernet-payload"
+version = "0.2.4"
+description = "Encrypt a Python source directory into one .enc file and run it from memory (Fernet AES, stdlib-only)."
+readme = "README.md"
+license = "MIT"
+license-files = ["LICENSE"]
+requires-python = ">=3.10"
+authors = [
+  { name = "shunyaoyin" },
+]
+keywords = [
+  "fernet",
+  "aes",
+  "encrypt",
+  "source-protection",
+  "in-memory",
+  "training",
+]
+classifiers = [
+  "Development Status :: 4 - Beta",
+  "Environment :: Console",
+  "Intended Audience :: Developers",
+  "Operating System :: OS Independent",
+  "Programming Language :: Python :: 3",
+  "Programming Language :: Python :: 3 :: Only",
+  "Programming Language :: Python :: 3.10",
+  "Programming Language :: Python :: 3.11",
+  "Programming Language :: Python :: 3.12",
+  "Programming Language :: Python :: 3.13",
+  "Topic :: Security :: Cryptography",
+  "Topic :: Software Development :: Libraries :: Python Modules",
+  "Typing :: Typed",
+]
+# 零运行时第三方依赖（纯标准库）
+dependencies = []
+
+[project.urls]
+Homepage = "https://github.com/yinshunyao/PyFernet"
+Issues = "https://github.com/yinshunyao/PyFernet/issues"
+Documentation = "https://github.com/yinshunyao/PyFernet#readme"
+
+[project.scripts]
+pyfernet = "pyfernet.cli:main"
+
+[tool.setuptools]
+package-dir = { "" = "src" }
+
+[tool.setuptools.packages.find]
+where = ["src"]
+include = ["pyfernet*"]
+
+[tool.setuptools.package-data]
+pyfernet = ["py.typed"]

pyfernet_payload-0.2.4/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

pyfernet_payload-0.2.4/setup.py

@@ -0,0 +1,63 @@
+#!/usr/bin/env python3
+"""setuptools entry for older pip that does not fully honor pyproject [project].
+
+Keeps name/version/entry points explicit so installs are not UNKNOWN-0.0.0.
+"""
+
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+from setuptools import find_packages, setup
+
+ROOT = Path(__file__).resolve().parent
+SRC = ROOT / "src"
+
+
+def _version() -> str:
+    init = (SRC / "pyfernet" / "__init__.py").read_text(encoding="utf-8")
+    m = re.search(r'^__version__\s*=\s*["\']([^"\']+)["\']', init, re.M)
+    if not m:
+        raise RuntimeError("cannot find __version__ in pyfernet/__init__.py")
+    return m.group(1)
+
+
+setup(
+    name="pyfernet-payload",
+    version=_version(),
+    description=(
+        "Encrypt a Python source directory into one .enc file "
+        "and run it from memory (Fernet AES, stdlib-only)."
+    ),
+    long_description=(ROOT / "README.md").read_text(encoding="utf-8"),
+    long_description_content_type="text/markdown",
+    author="shunyaoyin",
+    url="https://github.com/yinshunyao/PyFernet",
+    license="MIT",
+    package_dir={"": "src"},
+    packages=find_packages(where="src"),
+    package_data={"pyfernet": ["py.typed"]},
+    include_package_data=True,
+    python_requires=">=3.10",
+    install_requires=[],
+    entry_points={
+        "console_scripts": [
+            "pyfernet=pyfernet.cli:main",
+        ],
+    },
+    classifiers=[
+        "Development Status :: 4 - Beta",
+        "Environment :: Console",
+        "Intended Audience :: Developers",
+        "License :: OSI Approved :: MIT License",
+        "Operating System :: OS Independent",
+        "Programming Language :: Python :: 3",
+        "Programming Language :: Python :: 3 :: Only",
+        "Programming Language :: Python :: 3.10",
+        "Programming Language :: Python :: 3.11",
+        "Programming Language :: Python :: 3.12",
+        "Programming Language :: Python :: 3.13",
+        "Topic :: Security :: Cryptography",
+    ],
+)

pyfernet_payload-0.2.4/src/pyfernet/__init__.py

@@ -0,0 +1,14 @@
+"""PyFernet: encrypt a source directory into one .enc file and run it from memory."""
+
+from __future__ import annotations
+
+__version__ = "0.2.4"
+
+from pyfernet.encryptor import encrypt_directory
+from pyfernet.loader import run_payload
+
+__all__ = [
+    "__version__",
+    "encrypt_directory",
+    "run_payload",
+]

pyfernet_payload-0.2.4/src/pyfernet/__main__.py

@@ -0,0 +1,8 @@
+"""python -m pyfernet → CLI。"""
+
+from __future__ import annotations
+
+from pyfernet.cli import main
+
+if __name__ == "__main__":
+    raise SystemExit(main())

pyfernet_payload-0.2.4/src/pyfernet/cli.py

@@ -0,0 +1,158 @@
+"""命令行入口：pyfernet encrypt | run"""
+
+from __future__ import annotations
+
+import argparse
+import os
+import sys
+from pathlib import Path
+
+from pyfernet import __version__
+from pyfernet.encryptor import main as encrypt_main
+from pyfernet.loader import list_payload, main as run_main
+
+
+DEFAULT_PASSWORD_ENV = "PYFERNET_PASSWORD"
+
+
+def _password_from_args(password: str | None, password_env: str | None) -> str | None:
+    """解析口令：-p > --password-env > 环境变量 PYFERNET_PASSWORD > None(交互)。"""
+    if password is not None:
+        return password
+    env_name = password_env or DEFAULT_PASSWORD_ENV
+    # 显式传了 --password-env，或默认名在环境里有值时，走环境变量
+    if password_env is not None or env_name in os.environ:
+        value = os.environ.get(env_name)
+        if not value:
+            raise SystemExit(
+                f"环境变量未设置或为空: {env_name}\n"
+                f"  --password-env 后面是「变量名」不是口令本身。\n"
+                f"  正确示例:\n"
+                f"    export {DEFAULT_PASSWORD_ENV}='你的口令'\n"
+                f"    nohup pyfernet run train.enc --password-env {DEFAULT_PASSWORD_ENV} > d.log 2>&1 &\n"
+                f"  或（会进进程列表，仅临时用）:\n"
+                f"    nohup pyfernet run train.enc -p '你的口令' > d.log 2>&1 &"
+            )
+        return value
+    return None
+
+
+def _split_script_args(argv: list[str]) -> tuple[list[str], list[str]]:
+    """将 `run ... -- script_args` 拆开，避免 REMAINDER 吞掉 -p/--password-env。"""
+    if argv and argv[0] == "run" and "--" in argv:
+        idx = argv.index("--")
+        return argv[:idx], argv[idx + 1 :]
+    return argv, []
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(
+        prog="pyfernet",
+        description="将源码目录加密为单个 .enc，并在内存中解密运行（磁盘无明文源码）。",
+    )
+    parser.add_argument("--version", action="version", version=f"%(prog)s {__version__}")
+    sub = parser.add_subparsers(dest="command", required=True)
+
+    p_enc = sub.add_parser("encrypt", help="打包并加密源码目录")
+    p_enc.add_argument("source_dir", type=Path, help="要加密的源码目录")
+    p_enc.add_argument(
+        "-o",
+        "--output",
+        type=Path,
+        default=Path("train_payload.enc"),
+        help="输出密文路径（默认: train_payload.enc）",
+    )
+    p_enc.add_argument(
+        "-e",
+        "--entry",
+        default="train.py",
+        help="相对源目录的入口脚本（默认: train.py）",
+    )
+    p_enc.add_argument(
+        "-p",
+        "--password",
+        default=None,
+        help="口令（不推荐写在命令行；默认交互输入）。也可用 --password-env",
+    )
+    p_enc.add_argument(
+        "--password-env",
+        default=None,
+        metavar="VAR",
+        help="从环境变量读口令（填变量名，如 PYFERNET_PASSWORD；不是口令本身）",
+    )
+
+    p_run = sub.add_parser(
+        "run",
+        help="解密密文包并在内存中执行",
+        epilog="传给训练脚本的参数写在 -- 之后，例如: pyfernet run a.enc -- --epochs 10",
+    )
+    p_run.add_argument("payload", type=Path, help="密文包路径（.enc）")
+    p_run.add_argument(
+        "-p",
+        "--password",
+        default=None,
+        help="口令（不推荐写在命令行；默认交互输入）。也可用 --password-env",
+    )
+    p_run.add_argument(
+        "--password-env",
+        default=None,
+        metavar="VAR",
+        help="从环境变量读口令（填变量名，如 PYFERNET_PASSWORD；不是口令本身）",
+    )
+
+    p_list = sub.add_parser("list", help="列出密文包内文件（需口令）")
+    p_list.add_argument("payload", type=Path, help="密文包路径（.enc）")
+    p_list.add_argument("-p", "--password", default=None, help="口令（默认交互输入）")
+    p_list.add_argument(
+        "--password-env",
+        default=None,
+        metavar="VAR",
+        help="从环境变量读口令（填变量名；不是口令本身）",
+    )
+
+    return parser
+
+
+def main(argv: list[str] | None = None) -> int:
+    raw = list(sys.argv[1:] if argv is None else argv)
+    cli_argv, script_args = _split_script_args(raw)
+
+    parser = build_parser()
+    args = parser.parse_args(cli_argv)
+
+    if args.command == "encrypt":
+        password = _password_from_args(args.password, args.password_env)
+        encrypt_main(
+            source_dir=str(args.source_dir),
+            output_path=str(args.output),
+            entry_point=args.entry,
+            password=password,
+        )
+        return 0
+
+    if args.command == "run":
+        password = _password_from_args(args.password, args.password_env)
+        entry_name = Path(args.payload).name
+        train_argv = [entry_name, *script_args]
+        run_main(payload_path=str(args.payload), password=password, argv=train_argv)
+        return 0
+
+    if args.command == "list":
+        password = _password_from_args(args.password, args.password_env)
+        if password is None:
+            import getpass
+
+            password = getpass.getpass("解密口令: ")
+        entry, files = list_payload(args.payload, password)
+        print(f"entry: {entry}")
+        print(f"files: {len(files)}")
+        for name in files:
+            print(name)
+        return 0
+
+    parser.error(f"未知命令: {args.command}")
+    return 2
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

pyfernet_payload-0.2.4/src/pyfernet/constants.py

@@ -0,0 +1,31 @@
+"""Shared payload format constants."""
+
+from __future__ import annotations
+
+MAGIC = b"PYFE1\0"
+SALT_LEN = 16
+KDF_ITERATIONS = 390_000
+MANIFEST_NAME = "_pyfernet_manifest.json"
+
+SKIP_DIRS = {
+    ".git",
+    "__pycache__",
+    ".venv",
+    "venv",
+    ".mypy_cache",
+    ".pytest_cache",
+    "node_modules",
+}
+SKIP_SUFFIXES = {".pyc", ".pyo", ".enc"}
+ALLOW_SUFFIXES = {
+    ".py",
+    ".yaml",
+    ".yml",
+    ".json",
+    ".toml",
+    ".cfg",
+    ".ini",
+    ".txt",
+    ".md",
+}
+ALLOW_NAMES = {"LICENSE", "NOTICE"}