xppb 1.0.0__py3-none-any.whl

xppb/__init__.py

@@ -0,0 +1,3 @@
+"""A blazing-fast cross-platform Python bundling pipeline tool."""
+
+__version__ = "1.0.0" 

xppb/launcher_stub.c

@@ -0,0 +1,30 @@
+#include <windows.h>
+#include <stdio.h>
+#include <string.h>
+
+int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nCmdShow) {
+    char exePath[MAX_PATH];
+    GetModuleFileNameA(NULL, exePath, MAX_PATH);
+    
+    char* lastSlash = strrchr(exePath, '\\');
+    if (lastSlash != NULL) {
+        *lastSlash = '\0';
+    }
+
+    STARTUPINFO si;
+    PROCESS_INFORMATION pi;
+    ZeroMemory(&si, sizeof(si));
+    si.cb = sizeof(si);
+    ZeroMemory(&pi, sizeof(pi));
+
+    char cmd[32768];
+    // We use tokens here that Python will replace before compilation
+    snprintf(cmd, sizeof(cmd), "\"%s\\python\\__PYTHON_EXE__\" \"%s\\__ENTRY_POINT__\" %s", exePath, exePath, lpCmdLine);
+
+    if (CreateProcessA(NULL, cmd, NULL, NULL, FALSE, __CREATE_WINDOW_FLAG__, NULL, NULL, &si, &pi)) {
+        WaitForSingleObject(pi.hProcess, INFINITE);
+        CloseHandle(pi.hProcess);
+        CloseHandle(pi.hThread);
+    }
+    return 0;
+}

xppb/xppb.py

@@ -0,0 +1,638 @@
+import tomllib
+import os
+import sys
+import shutil
+import urllib.request
+import tarfile
+import zipfile
+import subprocess
+import platform
+from pathlib import Path
+import concurrent.futures
+import tempfile
+import contextlib
+
+@contextlib.contextmanager
+def mock_target_environment(platform_name):
+    """
+    Temporarily tricks the host Python environment and ModuleGraph into 
+    evaluating logic as if it were running natively on the target OS.
+    """
+    orig_platform = sys.platform
+    orig_os = os.name
+    orig_builtins = sys.builtin_module_names
+    target_os = platform_name.lower()
+    if 'windows' in target_os:
+        sys.platform = 'win32'
+        os.name = 'nt'
+        sys.builtin_module_names = tuple(set(orig_builtins) | {'winreg', 'msvcrt', '_winapi', 'nt'})
+    elif 'macos' in target_os:
+        sys.platform = 'darwin'
+        os.name = 'posix'
+        sys.builtin_module_names = tuple(set(orig_builtins) | {'posix'})
+    elif 'linux' in target_os:
+        sys.platform = 'linux'
+        os.name = 'posix'
+        sys.builtin_module_names = tuple(set(orig_builtins) | {'posix'})
+    try:
+        yield
+    finally:
+        sys.platform = orig_platform
+        os.name = orig_os
+        sys.builtin_module_names = orig_builtins
+try:
+    from modulegraph.modulegraph import ModuleGraph
+except ImportError:
+    print("[-] Error: 'modulegraph' is required for advanced dependency analysis.")
+    print('    Install it via: pip install modulegraph')
+    sys.exit(1)
+
+def generate_runtime_whitelist(entry_point_path, site_packages_path, stdlib_path, platform_name, hidden_imports=None, collect_all=None):
+    """
+    Uses ModuleGraph to trace required files, catching C-extensions and dynamic imports,
+    with an optimized, precise package file-level whitelisting system.
+    """
+    if hidden_imports is None:
+        hidden_imports = []
+    if collect_all is None:
+        collect_all = []
+    print(f' -> Tracing application dependencies via ModuleGraph (Targeting: {platform_name})...')
+    target_paths = [str(site_packages_path), str(stdlib_path)]
+    graph = ModuleGraph(path=target_paths)
+    scripts_to_trace = [str(entry_point_path)]
+    if hidden_imports:
+        print(f'    [*] Resolving {len(hidden_imports)} hidden imports...')
+        with tempfile.NamedTemporaryFile(mode='w', suffix='.py', delete=False) as temp_script:
+            for mod in hidden_imports:
+                temp_script.write(f'import {mod}\n')
+            temp_script_path = temp_script.name
+        scripts_to_trace.append(temp_script_path)
+    try:
+        with mock_target_environment(platform_name):
+            graph = ModuleGraph(path=target_paths)
+            for script in scripts_to_trace:
+                graph.run_script(script)
+    finally:
+        if hidden_imports and os.path.exists(temp_script_path):
+            os.remove(temp_script_path)
+    whitelist = set()
+    missing_modules = set()
+    base_paths = [Path(site_packages_path).resolve(), Path(stdlib_path).resolve()]
+
+    def smart_whitelist_add(p):
+        """Surgical path addition: breaks the parent directory shield."""
+        p = Path(p).resolve()
+        if p.is_dir():
+            for sub_p in p.rglob('*'):
+                if sub_p.is_file():
+                    smart_whitelist_add(sub_p)
+            return
+        whitelist.add(p)
+        parent = p.parent
+        while parent:
+            if not any((base in parent.parents or parent == base for base in base_paths)):
+                break
+            for init_name in ['__init__.py', '__init__.pyc']:
+                init_file = parent / init_name
+                if init_file.exists():
+                    whitelist.add(init_file.resolve())
+            parent = parent.parent
+    for node in graph.nodes():
+        if hasattr(node, 'filename') and node.filename:
+            smart_whitelist_add(node.filename)
+        if hasattr(node, 'packagepath') and node.packagepath:
+            for pkg_dir in node.packagepath:
+                if pkg_dir:
+                    smart_whitelist_add(pkg_dir)
+        if type(node).__name__ == 'MissingModule':
+            missing_modules.add(node.identifier)
+    essential_modules = ['site.py', 'os.py', 'stat.py', 'genericpath.py', 'encodings', 'codecs.py', 'io.py', 'abc.py', '_collections_abc.py', 'sitecustomize.py', 'importlib']
+    target_os = platform_name.lower()
+    if 'windows' in target_os:
+        essential_modules.extend(['ntpath.py', 'nt.py', '_winapi', 'msvcrt', 'winreg', 'socket.py', '_socket'])
+    else:
+        essential_modules.extend(['posixpath.py', 'posix.py', 'fcntl', 'termios', 'socket.py', '_socket'])
+    for essential in essential_modules:
+        for p in Path(stdlib_path).rglob(essential):
+            smart_whitelist_add(p)
+    print('    [*] Scanning compiled C-extensions for implicit dynamic imports...')
+    target_files = {}
+    for search_dir in base_paths:
+        for p in search_dir.rglob('*.py'):
+            target_files[p.stem] = p
+    rescued_binary_deps = 0
+    for file_path in list(whitelist):
+        if file_path.suffix.lower() in {'.so', '.pyd'}:
+            try:
+                with open(file_path, 'rb') as f:
+                    data = f.read()
+                for s in data.split(b'\x00'):
+                    if 2 < len(s) < 50 and s.replace(b'.', b'').replace(b'_', b'').isalnum():
+                        try:
+                            mod_string = s.decode('ascii')
+                            base_name = mod_string.split('.')[-1]
+                            if base_name in target_files and target_files[base_name] not in whitelist:
+                                smart_whitelist_add(target_files[base_name])
+                                rescued_binary_deps += 1
+                        except UnicodeDecodeError:
+                            pass
+            except OSError:
+                pass
+        if rescued_binary_deps > 0:
+            print(f'    [+] Binary scanner uncovered {rescued_binary_deps} hidden C-extension dependencies.')
+    if missing_modules:
+        print(f'    [*] Cross-compilation check: Attempting to rescue {len(missing_modules)} unresolved modules from target runtime...')
+        target_files = {}
+        for search_dir in base_paths:
+            for p in search_dir.rglob('*'):
+                if p.is_file():
+                    target_files[p.stem] = p
+        rescued_count = 0
+        for bad_mod in missing_modules:
+            base_name = bad_mod.split('.')[-1]
+            if base_name in target_files:
+                smart_whitelist_add(target_files[base_name])
+                rescued_count += 1
+        if rescued_count > 0:
+            print(f'    [+] Rescued {rescued_count} platform-specific modules from the cutting room floor.')
+    if collect_all:
+        print(f"    [*] Applying 'collect_all' override for {len(collect_all)} dynamic packages...")
+        for pkg_name in collect_all:
+            pkg_path = Path(site_packages_path) / pkg_name
+            if pkg_path.exists() and pkg_path.is_dir():
+                smart_whitelist_add(pkg_path)
+                for metadata_dir in Path(site_packages_path).glob(f'{pkg_name}-*.*-info'):
+                    smart_whitelist_add(metadata_dir)
+            else:
+                print(f"    [!] Warning: collect_all package '{pkg_name}' not found. Did you forget to list it in DEPENDENCIES?")
+    return whitelist
+
+def prune_runtime_bloat_strict(runtime_path, whitelist, site_packages_path, stdlib_path, extra_extensions=None):
+    """
+    Deletes EVERY file within the code-distribution scopes that is NOT in the whitelist,
+    while safely preserving critical non-Python data assets, compiled extensions, 
+    and surgical metadata blocks for active packages.
+    """
+    print(' -> Executing radical whitelisting (Strict Surgical Prune with Asset & Metadata Rescue)...')
+    runtime_path = Path(runtime_path)
+    bytes_saved = 0
+    preserve_extensions = {'.so', '.pyd', '.dylib', '.dll', '.pem', '.crt', '.json', '.yaml', '.yml', '.txt', '.csv', '.tcl', '.tk'}
+    if extra_extensions:
+        preserve_extensions.update((ext.lower() if ext.startswith('.') else f'.{ext.lower()}' for ext in extra_extensions))
+    target_zones = [Path(site_packages_path).resolve(), Path(stdlib_path).resolve()]
+    active_package_dirs = {p.parent.resolve() for p in whitelist}
+    active_module_names = set()
+    for p in whitelist:
+        if p.parent in target_zones:
+            active_module_names.add(p.stem.lower().replace('_', ''))
+        else:
+            for parent in p.parents:
+                if parent.parent in target_zones:
+                    active_module_names.add(parent.name.lower().replace('_', ''))
+                    break
+    for zone in target_zones:
+        if not zone.exists():
+            continue
+        for file_path in zone.rglob('*'):
+            if not file_path.is_file() and (not file_path.is_symlink()):
+                continue
+            resolved_file = file_path.resolve()
+            if resolved_file in whitelist:
+                continue
+            if resolved_file.suffix.lower() in preserve_extensions:
+                is_active_asset = False
+                parent = resolved_file.parent
+                while parent and parent != zone and (parent != parent.parent):
+                    if parent in active_package_dirs:
+                        is_active_asset = True
+                        break
+                    parent = parent.parent
+                if is_active_asset:
+                    whitelist.add(resolved_file)
+                    continue
+            is_metadata_file = False
+            for parent in resolved_file.parents:
+                if parent == zone:
+                    break
+                if parent.name.endswith('.dist-info') or parent.name.endswith('.egg-info'):
+                    critical_meta_files = {'METADATA', 'entry_points.txt', 'top_level.txt', 'PKG-INFO'}
+                    if resolved_file.name in critical_meta_files:
+                        meta_base_name = parent.name.split('-')[0].lower().replace('_', '')
+                        if meta_base_name in active_module_names:
+                            is_metadata_file = True
+                            whitelist.add(resolved_file)
+                    break
+            if is_metadata_file:
+                continue
+            try:
+                bytes_saved += file_path.stat().st_size
+                file_path.unlink()
+            except OSError:
+                pass
+    for dir_path in sorted(runtime_path.rglob('*'), key=lambda x: len(x.parts), reverse=True):
+        if dir_path.is_dir() and (not any(dir_path.iterdir())):
+            try:
+                dir_path.rmdir()
+            except OSError:
+                pass
+    print(f'    [+] Pruning complete. Reclaimed ~{bytes_saved / (1024 * 1024):.1f} MB.')
+
+def load_configuration(config_filename='projconf.toml'):
+    """Reads and maps the external TOML configuration layer."""
+    config_path = Path(config_filename)
+    if not config_path.exists():
+        print(f"[-] Error: Configuration file '{config_filename}' not found in the current working directory.")
+        sys.exit(1)
+    print(f'Loading environment manifest: {config_filename}')
+    with open(config_path, 'rb') as f:
+        try:
+            toml_data = tomllib.load(f)
+            return {'PROJECT_NAME': toml_data['project']['name'], 'VERSION': toml_data['project']['version'], 'PYTHON_VERSION': toml_data['project'].get('python_version', '3.11'), 'SOURCE_FILES': toml_data['project'].get('source_files', []), 'ENTRY_POINT': toml_data['project']['entry_point'], 'DEPENDENCIES': toml_data['project'].get('dependencies', []), 'HIDDEN_IMPORTS': toml_data['project'].get('hidden_imports', []), 'COLLECT_ALL': toml_data['project'].get('collect_all', []), 'LAUNCH_COMMAND': toml_data['project']['launch_command'], 'PRESERVE_EXTENSIONS': toml_data['project'].get('preserve_extensions', []), 'RUNTIMES': toml_data['runtimes'], 'WINDOWS_CONFIG': toml_data.get('windows', {}), 'MACOS_CONFIG': toml_data.get('macos', {}), 'LINUX_CONFIG': toml_data.get('linux', {})}
+        except KeyError as e:
+            print(f'[-] Configuration Error: Missing required TOML key definition {e}')
+            sys.exit(1)
+        except Exception as e:
+            print(f'[-] Syntax Error parsing TOML file: {e}')
+            sys.exit(1)
+
+def find_site_packages(base_path):
+    """Recursively crawls the runtime structure to locate the vendor folder."""
+    for root, dirs, _ in os.walk(base_path):
+        if os.path.basename(root) == 'site-packages':
+            return root
+    return None
+
+def download_runtime(url, dest_path):
+    """
+    Downloads the python runtime, utilizing a global cache to save bandwidth
+    and significantly speed up subsequent builds.
+    """
+    CACHE_DIR = Path.home() / '.core_bundler_cache' / 'runtimes'
+    CACHE_DIR.mkdir(parents=True, exist_ok=True)
+    filename = url.split('/')[-1]
+    cached_file = CACHE_DIR / filename
+    if cached_file.exists():
+        print(f'    [+] Cache hit! Using local runtime archive: {filename}')
+        shutil.copy2(cached_file, dest_path)
+        return
+    print(f'    [~] Downloading runtime to cache from {url}...')
+    try:
+        urllib.request.urlretrieve(url, cached_file)
+        print(f'    [+] Download complete. Cached permanently at {CACHE_DIR}')
+        shutil.copy2(cached_file, dest_path)
+    except Exception as e:
+        print(f'    [!] Failed to download runtime: {e}')
+        if cached_file.exists():
+            cached_file.unlink()
+        sys.exit(1)
+
+def extract_runtime(archive_path, extract_to):
+    """Extracts the .tar.gz bundle into the workspace securely, preventing path traversal attacks."""
+    print(f' -> Unpacking engine files securely...')
+    extract_to_path = Path(extract_to).resolve()
+    with tarfile.open(archive_path, 'r:gz') as tar:
+        if hasattr(tarfile, 'data_filter'):
+            try:
+                tar.extractall(path=extract_to_path, filter='data')
+                return
+            except (TypeError, ValueError):
+                pass
+        safe_members = []
+        for member in tar.getmembers():
+            target_path = Path(os.path.abspath(os.path.join(extract_to_path, member.name)))
+            if extract_to_path not in target_path.parents and target_path != extract_to_path:
+                print(f"[-] Malicious Archive Detected: Refusing to extract '{member.name}' (outside boundary).")
+                sys.exit(1)
+            safe_members.append(member)
+        tar.extractall(path=extract_to_path, members=safe_members)
+
+def download_and_extract_deps(deps, target_site_packages, temp_dir, platform_key, python_version):
+    """Resolves and properly installs specified packages using uv (if available) or pip."""
+    if not deps:
+        return
+    platform_map = {'windows-x64': {'platform': 'win_amd64', 'abi': f"cp{python_version.replace('.', '')}"}, 'windows': {'platform': 'win_amd64', 'abi': f"cp{python_version.replace('.', '')}"}, 'linux-x64': {'platform': 'manylinux2014_x86_64', 'abi': f"cp{python_version.replace('.', '')}"}, 'linux': {'platform': 'manylinux2014_x86_64', 'abi': f"cp{python_version.replace('.', '')}"}, 'macos-x64': {'platform': 'macosx_10_9_x86_64', 'abi': f"cp{python_version.replace('.', '')}"}, 'macos-arm64': {'platform': 'macosx_11_0_arm64', 'abi': f"cp{python_version.replace('.', '')}"}}
+    lookup_key = platform_key.lower()
+    plat_info = platform_map.get(lookup_key)
+    print(f" -> Syncing dependencies for {platform_key} (Targeting Python {python_version}): {', '.join(deps)}...")
+    uv_bin = shutil.which('uv')
+    if uv_bin:
+        print("    [*] Acceleration Engaged: Routing dependency resolution through 'uv'...")
+        cmd = [uv_bin, 'pip', 'install', '--target', str(target_site_packages), '--only-binary=:all:']
+    else:
+        cmd = [sys.executable, '-m', 'pip', 'install', '--target', str(target_site_packages), '--only-binary=:all:', '--no-warn-script-location']
+    if plat_info:
+        cmd.extend(['--platform', plat_info['platform'], '--abi', plat_info['abi'], '--python-version', python_version, '--implementation', 'cp'])
+    cmd.extend(deps)
+    try:
+        subprocess.run(cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, check=True)
+    except subprocess.CalledProcessError:
+        installer = 'uv' if uv_bin else 'pip'
+        print(f"    [!] Error: {installer} failed to resolve or install target variants for: {', '.join(deps)}")
+        raise RuntimeError(f'Dependency resolution failed via {installer}.')
+
+def generate_info_plist(dest_path, project_name, version):
+    """Generates and writes a compliant macOS Info.plist file."""
+    plist_content = f'<?xml version="1.0" encoding="UTF-8"?>\n<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\n<plist version="1.0">\n<dict>\n    <key>CFBundlePackageType</key>\n    <string>APPL</string>\n    <key>CFBundleInfoDictionaryVersion</key>\n    <string>6.0</string>\n    <key>CFBundleName</key>\n    <string>{project_name}</string>\n    <key>CFBundleExecutable</key>\n    <string>{project_name}</string>\n    <key>CFBundleIdentifier</key>\n    <string>com.standalone.{project_name.lower()}</string>\n    <key>CFBundleShortVersionString</key>\n    <string>{version}</string>\n    <key>CFBundleVersion</key>\n    <string>{version}</string>\n    <key>LSMinimumSystemVersion</key>\n    <string>10.13</string>\n</dict>\n</plist>\n'
+    dest_path.write_text(plist_content)
+
+def find_windows_compiler():
+    """Detects native toolchains or cross-compilers on the host platform."""
+    for compiler in ['gcc', 'x86_64-w64-mingw32-gcc', 'cl']:
+        if shutil.which(compiler):
+            return compiler
+    return None
+
+def find_signtool():
+    """Recursively searches traditional Windows SDK locations for signtool.exe."""
+    if shutil.which('signtool'):
+        return 'signtool'
+    possible_roots = [Path('C:/Program Files (x86)/Windows Kits/10/bin'), Path('C:/Program Files/Windows Kits/10/bin'), Path('C:/Program Files (x86)/Microsoft SDKs/ClickOnce/SignTool')]
+    for root in possible_roots:
+        if not root.exists():
+            continue
+        if root.name == 'SignTool':
+            exe = root / 'signtool.exe'
+            if exe.exists():
+                return str(exe)
+        else:
+            for sub in root.iterdir():
+                if sub.is_dir():
+                    for arch in ['x64', 'x86']:
+                        exe = sub / arch / 'signtool.exe'
+                        if exe.exists():
+                            return str(exe)
+    return None
+
+def sign_windows_executable(target_file, win_config):
+    """Integrates code signing parameters if a certificate context is provided."""
+    cert_path = win_config.get('pfx_certificate')
+    cert_password = win_config.get('pfx_password')
+    if not cert_path or not cert_password:
+        return
+    signtool_bin = find_signtool()
+    if not signtool_bin:
+        print('    [!] Warning: signtool.exe missing from common paths. Skipping signature routine.')
+        return
+    print(f' -> Code signing target binary: {target_file.name}...')
+    cmd = [signtool_bin, 'sign', '/f', str(cert_path), '/p', cert_password, '/tr', 'http://timestamp.digicert.com', '/td', 'sha256', '/fd', 'sha256', str(target_file)]
+    try:
+        subprocess.run(cmd, check=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+        print('[+] Code signature successfully embedded.')
+    except subprocess.CalledProcessError:
+        print('    [!] Error: SignTool invocation failed. Verify certificate properties.')
+
+def generate_windows_launcher(platform_dir, project_name, entry_point, win_config):
+    """Builds a zero-flash compiled binary using decoupled source files and guaranteed cleanup paths."""
+    hide_console = win_config.get('hide_console', False)
+    compiler = find_windows_compiler()
+    launcher_exe = platform_dir / f'{project_name}.exe'
+    entry_point_normalized = entry_point.replace('\\', '/')
+    entry_point_fixed = entry_point_normalized.replace('/', '\\\\')
+    python_exe = 'pythonw.exe' if hide_console else 'python.exe'
+    create_window_flag = 'CREATE_NO_WINDOW' if hide_console else '0'
+    if compiler:
+        print(f' -> Found build engine ({compiler}). Compiling native Win32 executable launcher...')
+        c_source_path = platform_dir / '_launcher.c'
+        stub_path = Path(__file__).parent / "launcher_stub.c"
+        if not stub_path.exists():
+            print("    [!] Error: 'launcher_stub.c' template missing. Reverting to fallback wrappers...")
+            compiler = None
+        else:
+            try:
+                raw_c_code = stub_path.read_text()
+                c_code = raw_c_code.replace('__PYTHON_EXE__', python_exe)
+                c_code = c_code.replace('__ENTRY_POINT__', entry_point_fixed)
+                c_code = c_code.replace('__CREATE_WINDOW_FLAG__', create_window_flag)
+                c_source_path.write_text(c_code)
+                if compiler == 'cl':
+                    subprocess.run(['cl.exe', '/O2', f'/Fe:{launcher_exe}', str(c_source_path), '/link', '/SUBSYSTEM:WINDOWS'], check=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+                else:
+                    build_cmd = [compiler, '-O2', str(c_source_path), '-o', str(launcher_exe)]
+                    if hide_console:
+                        build_cmd.append('-mwindows')
+                    subprocess.run(build_cmd, check=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+                return launcher_exe
+            except Exception:
+                print('    [!] Compilation pipeline exception. Reverting to structural fallback scripts...')
+                if launcher_exe.exists():
+                    launcher_exe.unlink()
+            finally:
+                if c_source_path.exists():
+                    c_source_path.unlink()
+                for junk in [platform_dir / '_launcher.obj', platform_dir / f'{project_name}.obj']:
+                    if junk.exists():
+                        junk.unlink()
+    print(' -> Constructing basic script wrapper (No native compiler available)...')
+    launcher_bat = platform_dir / f'{project_name}.bat'
+    bat_content = f'@echo off\nsetlocal\n"%~dp0python\\{python_exe}" "%~dp0{entry_point}" %*\nendlocal\n'
+    launcher_bat.write_text(bat_content)
+    if hide_console:
+        vbs_launcher = platform_dir / f'{project_name}.vbs'
+        vbs_content = f'Set WshShell = CreateObject("WScript.Shell")\nWshShell.Run chr(34) & "{project_name}.bat" & chr(34), 0\nSet WshShell = Nothing\n'
+        vbs_launcher.write_text(vbs_content)
+        return vbs_launcher
+    return launcher_bat
+
+def ensure_rcodesign():
+    """Locates or automatically downloads the cross-platform apple-codesign tool binary."""
+    system_path = shutil.which('rcodesign')
+    if system_path:
+        return system_path
+    tools_dir = Path('build/tools')
+    tools_dir.mkdir(parents=True, exist_ok=True)
+    host_sys = sys.platform
+    version = '0.29.0'
+    base_url = f'https://github.com/indygreg/apple-platform-rs/releases/download/apple-codesign%2F{version}/'
+    if host_sys == 'win32':
+        asset_name = f'apple-codesign-{version}-x86_64-pc-windows-msvc.zip'
+        binary_name = 'rcodesign.exe'
+    elif host_sys == 'darwin':
+        asset_name = f'apple-codesign-{version}-macos-universal.tar.gz'
+        binary_name = 'rcodesign'
+    else:
+        asset_name = f'apple-codesign-{version}-x86_64-unknown-linux-musl.tar.gz'
+        binary_name = 'rcodesign'
+    local_binary = tools_dir / binary_name
+    if local_binary.exists():
+        return str(local_binary)
+    print(f' -> Apple tools missing. Auto-fetching cross-platform rcodesign v{version} for host pipeline...')
+    archive_dest = tools_dir / asset_name
+    try:
+        req = urllib.request.Request(base_url + asset_name, headers={'User-Agent': 'Mozilla/5.0'})
+        with urllib.request.urlopen(req) as response, open(archive_dest, 'wb') as out_file:
+            shutil.copyfileobj(response, out_file)
+        if asset_name.endswith('.zip'):
+            with zipfile.ZipFile(archive_dest, 'r') as zip_ref:
+                zip_ref.extractall(tools_dir)
+        else:
+            with tarfile.open(archive_dest, 'r:gz') as tar:
+                tar.extractall(path=tools_dir)
+        for root, _, files in os.walk(tools_dir):
+            if binary_name in files:
+                target = Path(root) / binary_name
+                if target != local_binary:
+                    shutil.move(str(target), str(local_binary))
+                break
+        if local_binary.exists():
+            os.chmod(local_binary, 493)
+            if archive_dest.exists():
+                archive_dest.unlink()
+            return str(local_binary)
+    except Exception as e:
+        print(f'    [!] Failed to download cross-platform signing dependency: {e}')
+        sys.exit(1)
+
+def sign_macos_bundle_cross_platform(app_path, mac_config, rcodesign_bin):
+    """Signs a macOS .app bundle structure flawlessly from any supported OS platform context."""
+    p12_cert = mac_config.get('p12_certificate')
+    p12_pass = mac_config.get('p12_password')
+    if not p12_cert:
+        print('    [-] Skipping macOS signing engine: No .p12 certificate file defined.')
+        return
+    print(f' -> Cryptographically signing macOS application framework: {app_path.name}...')
+    cmd = [rcodesign_bin, 'sign', '--p12-file', str(p12_cert), '--p12-password', str(p12_pass), '--code-signature-flags', 'runtime', str(app_path)]
+    try:
+        subprocess.run(cmd, check=True, stdout=subprocess.DEVNULL, stderr=subprocess.PIPE, text=True)
+        print('    [+] Apple Developer signature successfully validated and compiled.')
+    except subprocess.CalledProcessError as e:
+        print(f'    [!] Error: rcodesign execution error:\n{e.stderr}')
+        sys.exit(1)
+
+def notarize_macos_bundle_cross_platform(app_path, mac_config, rcodesign_bin):
+    """Submits the payload to Apple Notary API and staples tickets directly inside non-macOS setups."""
+    api_key = mac_config.get('api_key_path')
+    api_issuer = mac_config.get('api_issuer_id')
+    api_key_id = mac_config.get('api_key_id')
+    if not all([api_key, api_issuer, api_key_id]):
+        print('    [-] Skipping Apple Notarization: ASC API Keys are incomplete.')
+        return
+    print(f' -> Submitting bundle to Apple Notary API servers (Cross-Platform Connection)...')
+    cmd = [rcodesign_bin, 'notary-submit', '--api-key-path', str(api_key), '--api-issuer', str(api_issuer), '--api-key', str(api_key_id), '--staple', str(app_path)]
+    try:
+        subprocess.run(cmd, check=True)
+        print('    [+] Notarization ticket acquired and stapled into app bundle.')
+    except subprocess.CalledProcessError:
+        print('    [!] Error: Apple Notary Service API transaction failed.')
+        sys.exit(1)
+
+def bundle_platform(platform_name, url, build_dir, dist_dir, base_temp_dir, CONFIG):
+    """Encapsulates the build process for a single target platform to allow concurrent execution."""
+    print(f'\n[Target Platform: {platform_name}] Process started...')
+    platform_dir = build_dir / platform_name
+    platform_dir.mkdir(parents=True, exist_ok=True)
+    archive_path = build_dir / f'engine_{platform_name}.tar.gz'
+    temp_dir = base_temp_dir / platform_name
+    temp_dir.mkdir(parents=True, exist_ok=True)
+    is_macos = 'macos' in platform_name.lower()
+    if is_macos:
+        app_bundle = platform_dir / f"{CONFIG['PROJECT_NAME']}.app"
+        contents_dir = app_bundle / 'Contents'
+        macos_dir = contents_dir / 'MacOS'
+        resources_dir = contents_dir / 'Resources'
+        macos_dir.mkdir(parents=True, exist_ok=True)
+        resources_dir.mkdir(parents=True, exist_ok=True)
+        runtime_extract_target = resources_dir
+        source_dest_parent = resources_dir
+    else:
+        runtime_extract_target = platform_dir
+        source_dest_parent = platform_dir
+    download_runtime(url, archive_path)
+    extract_runtime(archive_path, runtime_extract_target)
+    site_packages = find_site_packages(runtime_extract_target)
+    if not site_packages:
+        print(f'    [!] Error: Failed to pinpoint target environment layout for {platform_name}!')
+        return
+    download_and_extract_deps(CONFIG['DEPENDENCIES'], site_packages, temp_dir, platform_name, python_version=CONFIG['PYTHON_VERSION'])
+    stdlib_path = Path(site_packages).parent
+    active_hidden = list(CONFIG.get('HIDDEN_IMPORTS', []))
+    active_collect = list(CONFIG.get('COLLECT_ALL', []))
+    plat_lower = platform_name.lower()
+    if 'windows' in plat_lower:
+        active_hidden.extend(CONFIG['WINDOWS_CONFIG'].get('hidden_imports', []))
+        active_collect.extend(CONFIG['WINDOWS_CONFIG'].get('collect_all', []))
+    elif 'macos' in plat_lower:
+        active_hidden.extend(CONFIG['MACOS_CONFIG'].get('hidden_imports', []))
+        active_collect.extend(CONFIG['MACOS_CONFIG'].get('collect_all', []))
+    elif 'linux' in plat_lower:
+        active_hidden.extend(CONFIG['LINUX_CONFIG'].get('hidden_imports', []))
+        active_collect.extend(CONFIG['LINUX_CONFIG'].get('collect_all', []))
+    whitelist = generate_runtime_whitelist(entry_point_path=Path(CONFIG['ENTRY_POINT']), site_packages_path=Path(site_packages), stdlib_path=stdlib_path, platform_name=platform_name, hidden_imports=active_hidden, collect_all=active_collect)
+    prune_runtime_bloat_strict(runtime_path=runtime_extract_target, whitelist=whitelist, site_packages_path=site_packages, stdlib_path=stdlib_path, extra_extensions=CONFIG.get('PRESERVE_EXTENSIONS', []))
+    print(f' -> [{platform_name}] Packaging custom source layers...')
+    for src in CONFIG['SOURCE_FILES']:
+        src_path = Path(src)
+        if not src_path.exists():
+            print(f"    [!] Missing source path ignored: '{src}'")
+            continue
+        dest_path = source_dest_parent / src_path.name
+        if src_path.is_dir():
+            shutil.copytree(src_path, dest_path)
+        else:
+            shutil.copy2(src_path, dest_path)
+    print(f' -> [{platform_name}] Constructing isolated binary wrappers...')
+    if 'windows' in platform_name:
+        launcher_path = generate_windows_launcher(platform_dir, CONFIG['PROJECT_NAME'], CONFIG['ENTRY_POINT'], CONFIG['WINDOWS_CONFIG'])
+        sign_windows_executable(launcher_path, CONFIG['WINDOWS_CONFIG'])
+    elif is_macos:
+        launcher_path = macos_dir / CONFIG['PROJECT_NAME']
+        launch_cmd = CONFIG['LAUNCH_COMMAND'].format(ENTRY_POINT=f"$SCRIPT_DIR/../Resources/{CONFIG['ENTRY_POINT']}")
+        sh_content = f'#!/usr/bin/env bash\nSCRIPT_DIR="$(cd "$(dirname "${{BASH_SOURCE[0]}}")" && pwd)"\n"$SCRIPT_DIR/../Resources/python/bin/python3" {launch_cmd} "$@"\n'
+        launcher_path.write_text(sh_content)
+        generate_info_plist(contents_dir / 'Info.plist', CONFIG['PROJECT_NAME'], CONFIG['VERSION'])
+        os.chmod(launcher_path, 493)
+        python_bin = resources_dir / 'python' / 'bin' / 'python3'
+        if python_bin.exists():
+            os.chmod(python_bin, 493)
+        rcodesign_bin = ensure_rcodesign()
+        sign_macos_bundle_cross_platform(app_bundle, CONFIG['MACOS_CONFIG'], rcodesign_bin)
+        notarize_macos_bundle_cross_platform(app_bundle, CONFIG['MACOS_CONFIG'], rcodesign_bin)
+    else:
+        launcher_path = platform_dir / CONFIG['PROJECT_NAME']
+        launch_cmd = CONFIG['LAUNCH_COMMAND'].format(ENTRY_POINT=f"$SCRIPT_DIR/{CONFIG['ENTRY_POINT']}")
+        sh_content = f'#!/usr/bin/env bash\nSCRIPT_DIR="$(cd "$(dirname "${{BASH_SOURCE[0]}}")" && pwd)"\n"$SCRIPT_DIR/python/bin/python3" {launch_cmd} "$@"\n'
+        launcher_path.write_text(sh_content)
+        os.chmod(launcher_path, 493)
+        python_bin = platform_dir / 'python' / 'bin' / 'python3'
+        if python_bin.exists():
+            os.chmod(python_bin, 493)
+    print(f' -> [{platform_name}] Sealing compressed release asset...')
+    dist_base_name = dist_dir / f"{CONFIG['PROJECT_NAME']}-{CONFIG['VERSION']}-{platform_name}"
+    if 'windows' in platform_name:
+        shutil.make_archive(str(dist_base_name), 'zip', root_dir=platform_dir)
+        print(f'    [+] Archive ready: {dist_base_name}.zip')
+    else:
+        shutil.make_archive(str(dist_base_name), 'gztar', root_dir=platform_dir)
+        print(f'    [+] Archive ready: {dist_base_name}.tar.gz')
+    if archive_path.exists():
+        archive_path.unlink()
+
+def main():
+    CONFIG = load_configuration()
+    build_dir = Path('build')
+    dist_dir = Path('dist')
+    base_temp_dir = Path('build/temp_deps')
+    if build_dir.exists():
+        shutil.rmtree(build_dir)
+    if dist_dir.exists():
+        shutil.rmtree(dist_dir)
+    build_dir.mkdir(parents=True, exist_ok=True)
+    dist_dir.mkdir(parents=True, exist_ok=True)
+    base_temp_dir.mkdir(parents=True, exist_ok=True)
+    print(f'\n=== xppb v1.0.0')
+    print(f"\n=== Bundling Sequence Initiated: {CONFIG['PROJECT_NAME']} v{CONFIG['VERSION']} ===")
+    with concurrent.futures.ProcessPoolExecutor() as executor:
+        futures = []
+        for platform_name, url in CONFIG['RUNTIMES'].items():
+            futures.append(executor.submit(bundle_platform, platform_name, url, build_dir, dist_dir, base_temp_dir, CONFIG))
+        for future in concurrent.futures.as_completed(futures):
+            try:
+                future.result()
+            except Exception as e:
+                print(f'\n[!] A thread encountered a fatal error during compilation: {e}')
+    if base_temp_dir.exists():
+        shutil.rmtree(base_temp_dir)
+    print('\n========================================================================')
+    print(f'Success! Standalone bundles have been compiled inside: {dist_dir.resolve()}')
+    print('========================================================================')
+if __name__ == '__main__':
+    main()

xppb-1.0.0.dist-info/METADATA

@@ -0,0 +1,153 @@
+Metadata-Version: 2.4
+Name: xppb
+Version: 1.0.0
+Summary: A blazing-fast cross-platform Python bundling pipeline tool.
+Author-email: nulsie <donotemailme@mail.com>
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+Requires-Dist: modulegraph>=0.17.4
+
+# xppb (cross-platform python bundler)
+
+xppb is a blazing-fast truly cross-platform binary bundler designed to compile, prune, and package Python applications into standalone, production-ready executables for Windows, macOS, and Linux from a single host machine.
+
+Unlike traditional bundlers that are severely limited by their host operating system, xppb natively supports **true cross-compilation**. By temporarily spoofing the Python interpreter's global state and relying on standard archives, a developer on Linux can seamlessly build a signed Windows `.exe` and a fully notarized macOS `.app` bundle simultaneously in a single execution in a matter of seconds(takes a lot configuration and 20-30 min in Nuitka for reference).
+
+---
+
+While tools like PyInstaller, Nuitka, and cx_Freeze are industry standards, xppb bypasses their historical limitations through a modern, aggressive architecture:
+
+* **True Single-Host Cross-Compilation**: PyInstaller and Nuitka require you to build Windows binaries on a Windows host. xppb utilizes a `mock_target_environment` context manager to trick the host Python environment and `modulegraph` into evaluating code paths as if they were running natively on the target operating system.
+
+
+* **Radical "Default-Deny" Bloat Pruning**: Traditional bundlers pull in massive directories based on exclusion lists. xppb uses a strict surgical whitelist, deleting every file in `site-packages` and the standard library that is not explicitly resolved by the dependency graph. It safely preserves only the structural `__init__.py` files, compiled extensions, and active metadata blocks (like `.dist-info`).
+
+
+* **Host-Agnostic Apple Code-Signing**: You no longer need an Xcode-equipped Mac to notarize macOS software. xppb automatically fetches Indygreg’s cross-platform `rcodesign` tool to cryptographically sign bundles and submit them directly to the Apple Notary API from Linux or Windows environments.
+
+
+* **Lightning Fast Dependency Resolution**: xppb searches the host for Astral's `uv` binary. If found, it routes dependency installation through `uv`, utilizing its `--platform` and `--abi` flags to download platform-specific wheels in a fraction of the time standard `pip` would take.
+
+
+* **Zero-Flash Windows Launchers**: Instead of relying solely on slow script wrappers, xppb scans the host for native C compilers (`gcc`, `cl`, etc.) and dynamically templates and compiles a C-based executable (`launcher_stub.c`) to launch the application silently without console flashes.
+
+
+
+---
+
+## Core Features Under the Hood
+
+### 1. The Environment Spoofer (`mock_target_environment`)
+
+To trace platform-specific dependencies (like `winreg` on Windows or `termios` on Linux) without crashing the host machine, xppb temporarily intercepts and rewrites Python's core system identifiers.
+
+```python
+# Modifies global state thread-safely before ModuleGraph execution
+if "windows" in target_os:
+    sys.platform = "win32"
+    os.name = "nt"
+    sys.builtin_module_names = tuple(set(orig_builtins) | {"winreg", "msvcrt", "_winapi", "nt"})
+
+```
+
+### 2. C-Extension Binary Rescuer
+
+Compiled modules (`.so` / `.pyd`) often hide dynamic imports in their C code that standard AST tracers miss. xppb sweeps compiled extensions, reading them as binary data and matching valid ASCII strings against available system modules to rescue hidden dependencies.
+
+```python
+with open(file_path, "rb") as f:
+    data = f.read()
+for s in data.split(b'\0'):
+    # Look for strings that match the active environment file map
+    if 2 < len(s) < 50 and s.replace(b'.', b'').replace(b'_', b'').isalnum():
+        # ...rescues missing modules...
+
+```
+
+### 3. Persistent Runtime Caching
+
+To save bandwidth across frequent builds, xppb downloads massive standard standard-library `.tar.gz` runtimes into a persistent user-level directory (`~/.core_bundler_cache/runtimes`). Subsequent cross-compilations pull locally from the cache instantly.
+
+---
+
+## On Using It
+
+## Through uv:
+```
+uv pip install xppb
+```
+
+## Through pip:
+just remove the uv from the above command.
+
+## Git Clone:
+```
+git clone https://codeberg.org/nulsie/xppb.git
+cd xppb
+```
+
+### Prerequisites
+
+* Python 3.11+
+* `pip install modulegraph`
+
+* *(Optional but Recommended)*: Install `uv` for drastically accelerated wheel downloads.
+
+
+
+### Configuration (`projconf.toml`)
+
+xppb is entirely configuration-driven. Create a file named `projconf.toml` in your project root. Here is a complete reference of the required layout:
+
+```toml
+[project]
+name = "MyAwesomeApp"
+version = "1.0.0"
+python_version = "3.11"
+entry_point = "main.py"
+source_files = ["main.py", "assets/"]
+dependencies = ["requests", "rich", "numpy"]
+hidden_imports = ["pkg_resources.extern"]
+collect_all = []
+preserve_extensions = [".png", ".ico"]
+launch_command = "{ENTRY_POINT}"
+
+[runtimes]
+# URLs pointing to standalone python standard libraries (.tar.gz)
+windows-x64 = "https://example.com/python-3.11-win64.tar.gz"
+macos-arm64 = "https://example.com/python-3.11-macos-arm64.tar.gz"
+linux-x64 = "https://example.com/python-3.11-linux64.tar.gz"
+
+[windows]
+hide_console = true
+pfx_certificate = "certs/win_cert.pfx"
+pfx_password = "SuperSecretPassword123"
+hidden_imports = ["winreg"]
+
+[macos]
+p12_certificate = "certs/mac_cert.p12"
+p12_password = "SuperSecretPassword123"
+api_key_path = "certs/AuthKey_ABCD123.p8"
+api_issuer_id = "xxxxxx-xxxx-xxxx-xxxx-xxxxxxxx"
+api_key_id = "ABCD123"
+
+```
+
+### Usage
+
+Once your `projconf.toml` is configured, simply run `xppb` in your working directory and execute it:
+
+```bash
+xppb
+
+```
+
+xppb utilizes a `ProcessPoolExecutor` to spin up a concurrent build thread for every OS target defined in your `[runtimes]` configuration block.
+
+* Build artifacts are processed temporarily in a `build/` directory.
+
+* Final, compressed distribution assets (ready to be uploaded to GitHub Releases or S3) are deposited into `dist/`.
+
+-----
+
+**Author:** nulsie **License:** MIT License

xppb-1.0.0.dist-info/RECORD

@@ -0,0 +1,7 @@
+xppb/__init__.py,sha256=LEcj1vU8MTsXjgJ0x2Er8l6GgRzRpXsqitZTqhkPAkI,91
+xppb/launcher_stub.c,sha256=04C-3qgQekUToChHP9xNdLqdThw7puaVIkEnLX_1sVQ,946
+xppb/xppb.py,sha256=8L6FoGnJzh7b2BI65AERBSr8mh2jGLS5J2sxo5nVzLk,33859
+xppb-1.0.0.dist-info/entry_points.txt,sha256=b-OczJAZjjuVe7-5Vfy2vHhXRhCPicBYRblpzIN7rsE,39
+xppb-1.0.0.dist-info/WHEEL,sha256=G2gURzTEtmeR8nrdXUJfNiB3VYVxigPQ-bEQujpNiNs,82
+xppb-1.0.0.dist-info/METADATA,sha256=MrT4RgwpaltL7HMrZ2Avzzc89Ku1ReectHHqF_dgP8A,6207
+xppb-1.0.0.dist-info/RECORD,,

xppb-1.0.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: flit 3.12.0
+Root-Is-Purelib: true
+Tag: py3-none-any

xppb-1.0.0.dist-info/entry_points.txt

@@ -0,0 +1,3 @@
+[console_scripts]
+xppb=xppb.xppb:main
+