Obscuring Python source from end users

[Steven D'Aprano]

norman.ives at gmail.com wrote:

> Hello list
> 
> Python 3.4 applies.
> 
> I have a project that involves distributing Python code to users in an
> organisation. Users do not interact directly with the Python code; they
> only know this project as an Excel add-in.
> 
> Now, internal audit takes exception in some cases if users are able to see
> the source code.

You have my sympathy.


> So I'm wondering if anyone has clever suggestions in this regard...

Yes. Distribute the pyc files only. That is the canonical Python answer to
the problem of not distributing source code. You may need a tiny "driver"
script (or perhaps not), if you do it will be something as minor as:

import module_where_all_the_work_is_really_done as module
module.main()

depending on how the Excel add-in system works.

> My current plan is to modify the bdist_wheel setuptools extension so that
> it can produce distributions with only the .pyc files, laid out so that
> they will be importable in the normal way. This will be sufficient to
> satisfy internal audit, and will not negatively impact our users.

Sounds good to me. Do you know about the compileall.py script/module in the
standard library?


> However there are obvious downsides, including the overhead of maintaining
> separate wheels for different architectures and (in the future) Python
> versions. Not to mention that this plan seems to go against the grain of
> how Python wants to use byte code files...

Well, yes, it does go against the grain, but byte-code only distributions
are officially supported. Occasionally people have made requests to
simplify the import system by dropping support for .pyc only imports, but
Python's creator Guido van Rossum has made it clear that as alien as such a
thing is to the open source community, Python is going to allow it.

Another possibility is to distribute your modules inside a zip file. See
here:

https://mail.python.org/pipermail/python-list/2014-July/675506.html

Such zip files are not just runnable, but also importable. Depending on your
Excel requirements, you might need a tiny driver script as above.


-- 
Steven