Protecting Python Applications
You can protect Python applications using Sentinel LDK Script Envelope on Windows or Linux machines. Through built-in automation, Script Envelope provides the simplest and preferred method for applying Sentinel Envelope protection to your applications.
Sentinel LDK Script Envelope protects Python applications so that you can distribute software without exposing proprietary source code. Script Envelope provides the following protection capabilities:
•Encryption (Classic): Encrypts each Python file as a whole. The runtime decrypts code into memory on demand. Encryption (Classic) also protects non-Python data files and machine learning models. This protection method is included with Sentinel LDK Script Envelope.
•Native Compilation: Compiles Python source code into native machine-code extension modules (.pyd on Windows and .so on Linux). The resulting modules contain machine code instead of Python bytecode. This protection method is included with Sentinel LDK Script Envelope.
•Machine Code Hardening: Applies configurable obfuscation, anti-tamper, and anti-trace protection to natively compiled machine code. Machine Code Hardening requires the Script Envelope Plus add-on.
You can select Encryption (Classic) or Native Compilation for each group of files and combine both protection methods within the same project.
Script Envelope also protects application start scripts. Because Python requires an application to start with a Python script rather than a native compiled module, Script Envelope creates a Python stub script when you mark a start script for protection. This stub script loads and executes the native compiled start script.
NOTE Encryption (Classic) and Native Compilation are available in Script Envelope. Machine Code Hardening requires the Script Envelope Plus entitlement (Feature 302 on the developer key connected to the build machine). For current packaging and licensing details, see the
Sentinel LDK Script Envelope provides automated native compilation for Python and typed Cython scripts (.py and .pyx files). The automated workflow translates source code to C, compiles the generated code into native machine-code binaries (.pyd on Windows and .so on Linux), and binds each protected module to a Sentinel LDK Feature ID without requiring a local Microsoft Visual Studio or CPython installation on the vendor machine.
Script Envelope Plus is an add-on that extends Script Envelope with Machine Code Hardening for natively compiled modules. Script Envelope Plus applies configurable protection mechanisms (obfuscation, anti-tamper, and anti-trace) directly to the compiled machine code.
You can configure general protection settings in the Script Envelope project file (.sprjx, in YAML format) at the project and file-group levels. Script Envelope Plus also supports more granular Machine Code Hardening settings for modules and functions. For details, see Protecting Python Applications Using Script Envelope.
The following table lists the capabilities available in Script Envelope and the capabilities that require the Script Envelope Plus entitlement (Feature 302):
| Included with Script Envelope | Script Envelope Plus (Feature 302) |
|---|---|
|
>Bytecode encryption of Python scripts and data files >Module and package folder name obfuscation (Encryption method) >Native compilation of >Docstring stripping in natively compiled modules >Traceback frame information stripping in natively compiled modules >Module bundling ( >Multi-architecture packaging ( >Per-unit licensing via Feature ID >Customizable runtime error messages and multi-language fallback >Customizable startup and runtime licensing failure policies |
>Instruction and control-flow obfuscation of compiled code >Anti-tamper binary integrity checking >Anti-trace debugger and tracer detection >Granular protection levels via the |