Protecting Python Applications Using Script Envelope

Absolute path of the directory that contains the Python application to protect.

Absolute path of the directory where scriptenv.exe writes the protected Python application. You execute the application directly, with no additional manual steps.

(Optional) Parameter used to specify one or more entry scripts for your project.

The following terms are used in this section:

>Stub: A stub is a small piece of code generated to load the runtime libraries necessary to execute protected scripts. When a script file is protected, the stub is created as a separate file with the same name as the protected file.

>Prologue: When the script file is not protected, the stub code is inserted within the original script file itself and is called a prologue.

Script Envelope generates stub code to ensure that the runtime libraries load correctly. The behavior of stub generation depends on whether you specify the entry_scripts_glob parameter.

When entry_scripts_glob is specified:

>The tool generates runtime-loading stubs only for the listed entry scripts.

>The stub appears either as a prologue (if the entry script is not protected) or as a separate stub file (if the entry script is protected) with the same name as the entry script.

>If you run the protected application with a script that is not included in the entry_scripts_glob parameter, the runtime does not load and execution fails.

When entry_scripts_glob is not specified:

>The tool generates stub files for all scripts.

Usage Examples:

You can specify either a single entry script or multiple entry scripts depending on your project requirements. For example:

>Single Entry Script: Use this format when your project has only one entry script. The tool generates stub files only for the specified script.

entry_scripts_glob: main.py

>Multiple Entry Scripts: Use this format when your project has more than one entry script. The tool generates stub files only for each valid script you specify.

entry_scripts_glob:
  - file.py
  - file2.py

Considerations:

>To enable selective stub generation, entry_scripts_glob must include at least one valid .py file.

>Only files with the .py extension are valid in entry_scripts_glob. If any non-.py files are included, the system generates an error.

Parameter that contains one or more sets of sub-parameters input_glob and (optionally) ignore_glob and feature_id (described later). The sub-parameters in each set identify a subset of files in the application to be protected with a specific Feature ID. For example:

to_be_protected:
  - input_glob: "*.*"
    ignore_glob: moduleC.py
    feature_id: 4
  - input_glob: "CD/*.py"
    feature_id: 14
  - input_glob:
      - "EF/*.py"
      - "GH/*.py"

The parameters in the example protect:

> All files in the root folder (excluding moduleC.py) with Feature ID 4.

> All Python files in the CD folder with Feature ID 14.

> All Python files in the EF and GH folders by default with the global_feature_id.

Script Envelope creates runtime stub modules for .py files. The tool handles all other files as data files for use at run time.

The following files are copied from the input_root location to the output_root location with no change:

>Files that are not included in any input_glob parameter.

>Files included in an input_glob parameter but excluded using the ignore_glob parameter.

To protect model files:

>To apply model file protection for TensorFlow, the to_be_protected parameter must include the TensorFlow model files. For example:

  - input_glob: model.keras
    ignore_glob: ""
    feature_id: 0

>To apply model file protection for Pytorch, the to_be_protected parameter must include the Pytorch model files. For example:

  - input_glob: model.pt
    ignore_glob: ""
    feature_id: 0

Glob pattern that identifies the files under the input root to be protected by Envelope using the associated Feature ID (see feature_id). For example:

You can specify multiple patterns. For example:

For details, see https://docs.python.org/3/library/glob.html.

(Optional) Files to exclude from the input glob. For example:

"input_glob": "**/*.py"
"ignore_glob": fileA.py

This example indicates that Script Envelope recursively protects all .py files under the root folder, excluding fileA.py.

(Optional) Feature ID (in the range 0 - 65535) for the Python script (.py) files in the associated input_glob that you are protecting. If feature_id is not specified, the global Feature ID (see global_feature_id) is used.

If provided, the protected program searches for a Sentinel protection key according to the custom login scope that you specify.

For information on the syntax for login scope parameters, see the topic "Scope Input XML Tags" in Sentinel Licensing API C Reference. You can also paste a login scope that was created using Sentinel LDK ToolBox in this field.

Note: In YAML, double quotes inside double-quoted strings must be escaped with a backslash (\"). Alternatively, you can enclose the entire string in single quotes to avoid escaping the inner double quotes entirely:

custom_scope: '<haspscope><hasp type="HASP-HL" /></haspscope>'

(Optional) Global Feature ID (in the range 0 - 65535) for the complete application that you are protecting. This Feature ID is also applied by default for any input_glob (under to_be_protected) for which a corresponding feature_id is not specified.

Default: 0

(Optional) Specify a time interval (in seconds) of 0-65535 for periodic background checks for a Sentinel protection key with the required licenses. Default: 300 seconds.

If you specify a value of 0, a periodic background check is not performed.

Regardless of the setting for this parameter, the License Manager checks for the required license when the application is started.

(Optional) Specifies how runtime user messages are delivered. Available output modes are:

>windows – If assigned the value true, displays messages in a message box.

>stderr – If assigned the value true, writes messages to the console.

Default: If no output modes are specified, windows mode is set to true and stderr mode is set to false.

The relative or absolute path and name for the project file that you prepared earlier.