How do I protect my Python codebase so that guests can't see certain modules but so it still works?

Question

We\'re starting a new project in Python with a few proprietary algorithms and sensitive bits of logic that we\'d like to keep private. We also will have a few outsiders (sel

Answer 1

Use some sort of plugin system, and keep your plugins to your self, but also have publically available plugins that gets shipped with the open code.

Plugin systems abound. You can easily make dead simple ones yourself. If you want something more advanced I prefer the Zope Component Architecture, but there are also options like setuptools entry_points, etc.

Which one to use in your case would be a good second question.

Answer 2

In the __init__ method of the foo package you can change __path__ to make it look for its modules in other directories.

So create a directory called secret and put it in your private Subversion repository. In secret put your proprietary bar.py. In the __init__.py of the public foo package put in something like:

__path__.insert(0,'secret')

This will mean for users who have the private repository and so the secret directory they will get the proprietary bar.py as foo.bar as secret is the first directory in the search path. For other users, Python won't find secret and will look as the next directory in __path__ and so will load the normal bar.py from foo.

So it will look something like this:

   private
    └── trunk/
        └── secret/
            └── bar.py
    public
    └── trunk/
        ├── __init__.py
        └── foo/
            ├── __init__.py
            ├── bar.py
            ├── baz.py
            └── quux.py

Answer 3

Here's an alternate solution I noticed when reading the docs for Flask:

flaskext/__init__.py

The only purpose of this file is to mark the package as namespace package. This is required so that multiple modules from different PyPI packages can reside in the same Python package:

__import__('pkg_resources').declare_namespace(__name__)

If you want to know exactly what is happening there, checkout the distribute or setuptools docs which explain how this works.