Metadata-Version: 2.4
Name: sitrtech
Version: 1.3.1
Summary: Encrypt & license-lock Python source (Odoo, Django, Flask, FastAPI, Tornado) with AES-256 and a native runtime loader
Author-email: SitrTech <info@sitrtech.com>
License: Proprietary
Project-URL: Homepage, https://sitrtech.com
Project-URL: Docs, https://sitrtech.com/docs
Project-URL: Repository, https://sitrtech.com
Project-URL: Bug Tracker, https://sitrtech.com/support
Keywords: odoo,django,flask,fastapi,tornado,encryption,aes-256,licensing,license-key,code-protection,source-protection,obfuscation,anti-reverse-engineering,intellectual-property
Classifier: Development Status :: 5 - Production/Stable
Classifier: Environment :: Console
Classifier: Intended Audience :: Developers
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.8
Classifier: Programming Language :: Python :: 3.9
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Programming Language :: Python :: 3.14
Classifier: Topic :: Security :: Cryptography
Classifier: Topic :: Software Development :: Build Tools
Requires-Python: >=3.8
Description-Content-Type: text/markdown
Requires-Dist: requests>=2.31
Requires-Dist: rich>=13
Requires-Dist: click>=8
Requires-Dist: cryptography>=41

# SitrTech — Python Source Code Encryption & Licensing

[![PyPI](https://img.shields.io/pypi/v/sitrtech.svg)](https://pypi.org/project/sitrtech/)
[![Python](https://img.shields.io/badge/CLI-Python%203.8%2B-blue.svg)](https://pypi.org/project/sitrtech/)
[![Runtime](https://img.shields.io/badge/runtime-Python%203.7%E2%80%933.14-blue.svg)](https://sitrtech.com/docs)
[![Platforms](https://img.shields.io/badge/platforms-Linux%20%C2%B7%20macOS%20%C2%B7%20Windows-lightgrey.svg)](https://sitrtech.com/docs)

Ship your **Odoo, Django, Flask, FastAPI, or Tornado** project as encrypted Python
that runs at native speed — while your source stays unreadable, license-locked, and
optionally bound to a machine, network, or time window. One command, in your CI or on
your laptop.

```bash
pipx install sitrtech        # recommended for CLI tools
sitr encrypt my_module.zip --framework odoo --secret sk-...
```

---

## Why SitrTech

- **Real encryption, not obfuscation.** Every `.py` becomes a `.pye` sealed with
  **AES-256-GCM** under a per-file key. There is no de-obfuscator to reverse — without
  the key, the bytes are ciphertext.
- **A compiled native loader does the unwrapping.** Decryption keys live only inside a
  compiled C extension, never in readable Python. The master secret is **never** present
  in this package or on your machine.
- **Zero runtime tax.** Modules are decrypted once at import time, then execute as normal
  CPython bytecode. No per-call overhead.
- **License binding built in.** Lock code to an expiry date, start date, IP/CIDR, MAC,
  machine ID, hostname, disk serial, Odoo database, or domain — combinable with AND logic,
  enforced at import.
- **Local mode.** Encrypt entirely on your own machine: your source is **never uploaded**.
  Only signed, tamper-proof line counts are exchanged for metering.
- **Built for CI.** Incremental, parallel batch encryption of hundreds of modules, plus an
  offline mode for air-gapped or maintenance windows.

---

## Installation

```bash
# pipx — best for CLI tools; isolated, works on Ubuntu/Debian/macOS without conflicts
pipx install sitrtech
pipx upgrade sitrtech

# pip — standard package manager
pip install sitrtech            # latest stable
pip install --upgrade sitrtech
pip install "sitrtech==1.3.1"   # pin a version
```

> **Ubuntu / Debian:** if you hit `externally-managed-environment`, use
> `pipx install sitrtech`.

**Compatibility**

| Component | Supported |
|-----------|-----------|
| **CLI** (this package) | Python **3.8 – 3.14** · Linux, macOS, Windows |
| **Encrypted runtime** (where your protected app runs) | Python **3.7 – 3.14** · Linux (manylinux/musllinux, x86-64 & aarch64), macOS (Intel & Apple Silicon), Windows (x64/x86) |

The right native loader for the deployment machine is selected automatically — no manual
setup on your servers.

---

## Quick start

Get an API secret key from **[sitrtech.com/api-keys](https://sitrtech.com/api-keys)**,
then export it once:

```bash
export SITR_SECRET=sk-your-key-here
```

```bash
# Encrypt an Odoo addon
sitr encrypt hr_module.zip --framework odoo

# Encrypt a Django project, expiring end of 2026, limited to one network
sitr encrypt backend.zip -f django --expiry 2026-12-31 --network 10.0.0.0/24

# Encrypt on your own machine — source never leaves it
sitr encrypt api.zip -f fastapi --local

# Check your token balance
sitr balance
```

---

## Commands

| Command | Purpose |
|---------|---------|
| `sitr encrypt <FILE.zip>` | Encrypt one zipped project |
| `sitr encrypt-dir <DIR>` | Encrypt many modules — incremental, parallel |
| `sitr offline fetch \| sync \| status` | Work without live platform access |
| `sitr balance` | Show tokens, plan, and per-line rate |
| `sitr info` | List frameworks and required project layout |
| `sitr version` | Print the CLI version |

Run `sitr <command> --help` for full options.

### `sitr encrypt`

```
sitr encrypt <FILE.zip> [OPTIONS]

  -f, --framework TEXT   odoo | django | flask | fastapi | tornado   [default: odoo]
  -v, --version TEXT     Framework version (e.g. 17.0 for Odoo)
  -o, --output PATH      Output file  [default: <input>_encrypted.zip]
      --local            Encrypt locally — source is never uploaded
  -s, --secret TEXT      API secret key            [env: SITR_SECRET]
  -b, --base URL         Override API base URL      [env: SITR_BASE]

  Binding (all optional, combinable):
  -e, --expiry DATE       stop working after this date/time
      --start DATE        not valid before this date/time
  -n, --network CIDR      allowed IP / CIDR / range        (repeatable)
      --mac MAC           allowed MAC address              (repeatable)
      --machine-id ID     machine fingerprint              (repeatable)
      --hostname HOST     allowed hostname                 (repeatable)
      --disk-serial SN    allowed disk / volume serial     (repeatable)
      --odoo-db DB        allowed Odoo database name       (repeatable)
      --domain DOMAIN     allowed domain / base URL        (repeatable)
```

### `sitr encrypt-dir` — batch, incremental, parallel

Built for teams shipping **dozens of modules across many projects, daily**. No manual
zipping; source never leaves your machine; only **changed** modules are re-encrypted each
run (state tracked in `<output>/.sitr_state.json`).

```bash
# Encrypt every Odoo module under ./addons — locally, in parallel, incrementally
sitr encrypt-dir ./addons --framework odoo

# With binding + expiry, into a custom output directory
sitr encrypt-dir ./addons -f odoo -o ./dist \
  --expiry 2026-12-31 --network 10.0.0.0/24 --mac 00:1a:2b:3c:4d:5e

sitr encrypt-dir ./addons --full        # force a full re-encryption
```

| Option | Meaning |
|--------|---------|
| `-o, --output DIR` | output directory (default `<source>_encrypted`) |
| `-j, --jobs N` | parallel workers (default: CPU count) |
| `--full` | ignore incremental state; re-encrypt everything |
| *all binding flags* | `--expiry --start --network --mac --machine-id --hostname --disk-serial --odoo-db --domain` |

---

## Local mode — your source never leaves your machine

Add `--local` to encrypt entirely on your own hardware. Your code is read, encrypted, and
written **on the spot**; the platform only ever sees what it needs to meter usage.

```bash
sitr encrypt my_addon.zip --framework odoo --local
```

**How it stays honest without seeing your code**

1. **Authorize** — the CLI reserves tokens and receives a signed, one-time job key.
2. **Encrypt locally** — every file is sealed with AES-256-GCM using that key.
3. **Attest & commit** — the compiled loader (the only local component that can) signs a
   proof of the **actual line count** over the encrypted output. The platform verifies that
   signature before charging, so counts can be neither over- nor under-reported.

No valid authorization ⇒ nothing is encrypted. The master secret is never on your machine.

---

## Binding & protection

Lock encrypted code to a place, machine, or time window. Rules combine with **AND** — every
rule present must pass at import time. Works in both normal and `--local` modes.

| Option | Binds the code to… |
|--------|--------------------|
| `-e, --expiry DATE` | stops working after this date/time |
| `--start DATE` | not valid before this date/time |
| `-n, --network CIDR` | allowed IPs / CIDR / ranges |
| `--mac MAC` | allowed MAC address(es) |
| `--machine-id ID` | machine fingerprint (Linux `machine-id` / Windows `MachineGuid`) |
| `--hostname HOST` | allowed hostname(s) |
| `--disk-serial SN` | allowed disk / volume serial(s) |
| `--odoo-db DB` | allowed Odoo database name(s) |
| `--domain DOMAIN` | allowed domain / base URL(s) |

```bash
# Bind to one machine + network, expiring end of 2026
sitr encrypt hr_module.zip -f odoo --local \
  --expiry 2026-12-31 \
  --network 10.0.0.0/24 \
  --mac 00:1a:2b:3c:4d:5e \
  --machine-id "$(cat /etc/machine-id)"
```

---

## Offline mode

Pre-authorize work so encryption keeps running when the platform is unreachable
(maintenance, air-gapped build hosts). Quota is reserved up front and reconciled later.

```bash
sitr offline fetch --quota 200000 --days 14   # pre-authorize while online
sitr encrypt-dir ./addons -f odoo             # ...later, encrypt with no connectivity
sitr offline sync                             # reconcile real usage once back online
sitr offline status                           # show the cached grant and remaining quota
```

---

## Project structure

| Framework | Required entry-point file |
|-----------|---------------------------|
| Odoo | `__manifest__.py` |
| Django | `manage.py` |
| Flask | `app.py` or `wsgi.py` |
| FastAPI | `main.py` or `asgi.py` |
| Tornado | `main.py` or `server.py` |

**Always zip the root folder — not its contents:**

```bash
# Correct ✓
zip -r my_addon.zip my_addon/

# Wrong ✗
cd my_addon && zip -r ../my_addon.zip .
```

---

## CI/CD

### GitHub Actions — daily encryption of all modules

```yaml
name: Encrypt & deploy addons
on:
  schedule: [{ cron: "0 2 * * *" }]   # daily at 02:00
  workflow_dispatch:
jobs:
  encrypt:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with: { python-version: "3.12" }
      # cache incremental state so only changed modules re-encrypt
      - uses: actions/cache@v4
        with: { path: dist/.sitr_state.json, key: sitr-state-${{ github.ref }} }
      - run: pipx install sitrtech
      - name: Encrypt all modules (source never leaves the runner)
        env: { SITR_SECRET: ${{ secrets.SITR_SECRET }} }
        run: sitr encrypt-dir ./addons -f odoo -o ./dist --expiry 2026-12-31
      - name: Deploy encrypted modules
        run: rsync -az ./dist/ user@server:/opt/odoo/addons/
```

### GitLab CI

```yaml
encrypt:
  image: python:3.12
  cache: { paths: [dist/.sitr_state.json] }
  variables: { SITR_SECRET: $SITR_SECRET }
  script:
    - pip install sitrtech
    - sitr encrypt-dir ./addons -f odoo -o ./dist
```

### Docker one-liner

```bash
docker run --rm -e SITR_SECRET -v "$PWD/addons:/src:ro" -v "$PWD/dist:/out" \
  python:3.12-slim sh -c "pip install -q sitrtech && sitr encrypt-dir /src -f odoo -o /out"
```

---

## Environment variables

| Variable | Description |
|----------|-------------|
| `SITR_SECRET` | API secret key (so you don't pass `--secret` each time) |
| `SITR_BASE` | Override the API base URL (default: `https://sitrtech.com`) |

---

## How it works

1. **Per-file sealing.** Each source file is encrypted with a fresh AES-256-GCM key; that
   file key is itself wrapped under a one-time, per-job key.
2. **Native loader.** A compiled C extension is placed alongside your code. At import it
   unwraps the job key and decrypts modules in memory — key material never exists as
   readable Python, and the platform master secret is never distributed.
3. **License gate.** If you set any binding, the loader validates every rule (expiry, start,
   network, MAC, machine ID, hostname, disk serial, Odoo DB, domain) before a module runs.
4. **Metered fairly.** Billing is per line of code. In local mode the loader
   **cryptographically attests** the real line count, so metering is trustworthy without the
   platform ever seeing your source.

---

## Links

- **Documentation** — <https://sitrtech.com/docs>
- **API keys** — <https://sitrtech.com/api-keys>
- **Support** — <https://sitrtech.com/support> · info@sitrtech.com

© SitrTech. Proprietary. All rights reserved.
