Describe the distribution honestly
List whether customers receive source files, wheels, a zip application, a frozen executable or native extension modules. Identify the runtime and platform assumptions of each component. A single downloadable executable can still contain resources or code that a user can inspect.
Do not treat removing .py files as proof that implementation details disappeared. CPython has documented bytecode analysis tools, and bytecode formats can differ between interpreter versions. A particular decompiler failing on one release is a compatibility observation about that tool, not a general protection claim.
Separate installation from secrecy
A zip application is fundamentally an executable ZIP arrangement with an entry point. It is useful for deployment, but not intended to conceal its contents. Freezing or compiling parts of an application changes the analysis work required without removing the need to distribute code for local execution.
Classify configuration values and credentials before packaging. Public service identifiers differ from application-wide privileged keys. A server credential copied into a module or binary extension remains a client-distributed credential. Use scoped user authentication and backend permission checks for operations that require service authority.
Preserve compatibility and dependency behavior
Build in a reproducible environment and test the installed artifact in a clean supported target. Exercise package resources, dynamic imports, plugin discovery and native extension loading. A development checkout can mask missing resources because the interpreter finds files outside the packaged output.
Check architecture and runtime requirements of native extensions separately from Python modules. If the product supports offline use, document its entitlement and update behavior without claiming that a local check is unmodifiable. Keep supported signatures or authenticated update mechanisms in the actual delivery workflow.
Screen, diagnose and record the release
Review the public artifact and adjacent downloads for environment files, credentials, tests containing private data and debug companions. Retain private diagnostic resources and avoid publishing full build directories just to make support easier. Set the audit scope to the customer artifact rather than a dependency-heavy source workspace.
CloneGuard uses Python as its own runtime but is not a Python code obfuscator or a universal frozen-executable unpacker. It performs bounded supported screening and reports opaque or unassessed surfaces. Read those coverage gaps instead of interpreting every successful outer-file hash as an inspection of its internals.
Create the receipt after packaging and any signing, and verify the exact retained release. Keep installer and application compatibility tests separate. The resulting evidence can establish exposure corrections and byte identity; it does not establish that REA cannot infer the program behavior or recreate its user-facing workflow.
Practical checklist
- List delivered formats, runtime and architecture requirements.
- Remove privileged shared credentials from clients.
- Test imports and resources outside the source checkout.
- Report opaque surfaces and verify final release bytes.
Sources and further reading
Primary references support the technical details. Procedures here are guidance; only explicitly recorded project results describe tests we ran.
Prepared with AI assistance. How this library is produced. Suggest a correction; keep private code and credentials out of public issues.