Repository navigation
Feature/protected resources - #2
Conversation
- Bump version to 1.0.0a2 in pyproject.toml. - Introduce resource protection feature in the freezing process: - Add support for protected settings and resources in FreezeManifest. - Implement logic to skip copying plain resources when protection is enabled. - Embed protected resources and runtime secret module in the build command. - Create a package for protected resources with encryption. - Add tests to verify the functionality of resource protection.
- Added support for a new configuration file, sign.json, to store signing credentials separately from secrets.json. - Updated FrameworkHookResolver to exclude sign.json from processing. - Enhanced PyInstallerFreezer to handle sign.json and validate its contents. - Modified CompiledAppSigner to reference sign.json for signing credentials. - Updated SettingsRepository to ensure signing keys are not loaded from secrets.json. - Added tests to verify the correct handling of sign.json and its integration with the build process. - Documented the new sign.json configuration in the project documentation.
There was a problem hiding this comment.
Copilot review overview
🔵 Needs a closer look
It introduces custom cryptographic packaging, cleartext-secret-on-disk handling, mandatory secrets.json builds, and a dependency-driven buildozer downgrade that warrant human security and operational review.
Review effort: Balanced
Findings: 1
Open (3)
What changed in this PR
This PR adds a "protected resources" feature to the Qyro CLI freeze pipeline. During qyro build, project settings/ and resources/ can be encrypted into a single .qyro/protected_resources.pak package, while settings/secrets.json is always encrypted (AES-256-GCM) and embedded as .qyro/secrets.enc. A per-build runtime secret is compiled into a native module via Cython so no plaintext secret ships as .py. It also introduces a dedicated local-only settings/sign.json profile for signing/notarization (kept out of frozen apps and rejected from secrets.json), splits the version command into CLI vs Engine versions, and adds a full configuration reference doc.
Changes:
- New AES-256-GCM secrets crypto module plus a homemade package cipher, Cython-compiled runtime-secret module, and PyInstaller wiring to embed protected packages.
- Separation of signing config into
settings/sign.json(loaded only byqyro sign; stripped/rejected fromsecrets.json), with updated hints and extensive README/docs. qyro versionnow reports CLI and Engine versions separately; addscryptography/cythondependencies (which forced abuildozerdowngrade in the lock).
| File | Description |
|---|---|
| qyro_cli/adapters/freeze/secrets_crypto.py | New AES-256-GCM encrypt/decrypt with versioned header; correct. |
| qyro_cli/adapters/freeze/pyinstaller_adapter.py | Protected package building; secret-leak-on-error, duplicate condition, duplicated key set. |
| qyro_cli/adapters/freeze/framework_hooks.py | Skips plain assets under protection and excludes secrets/sign files. |
| qyro_cli/adapters/persistence/storage.py | Strips signing keys from secrets.json; new SIGNING_SETTING_KEYS. |
| qyro_cli/adapters/package/metadata.py | Adds cli_version/engine_version; qyro_version delegates to CLI. |
| qyro_cli/adapters/package/compiled_app_signer.py | Error hints now point to settings/sign.json. |
| qyro_cli/application/use_cases/version.py, ports.py | Dual version output and new port methods. |
| qyro_cli/application/use_cases/sign.py | Activates release then sign profile. |
| qyro_cli/application/use_cases/freeze.py, domain/build.py | Loads/propagates resource-protection manifest fields. |
| qyro_cli/adapters/cli/console_ui.py | Disables Rich auto-highlight. |
| pyproject.toml, poetry.lock | Adds cryptography/cython; buildozer downgraded 1.6.0→1.5.0. |
| README.md, docs/configuration.md | Documents protection, sign.json, secrets handling. |
| tests/** | Updates and adds coverage for crypto, hooks, settings, version, metadata. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
…d improve error handling in runtime secret module generation
There was a problem hiding this comment.
Copilot review overview
🔵 Needs a closer look
It introduces security-sensitive encryption, a new mandatory Cython/C-compiler + secrets.json requirement for all desktop builds, and a dependency-resolution change that downgrades the mobile buildozer, all of which warrant human review.
Review effort: Balanced
Findings: 1
Open (1)
| desktop = [ | ||
| "pyinstaller>=6.22.3,<7.0.0", | ||
| "pillow>=11.0.0,<13.0.0", | ||
| "cython>=3.0.12,<4.0.0", |
There was a problem hiding this comment.
Removed the forced cython pin from the desktop extra so the mobile extra no longer resolves a conflicting Cython version. The runtime-secret compilation still relies on Cython when available in the environment, without downgrading buildozer.
No description provided.