Dev1

.github/workflows/actions.yml

@@ -4,10 +4,10 @@ on:
   push:
     branches:
       - main
-    pull_request:
-      types: [opened, synchronize]
-      branches:
-        - main
+  pull_request:
+    types: [opened, synchronize]
+    branches:
+      - main
 
 jobs:
   build:

build_managed_app.py

@@ -0,0 +1,65 @@
+import os
+import sys
+import subprocess
+import shutil
+
+# Security constants must match the Hub/Publisher
+SALT = b"\x3c\x4f\x6d\x2a\x7a\x31\x5b\x44"
+SENTINEL = b"\x73\x65\x63\x75\x72\x65\x76\x65\x72" # "securever"
+
+def build_app(app_id, source_file, version):
+    print(f"--- Building {app_id} v{version} ---")
+
+    # 1. Use PyInstaller to create a single-file executable
+    try:
+        subprocess.check_call([
+            sys.executable, "-m", "PyInstaller",
+            "--onefile",
+            "--clean",
+            "--name", "app_temp",
+            source_file
+        ])
+    except subprocess.CalledProcessError as e:
+        print(f"PyInstaller failed: {e}")
+        return
+
+    # 2. Get the compiled binary path
+    ext = ".exe" if sys.platform == "win32" else ""
+    compiled_path = os.path.join("dist", f"app_temp{ext}")
+
+    # 3. Read the binary and append the Steganographic Footer
+    print("Injecting security footer...")
+    with open(compiled_path, "rb") as f:
+        binary_data = f.read()
+
+    # Pad version to 8 bytes and XOR obfuscate
+    ver_bytes = version.encode().ljust(8, b"\x00")
+    obfuscated = bytes([b ^ SALT[i % len(SALT)] for i, b in enumerate(ver_bytes)])
+
+    final_binary = binary_data + obfuscated + SENTINEL
+
+    # 4. Save to final destination
+    output_name = f"{app_id}_v{version}{ext}"
+    with open(output_name, "wb") as f:
+        f.write(final_binary)
+
+    # Cleanup
+    shutil.rmtree("build", ignore_errors=True)
+    shutil.rmtree("dist", ignore_errors=True)
+    if os.path.exists("app_temp.spec"): os.remove("app_temp.spec")
+
+    print(f"[SUCCESS] Compiled secure binary: {output_name}")
+    return output_name
+
+if __name__ == "__main__":
+    if not os.path.exists("managed_apps_sources/hello_app.py"):
+        print("Error: Source file not found.")
+        sys.exit(1)
+
+    # Install dependencies for pyinstaller if needed
+    # build_app("hello_world", "managed_apps_sources/hello_app.py", "1.0.0")
+    print("\nUSE THIS SCRIPT TO COMPILE REAL APPS:")
+    print("Example: python build_managed_app.py")
+
+    # Execute actual build for demonstration
+    build_app("hello_world", "managed_apps_sources/hello_app.py", "1.0.0")

client/anti_tamper.py

@@ -0,0 +1,29 @@
+import sys
+import os
+
+def check_environment():
+    """
+    Client Hardening: Proactive environment checks.
+    Detects if a debugger or analysis tool is attached to protect 
+    the application's memory and cryptographic keys.
+    """
+
+    # 1. Check for Python Debuggers (sys.gettrace)
+    if sys.gettrace() is not None:
+        _self_destruct("Debugger detected (sys.gettrace)")
+
+    # 2. Check for common analysis environment variables
+    analysis_vars = ["PYTHONINSPECT", "PYTHONDONTWRITEBYTECODE"]
+    for var in analysis_vars:
+        if var in os.environ:
+            # Note: Some IDEs use these, but in high-security production they are suspicious
+            pass 
+
+def _self_destruct(reason):
+    """
+    Gracefully terminates the application and logs the breach attempt.
+    """
+    print(f"\n[🛡️ SECURITY SHIELD] CRITICAL BREACH: {reason}")
+    print("Application memory is being protected. Session terminated.\n")
+    # Using os._exit to bypass standard exception handlers for immediate kill
+    os._exit(1)