How to protect my Python codebase so that guests cannot see certain modules, but how does it work?

Question

We are starting a new Python project with a few proprietary algorithms and sensitive bits of logic that we would like to keep confidential. We will also have several outsiders (select members of the public) working on the code. We cannot give third-party users access to small private bits of code, but we would like the open version to work well enough for them.

Let's say that our Foo project has a module barwith one function get_sauce(). What really happens in get_sauce()is secret, but we want the open version to get_sauce()return an acceptable, albeit incorrect, result.

We are also launching our own Subversion server, so we have full control over who can access them.

Symlinks

My first thought was a symbolic link - instead of bar.pyproviding it to bar_public.pyeveryone and bar_private.pyonly to internal developers. Unfortunately, creating symbolic links is tedious, manual work - especially when there are actually about two dozen of these private modules.

More importantly, it makes managing the authz Subversion file more difficult, because for each module that we want to protect the exception must be added to the server. Someone may forget to do this and accidentally check the secrets ... Then the module is in the repo, and we must rebuild the repository without it and hope that the outsider did not load it at this time.

Multiple repositories

, :

private
└── trunk/
    ├── __init__.py
    └── foo/
        ├── __init__.py
        └── bar.py
public
└── trunk/
    ├── __init__.py
    └── foo/
        ├── __init__.py
        ├── bar.py
        ├── baz.py
        └── quux.py

, private/, public/. PYTHONPATH=private/trunk:public/trunk, PYTHONPATH=public/trunk. , from foo import bar , ?

:

% PYTHONPATH=private/trunk:public/trunk python
Python 2.5.1
Type "help", "copyright", "credits" or "license" for more information.
>>> import foo.bar
>>> foo.bar.sauce()
'a private bar'
>>> import foo.quux
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
ImportError: No module named quux

Python, , Python foo :

>>> foo
<module 'foo' from '/path/to/private/trunk/foo/__init__.py'>

foo :

>>> import sys
>>> del foo
>>> del sys.modules['foo']
>>> import foo.quux
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
ImportError: No module named quux

?

Answer 1

__init__ foo __path__, .

, secret Subversion. secret bar.py. __init__.py foo :

__path__.insert(0,'secret')

, , secret bar.py foo.bar secret - . Python secret __path__ bar.py foo.

, :

   private
    └── trunk/
        └── secret/
            └── bar.py
    public
    └── trunk/
        ├── __init__.py
        └── foo/
            ├── __init__.py
            ├── bar.py
            ├── baz.py
            └── quux.py

Answer 2

- , , .

. . - , Zope, , setuptools entry_points ..

.

Answer 3

, Flask:

flaskext/__init__.py

- . , PyPI Python:

__import__('pkg_resources').declare_namespace(__name__)

If you want to know exactly what is going on there, check out the distribute or setuptools docs that explain how this works.