Skip to main content

Deploying

A protected distribution is self-contained: it bundles the native runtime and runs in place. Deploying it is mostly a matter of shipping the ./dist mirror instead of your source — plus deciding how the build key reaches the target.

What to ship​

Ship the entire ./dist tree, including the __obfy__/ directory (encrypted payloads + bundled runtime) and every copied non-Python file. The target needs a matching CPython version (3.10–3.13, the same one you built with); it does not need Obfy installed — the runtime is bundled into the dist.

Decide how the key reaches the target​

You have two options:

  1. Ship the key with the dist. Simplest: leave code.key in ./dist. The dist runs with no extra configuration. The key travels with the code, so this is lower protection.

  2. Supply the key out-of-band. Delete code.key from the dist and provide it at run time via the OBFY_KEY environment variable (hex). The shipped artifact contains no key.

    OBFY_KEY=<hex-key> python ./dist/run.py

See Keys and licensing for details.

Bind the build to its target​

For distributed software, bake a license file into the build to bind it to an expiry date or specific machines/hostnames/disks. The runtime enforces these locally at import time, with no network calls — suitable for air-gapped targets.

Packaging into an installer or image​

The dist drops into your existing packaging step unchanged:

  • PyInstaller — point the spec at dist/run.py.
  • Docker — copy the mirror into the image.

Checklist​

  • Built with the same CPython version as the target.
  • Shipped the whole ./dist tree, including __obfy__/.
  • Decided key delivery: bundled code.key or OBFY_KEY out-of-band.
  • code.key is not in version control.
  • Added a license file if binding to expiry/hardware.
  • Verified the dist runs on a clean target: python ./dist/run.py.