SitrTech — Python Source Code Encryption & Licensing

Ship your Odoo, Django, Flask, FastAPI, or Tornado project as encrypted Python that runs at native speed — while your source stays unreadable, license-locked, and optionally bound to a machine, network, or time window. One command, in your CI or on your laptop.

pipx install sitrtech        # recommended for CLI tools
sitr encrypt my_module.zip --framework odoo --secret sk-...

Why SitrTech

• Real encryption, not obfuscation. Every .py becomes a .pye sealed with AES-256-GCM under a per-file key. There is no de-obfuscator to reverse — without the key, the bytes are ciphertext.
• A compiled native loader does the unwrapping. Decryption keys live only inside a compiled C extension, never in readable Python. The master secret is never present in this package or on your machine.
• Zero runtime tax. Modules are decrypted once at import time, then execute as normal CPython bytecode. No per-call overhead.
• License binding built in. Lock code to an expiry date, start date, IP/CIDR, MAC, machine ID, hostname, disk serial, Odoo database, or domain — combinable with AND logic, enforced at import.
• Local mode. Encrypt entirely on your own machine: your source is never uploaded. Only signed, tamper-proof line counts are exchanged for metering.
• Built for CI. Incremental, parallel batch encryption of hundreds of modules, plus an offline mode for air-gapped or maintenance windows.

Installation

# pipx — best for CLI tools; isolated, works on Ubuntu/Debian/macOS without conflicts
pipx install sitrtech
pipx upgrade sitrtech

# pip — standard package manager
pip install sitrtech            # latest stable
pip install --upgrade sitrtech
pip install "sitrtech==1.3.1"   # pin a version

Ubuntu / Debian: if you hit externally-managed-environment, use pipx install sitrtech.

Compatibility

The right native loader for the deployment machine is selected automatically — no manual setup on your servers.

Quick start

Get an API secret key from sitrtech.com/api-keys, then export it once:

export SITR_SECRET=sk-your-key-here

# Encrypt an Odoo addon
sitr encrypt hr_module.zip --framework odoo

# Encrypt a Django project, expiring end of 2026, limited to one network
sitr encrypt backend.zip -f django --expiry 2026-12-31 --network 10.0.0.0/24

# Encrypt on your own machine — source never leaves it
sitr encrypt api.zip -f fastapi --local

# Check your token balance
sitr balance

Commands

Run sitr <command> --help for full options.

sitr encrypt

sitr encrypt <FILE.zip> [OPTIONS]

  -f, --framework TEXT   odoo | django | flask | fastapi | tornado   [default: odoo]
  -v, --version TEXT     Framework version (e.g. 17.0 for Odoo)
  -o, --output PATH      Output file  [default: <input>_encrypted.zip]
      --local            Encrypt locally — source is never uploaded
  -s, --secret TEXT      API secret key            [env: SITR_SECRET]
  -b, --base URL         Override API base URL      [env: SITR_BASE]

  Binding (all optional, combinable):
  -e, --expiry DATE       stop working after this date/time
      --start DATE        not valid before this date/time
  -n, --network CIDR      allowed IP / CIDR / range        (repeatable)
      --mac MAC           allowed MAC address              (repeatable)
      --machine-id ID     machine fingerprint              (repeatable)
      --hostname HOST     allowed hostname                 (repeatable)
      --disk-serial SN    allowed disk / volume serial     (repeatable)
      --odoo-db DB        allowed Odoo database name       (repeatable)
      --domain DOMAIN     allowed domain / base URL        (repeatable)

sitr encrypt-dir — batch, incremental, parallel

Built for teams shipping dozens of modules across many projects, daily. No manual zipping; source never leaves your machine; only changed modules are re-encrypted each run (state tracked in <output>/.sitr_state.json).

# Encrypt every Odoo module under ./addons — locally, in parallel, incrementally
sitr encrypt-dir ./addons --framework odoo

# With binding + expiry, into a custom output directory
sitr encrypt-dir ./addons -f odoo -o ./dist \
  --expiry 2026-12-31 --network 10.0.0.0/24 --mac 00:1a:2b:3c:4d:5e

sitr encrypt-dir ./addons --full        # force a full re-encryption

Local mode — your source never leaves your machine

Add --local to encrypt entirely on your own hardware. Your code is read, encrypted, and written on the spot; the platform only ever sees what it needs to meter usage.

sitr encrypt my_addon.zip --framework odoo --local

How it stays honest without seeing your code

1. Authorize — the CLI reserves tokens and receives a signed, one-time job key.
2. Encrypt locally — every file is sealed with AES-256-GCM using that key.
3. Attest & commit — the compiled loader (the only local component that can) signs a proof of the actual line count over the encrypted output. The platform verifies that signature before charging, so counts can be neither over- nor under-reported.

No valid authorization ⇒ nothing is encrypted. The master secret is never on your machine.

Binding & protection

Lock encrypted code to a place, machine, or time window. Rules combine with AND — every rule present must pass at import time. Works in both normal and --local modes.

# Bind to one machine + network, expiring end of 2026
sitr encrypt hr_module.zip -f odoo --local \
  --expiry 2026-12-31 \
  --network 10.0.0.0/24 \
  --mac 00:1a:2b:3c:4d:5e \
  --machine-id "$(cat /etc/machine-id)"

Offline mode

Pre-authorize work so encryption keeps running when the platform is unreachable (maintenance, air-gapped build hosts). Quota is reserved up front and reconciled later.

sitr offline fetch --quota 200000 --days 14   # pre-authorize while online
sitr encrypt-dir ./addons -f odoo             # ...later, encrypt with no connectivity
sitr offline sync                             # reconcile real usage once back online
sitr offline status                           # show the cached grant and remaining quota

Project structure

Always zip the root folder — not its contents:

# Correct ✓
zip -r my_addon.zip my_addon/

# Wrong ✗
cd my_addon && zip -r ../my_addon.zip .

CI/CD

GitHub Actions — daily encryption of all modules

name: Encrypt & deploy addons
on:
  schedule: [{ cron: "0 2 * * *" }]   # daily at 02:00
  workflow_dispatch:
jobs:
  encrypt:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with: { python-version: "3.12" }
      # cache incremental state so only changed modules re-encrypt
      - uses: actions/cache@v4
        with: { path: dist/.sitr_state.json, key: sitr-state-${{ github.ref }} }
      - run: pipx install sitrtech
      - name: Encrypt all modules (source never leaves the runner)
        env: { SITR_SECRET: ${{ secrets.SITR_SECRET }} }
        run: sitr encrypt-dir ./addons -f odoo -o ./dist --expiry 2026-12-31
      - name: Deploy encrypted modules
        run: rsync -az ./dist/ user@server:/opt/odoo/addons/

GitLab CI

encrypt:
  image: python:3.12
  cache: { paths: [dist/.sitr_state.json] }
  variables: { SITR_SECRET: $SITR_SECRET }
  script:
    - pip install sitrtech
    - sitr encrypt-dir ./addons -f odoo -o ./dist

Docker one-liner

docker run --rm -e SITR_SECRET -v "$PWD/addons:/src:ro" -v "$PWD/dist:/out" \
  python:3.12-slim sh -c "pip install -q sitrtech && sitr encrypt-dir /src -f odoo -o /out"

Environment variables

How it works

1. Per-file sealing. Each source file is encrypted with a fresh AES-256-GCM key; that file key is itself wrapped under a one-time, per-job key.
2. Native loader. A compiled C extension is placed alongside your code. At import it unwraps the job key and decrypts modules in memory — key material never exists as readable Python, and the platform master secret is never distributed.
3. License gate. If you set any binding, the loader validates every rule (expiry, start, network, MAC, machine ID, hostname, disk serial, Odoo DB, domain) before a module runs.
4. Metered fairly. Billing is per line of code. In local mode the loader cryptographically attests the real line count, so metering is trustworthy without the platform ever seeing your source.

Links

• Documentation — https://sitrtech.com/docs
• API keys — https://sitrtech.com/api-keys
• Support — https://sitrtech.com/support · info@sitrtech.com

© SitrTech. Proprietary. All rights reserved.