python 我将如何打包和销售 Django 应用程序？

How would I package and sell a Django app?

提问by Josh Hunt

Currently I am hosting a Django app I developed myself for my clients, but I am now starting to look at selling it to people for them to host themselves.

目前我正在托管一个我为客户自己开发的 Django 应用程序，但我现在开始考虑将它出售给人们让他们自己托管。

My question is this: How can I package up and sell a Django app, while protecting its code from pirating or theft? Distributing a bunch of .py files doesn't sound like a good idea as the people I sell it to too could just make copies of them and pass them on.

我的问题是：如何打包和销售 Django 应用程序，同时保护其代码免遭盗版或盗窃？分发一堆 .py 文件听起来不是一个好主意，因为我卖给它的人也可以制作它们的副本并传递它们。

I think for the purpose of this problem it would be safe to assume that everyone who buys this would be running the same (LAMP) setup.

我认为就这个问题而言，可以安全地假设购买此产品的每个人都将运行相同的 (LAMP) 设置。

回答by dbr

Don't try and obfuscate or encrypt the code - it will never work.

不要试图混淆或加密代码 - 它永远不会工作。

I would suggest selling the Django application "as a service" - either host it for them, or sell them the code and support. Write up a contract that forbids them from redistributing it.

我建议将 Django 应用程序“作为服务”出售——要么为他们托管它，要么向他们出售代码和支持。写一份合同，禁止他们重新分发它。

That said, if you were determined to obfuscate the code in some way - you can distribute python applications entirely as .pyc (Python compiled byte-code).. It's how Py2App works.

也就是说，如果您决定以某种方式混淆代码 - 您可以完全以 .pyc（Python 编译的字节码）的形式分发 Python 应用程序。这就是 Py2App 的工作原理。

It will still be re-distributable, butit will be very difficult to edit the files - so you could add some basic licensing stuff, and not have it foiled by a few #s..

它仍然可以重新分发，但编辑文件将非常困难 - 因此您可以添加一些基本的许可内容，而不会被几#秒钟所挫败。

As I said, I don't think you'll succeed in anti-piracy via encryption or obfuscation etc.. Depending on your clients, a simple contract, and maybe some really basic checks will go a long much further than some complicated decryption system (And make the experience of using your application better, instead of hopefully not any worse)

正如我所说，我认为您不会通过加密或混淆等方式在反盗版方面取得成功。取决于您的客户，一个简单的合同，也许一些非常基本的检查将比一些复杂的解密系统走得更远（并使使用您的应用程序的体验更好，而不是希望不会变得更糟）

回答by Cody Brocious

The way I'd go about it is this:

我的做法是这样的：

1. Encrypt all of the code
2. Write an installer that contacts the server with the machine's hostname and license file and gets the decryption key, then decrypts the code and compiles it to python bytecode
3. Add (in the installer) a module that checks the machine's hostname and license file on import and dies if it doesn't match

1. 加密所有代码
2. 编写一个安装程序，用机器的主机名和许可证文件联系服务器并获取解密密钥，然后解密代码并将其编译为python字节码
3. 添加（在安装程序中）一个模块，该模块在导入时检查机器的主机名和许可证文件，如果不匹配则终止

This way the user only has to contact the server when the hostname changes and on first install, but you get a small layer of security. You could change the hostname to something more complex, but there's really no need -- anyone that wants to pirate this will do so, but a simple mechanism like that will keep honest people honest.

通过这种方式，用户只需在主机名更改和首次安装时联系服务器，但您可以获得一小层安全性。您可以将主机名更改为更复杂的名称，但实际上没有必要——任何想要盗版的人都会这样做，但这样的简单机制将使诚实的人保持诚实。

回答by Mike

You could package the whole thing up as an Amazon Machine Instance (AMI), and then have them run your app on Amazon EC2. The nice thing about this solution is that Amazon will take care of billing for you, and since you're distributing the entire machine image, you can be certain that all your clients are using the same LAMP stack. The AMI is an encrypted machine image that is configured however you want it.

您可以将整个内容打包为一个 Amazon Machine Instance (AMI)，然后让它们在Amazon EC2上运行您的应用程序。这个解决方案的好处是亚马逊会为您负责计费，而且由于您分发整个机器映像，您可以确定您的所有客户都使用相同的 LAMP 堆栈。AMI 是加密的机器映像，可根据需要进行配置。

You can have Amazon bill the client with a one-time fee, usage-based fee, or monthly fee.

您可以让亚马逊向客户收取一次性费用、基于使用的费用或月费。

Of course, this solution requires that your clients host their app at Amazon, and pay the appropriate fees.

当然，此解决方案要求您的客户在亚马逊托管他们的应用程序，并支付适当的费用。

回答by James Bennett

"Encrypting" Python source code (or bytecode, or really bytecode for any language that uses it -- not just Python) is like those little JavaScript things some people put on web pages to try to disable the right-hand mouse button, declaring "now you can't steal my images!"

“加密” Python 源代码（或字节码，或任何使用它的语言的真正字节码——不仅仅是 Python）就像一些人放在网页上试图禁用鼠标右键的 JavaScript 小东西，声明“现在你不能偷我的照片！”

The workarounds are trivial, and will not stop a determined person.

解决方法是微不足道的，不会阻止一个坚定的人。

If you're really serious about selling a piece of Python software, you need to act serious. Pay an attorney to draw up license/contract terms, have people agree to them at the time of purchase, and then just let them have the actual software. This means you'll have to haul people into court if they violate the license/contract terms, but you'd have to do that no matter what (e.g., if somebody breaks your "encryption" and starts distributing your software), and having the actual proper form of legal words already set down on paper, with their signature, will be far better for your business in the long term.

如果您真的很想出售一款 Python 软件，那么您就需要认真对待。聘请律师起草许可/合同条款，让人们在购买时同意这些条款，然后让他们拥有实际的软件。这意味着如果他们违反许可/合同条款，您将不得不将他们告上法庭，但无论如何您都必须这样做（例如，如果有人破坏了您的“加密”并开始分发您的软件），并且从长远来看，已经在纸上写下并带有签名的法律词汇的实际正确形式对您的业务来说会好得多。

If you're really thatparanoid about people "stealing" your software, though, just stick with a hosted model and don't give them access to the server. Plenty of successful businesses are based around that model.

但是，如果您真的对人们“窃取”您的软件如此偏执，请坚持使用托管模型，不要让他们访问服务器。许多成功的企业都基于这种模式。

回答by Jeremy Cantrell

You'll never be able to keep the source code from people who really want it. It's best to come to grips with this fact now, and save yourself the headache later.

你永远无法让真正想要它的人获得源代码。最好现在就来处理这个事实，并避免以后的头痛。

回答by csexton

One thing you might want to consider is what FogBugz does. Simply include a small binary (perhaps a C program) that is compiled for the target platforms and contains the code to validate the license.

您可能要考虑的一件事是 FogBugz 的作用。只需包含一个为目标平台编译的小二进制文件（可能是一个 C 程序），并包含验证许可证的代码。

This way you can keep the honest people honest with minimal headache on your part.

通过这种方式，您可以让诚实的人保持诚实，而不会让您感到头疼。

回答by John Samuel Anderson

May I speak frankly, as a friend? Unless your app is Really Amazing, you may not get many buyers. Why waste the time on lawyers, obfuscation, licensing and whatnot? You stand to gain a better reputation by open-sourcing your code...and maintaining it.

我可以坦率地说，作为朋友吗？除非你的应用真的很棒，否则你可能不会有很多买家。为什么要在律师、混淆、许可等方面浪费时间？通过开源您的代码......并维护它，您将获得更好的声誉。

Django comes from the open-source end of the spectrum from licensing (and obfuscating). Granted, the MIT license is more common than the GPL; still they are both very far removed from anything like Microsoft's EULA. A lot of Djangophiles will balk at closed source code, simply because that's what Microsoft does.

Django 来自许可（和混淆）范围的开源端。诚然，MIT 许可证比 GPL 更常见；尽管如此，它们都与微软的 EULA 之类的东西相去甚远。许多 Djangophiles 会拒绝封闭源代码，仅仅因为微软就是这样做的。

Also, people will trust your code more, since they will be able to read it and verify that it contains no malicious code. Remember, "obfuscating" means "hiding;" and who will really know exactly what you've hidden?

此外，人们会更加信任您的代码，因为他们将能够阅读它并验证它不包含恶意代码。请记住，“混淆”意味着“隐藏”；谁会真正知道你隐藏了什么？

Granted, there's no easy way to monetize open-sourced code. But you could offer your services or even post a campaign on Pledgie.com, for those who are thankful for all your great work.

诚然，没有简单的方法可以将开源代码货币化。但是您可以提供您的服务，甚至可以在 Pledgie.com 上发布活动，感谢那些感谢您所做的所有出色工作的人。