stevef1uk/secure-packager repository overview

⁠secure_packager

⁠Why this exists

Modern teams need to ship valuable data/models to customers securely, without painful key management or custom builds on every machine. Plain zips leak keys, signatures don’t enforce access, and full-blown DRM is heavy and brittle. This project offers a pragmatic middle ground:

• Problem: You must distribute files inside containers or via zip, but only the intended recipient should be able to open them.
• Solution: Encrypt files with a symmetric key (Fernet), then wrap that key with the recipient’s RSA public key. Only their private key can unwrap and decrypt.
• Optional licensing: Add a vendor-signed token that’s verified at decrypt time for friendly messaging and basic enforcement (expiry, warnings, block within 24h).

⁠Key features

• Confidentiality by default: No plaintext Fernet key shipped.
• Two modes: with or without licensing enforcement (auto-detected from the zip).
• Simple CLI or Docker: Use locally or via container with volume mounts.
• Portable: Multi-arch container images (linux/amd64, linux/arm64).

Envelope encryption utilities for distributing data/models:

• Packager: Fernet-encrypts files; wraps the Fernet key with customer's RSA public key (RSA-OAEP SHA-256)
• Unpack: Requires customer's RSA private key to unwrap key and decrypt files
• Issue-token: Generates vendor-signed license tokens for messaging/enforcement

⁠Build

[See GitHub Repo: ](https://raw.githubusercontent.com/stevef1uk/secure_packager/README.md⁠

Run examples (integration examples in GitHub repo) (volume mount input/output):

⁠Packager (no licensing):

docker run --rm -v $(pwd)/input:/in -v $(pwd)/out:/out
yourorg/secure-packager:latest packager -in /in -out /out -pub /out/customer_public.pem -zip=true

⁠Packager (with licensing):

docker run --rm -v $(pwd)/input:/in -v $(pwd)/out:/out -v $(pwd)/keys:/keys
yourorg/secure-packager:latest packager -in /in -out /out -pub /out/customer_public.pem -zip=true -license -vendor-pub /keys/vendor_public.pem

⁠Unpack (auto-detect licensing from zip):

docker run --rm -v $(pwd)/out:/out -v $(pwd)/dec:/dec -v $(pwd)/keys:/keys
yourorg/secure-packager:latest unpack -zip /out/encrypted_files.zip -priv /keys/customer_private.pem -out /dec -license-token /keys/token.txt

⁠Issue token:

docker run --rm -v $(pwd)/keys:/keys yourorg/secure-packager:latest
issue-token -priv /keys/vendor_private.pem -expiry 2025-12-31 -company Acme -email [email protected]⁠ -out /keys/token.txt

### Modes

- Without licensing: default; zip contains encrypted files and `wrapped_key.bin` only
- With licensing: add manifest and vendor public key; unzip enforces license automatically


License token format (compatible with existing):
- `base64url(expiry:company:email:placeholder_key:signature_b64)`
- Signature: RSA-PSS over `expiry:company:email:placeholder_key`
- Behavior: prints Company/Email/Expiry, warns at <=7 days, blocks if expired or <=24h 

*****
This container is licensed under the Creative Commons Attribution-NonCommercial 4.0 International License.
You may use, modify, and share it for non-commercial purposes, provided that attribution is given.
Commercial use requires explicit permission.


see: https://emotion-service-api.sjfisher.com for commercial terms

©  2025 SJFIsher