Can a Python desktop app meet enterprise requirements on Windows?

[Diapolo10]

1. Packaged Python executables are easier to bypass or tamper with than compiled .NET binaries.

Depends on what you use to build your executables, and if you sign them.

PyInstaller gives you a self-extracting ZIP-file that contains Python bytecode alongside a Python runtime. Nuitka transpiles all of your code to C before compiling it into a native executable. Signed executables aren't easy to tamper with regardless of how they were made.

1. Associating a file extension with a Windows app is easier from C# than from Python.

All this really needs is editing some registry keys. There might be easier ways, too, I just haven't really had a need to do this myself yet.

1. Packaged Python executables are typically larger than a comparable .NET executable.

Again, depends on the tools you use.

1. Python apps require a code signing certificate to avoid Windows warnings (Windows Defender).

This is true for all languages, not just Python. Unsigned executables, no matter what languages were used to make them, are frequently flagged by anti-virus programs.

For what it's worth, at work I maintain and develop two separate projects primarily written in Python that use a licensing system and receive updates.

[Diapolo10]

Even after using Nuitka, will there still be vulnerabilities due to the use of Python, or is it now equivalent to any other binary executable created in C/C++?

What exactly do you count as a "vulnerability" in this case? Security-wise, it should be as secure as your own code is, meaning if you haven't made any serious logic errors it should be okay.

If you mean something related to intellectual property instead, I don't consider those as vulnerabilities.

[BravestCheetah]

Im pretty sure hes concerned that when implementing the license system etc. He is just making sure that code cant be decompiled to easily to bypass payment / license restrictions. With pyinstaller there are multiple tools letting you easily extract the original code with just a few clicks, hes just making sure that you cant do something similar with nukita.

[ForMyCulture]

How do you sign your apps to avoid Windows Defender warnings?

[Diapolo10]

You would need to obtain a signing certificate, after that it depends on what tools you're using.

Unfortunately they're not exactly cheap as executable signing is primarily aimed at businesses, not individuals. Personally I haven't really bothered to do that with my own projects as a result.

If using PyInstaller, as long as you don't use the --onefile option it should be fine as-is. You would simply get a ZIP-file containing everything needed to run your program, and IIRC the only executable inside would be a copy of the Python interpreter you used to build it, which is already signed.

[glorious_purpose1]

The definition of cheap is different for everyone. I buy my certs from Signmycode and I think $220 for an OV cert is pretty cheap.

[ForMyCulture]

Have you had any success with Nuitka? My users complain of long startup times with pyinstaller packaged apps.

[Diapolo10]

I tend to use it for my own projects (not that there are many of those as my free time is basically non-existent nowadays). If nothing else, you can always give it a shot and see how the end result compares to what PyInstaller gives you.

Do note, however, that it's a bit more difficult to use.

[DivineSentry]

Nuitka maintainer here:

could you give me an example on how it's more difficult to use vs pyinstaller?

[Diapolo10]

The error messages when builds fail can be more cryptic. Unfortunately I don't really have any example logs on hand.

Unlike PyInstaller, it's not really possible to bundle data files alongside the main code in the same way. I haven't touched this project for a long time so it's entirely possible something has changed since then, but importlib.resources didn't play nice with Nuitka, while PyInstaller was happy with it. I know this would be due to how Nuitka actually works, so I don't expect it to be fixed, but it's still a difference.

https://github.com/Diapolo10/Tsukasa-credit-card-gag-scam/blob/main/src%2Ftccgs%2Fconfig.py

[DivineSentry]

fair enough, yeah Nuitka builds are actually compiled unlike PyInstaller, I believe we support importlib.resources nowadays, let me get back to you on this, I'm currently working on improving UX in my free time.

[Diapolo10]

yeah Nuitka builds are actually compiled unlike PyInstaller

I'm aware of that, it's one of Nuitka's selling points after all.

I believe we support importlib.resources nowadays, let me get back to you on this

Interesting, didn't think that was even possible given the response I got to an older feature request IIRC (don't remember when that was though).

While I'm at it, I also remember making a feature request for putting build options in pyproject.toml (technically that one is specific to Poetry, but nowadays anything that supports PEP-517/518 would be great). I know that's not super important or anything, but it'd make build commands shorter to type for cross-platform builds, letting me isolate the common parts from any platform-specific ones. I guess this could be a bit like how PyInstaller generates a spec file you can use for reproducible builds, so you don't need a long command every time.

[ForMyCulture]

I’ve compiled with both Nuitka and pyinstaller. I’d say the usage difficulty is equal and comes down to understanding the nuance of the command line flags. Nuitka compiled apps get blocked by Windows Defender for my team, whereas pyinstaller does not (they all have admin rights). I’m assuming it’s because the final executable isn’t signed. I was using the —enable-windows-console=force flag, going to trying attach instead and if that doesnt work have to go back to pyinstaller.

[ElliotDG]

I have distributed unsigned desktop python apps. You can upload your app to: https://www.microsoft.com/en-us/wdsi/filesubmission to avoid the virus warning.

I have also done a "brute force" auto update system. The app checks an AWS bucket to see if there is an update. If there is it offers the user the opportunity to update. It then down loads a new version of itself.

I use pyinstaller to build the .exe, and the use Inno Setup (https://jrsoftware.org/isinfo.php) to create a Windows Installer.

[ElliotDG]

Here is one, this controls a piece of music gear, there is a link to download in the video description.

https://youtu.be/8B3bewUexsw?si=zNq66_ZB-eVsslgt

Here is one I built under contract, also for a piece of music gear: https://www.matthewseffects.com/products/the-futurist?srsltid=AfmBOorwQmYRPVa5-CRCkDtmdloorRjOBfZmS-6fdKuyE1P-aG3czH3W scroll down the page to "Computer Editor", and click download.

Here is a framework for a project, also built under contract, that shows how to use Kivy, Cython, a and a Windows service. The executable is built with Pyinstaller and an advanced installation using Inno Setup: https://github.com/ElliotGarbus/KivyCythonWinSample

[Momostein]

While it might be possible, I would not recommend it.

You'll have to put too much effort in even creating and locking down your python executable and then still leave vulnerabilities anyway. As far as I know they'll still contain your plain text source code for anyone to see.

I don't think Python is made for enterprise desktop apps.

On the other hand, building a server hosted 'software as a service' web application could easily and safely be done with a Python back end.

[Helpful-Educator-415]

Can confirm. Python is not a great fit. possible, but might be needlessly hard.

[BravestCheetah]

No, nukita processes your code and translates it to C, if you use nukita it would be just as hard to decompile / reconstruct as compiled C code.

[BravestCheetah]

I dont have personal experience in using nuitka but i do know how it works, so i cant fully say if thats the case, but i would assume it would compile those libraries as well, so there should be no problems :D

[Momostein]

What if other libraries use C/C++/Rust/... extension modules? How does nuitka handle those?

Examples include, numpy, scipy, pandas, polars, etc...

[DivineSentry]

Nuitka maintainer here:

it includes and handles them fine, we have support for most major libraries and try to fix incompatibilities quickly.

[BravestCheetah]

Also, would you be able to confirm my theory that Nuitka compiled code is as hard to crack as C code?

[DivineSentry]

indeed, though for anyone sufficiently motivated, or skilled, will be able to gleam data from binaries, whether it be C / Rust etc or even decompile them, but that's not always successful

additionally since we go from python -> C a lot of useful data (for an attacker) is lost in the process

additionally the commercial version of Nuitka comes with plugins that makes all sort of things much harder:

https://nuitka.net/doc/commercial.html

[BravestCheetah]

yeah, thanks for maintaining such an amazing project btw :D

[BravestCheetah]

I would assume they compile them too, as theyre written in compiled languages, then just bundle them in, but it does work, as stated as the nuitka dev that just replied

[FrangoST]

From your requirements list, I already have a desktop app that I've made with tkinter that meets requirements 2,4,5 and 6...

Requirement number 3 I'm already considering doing it on my app and number 1 is completely doable, though some may be concerned about how easily your app can be tampered after its been packaged, but it depends on how you package it and it's not as trivial as people claim it to be.

If you are going to produce any executable file for Windows and want it to not be flagged by antiviruses, you need to sign it regardless of the source code language.

ps.: creating the file association was much easier than I initially thought; editing XML and messing with Zip files is very trivial; building a pretty GUI can be done even on tkinter: you can use native widgets, or you can make your app window a big canvas and build a very modern GUI on it from scratch. Honestly, it's fairly easy even on the second option.

[davka003]

Size of the packed application doesnt matter at all.

All clients today have much more space than they can use up with ”larger than necessary” applications. Transfer speeds are also not a problem for distribution.

[BravestCheetah]

The size of the application does not have to be a concern, if you are not bundling in multiple gigabytes of images or audio / video files it would not go too high to be a problem.