I could simply write a bash script that signs every file in a directory with my GPG keypair, but my problem is the fact that if the code was not signed, it doesn't raise any additional errors than if it was signed correctly, so in interests of protecting my server from sending out/executing malicious scripts that I haven't explicitly authorized, is there any way I can use my GPG keypair (or even my X.509 certs!) and ENSURE all code in a particular, say, directory is always checked for a valid signature before execution?
To throw a spanner even further in the works, how could we effectively 'sandbox' this in such a way as malicious scripts placed outside the scope of the enforced checking could not interfere? For example, if a directory was 'flagged' as requiring enforced signatures on all files, would it be possible for files outside this directory to be used to circumvent the code signatures and interfere with the application or scripts?
I'm not really interested in the signing algorithm, scripts vs. binaries or operating system, but for the application I would apply this to, it would be against python/django or PHP scripts running in a Debian VPS (for the purposes of web applications).
Just an interesting thought, one I'd certainly like to pursue if a suitable solution is around! Ideas or discussion is much appreciated!