Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I'd like to know whether HTTPS can be used as a secure means of software distribution.
Concretely, can I put up a file on a server making it accessible through a public HTTPS URL and be sure that it won't be infected by malware by the time it reaches the user?
If no, what other ways are there to securely distribute software?
Concretely, can I put up a file on a server making it accessible through a public HTTPS URL and be sure that it won't be infected by malware by the time it reaches the user?
HTTPS only secures the transport. If this is your only problem then HTTPS is sufficient.
But, HTTPS does not secure the files at the server, nor does it secure the transport to the server (unless you use HTTPS too or for similar security SSH). It does also not protect your computer so it might be possible that the binary you ship already contains malware (would not be a first).
If no, what other ways are there to securely distribute software?
A good idea is to start with security es early as possible. I.e. make sure that the build itself is fine (no malware on your machine, source code not compromised by including suspicious third party code...) and then sign the binary, see Wikipedia on Code Signing. If any changes are done to the software after the signing process the signature will be invalid.
