Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I want to send my application to different servers/terminals with content integrity and confidentiality.
So, I need to some process to sign my code and application before sending it to servers and to ensure that the software comes from a trusted source and has not been altered.
What do you suggest? What are the most common practices?
For example, use a symmetric key to encrypt the code and a public key to protect the symmetric key and hash of package?
That is the basic idea, but you probably don't want to implement a custom solution. Depending on your operating system there is probably already a mechanism, for example Debian's SecureApt which leverages GPG.
