I am trying to distribute a software, a simple exe file, that can be executed directly from an USB drive. I would like to make that USB drive read only to avoid any malware infection and accidental deletion. Another requirements is to update this software using a trusted updater package in the field.
I understand I can use a hardware switched write protect USB drive, but then I am giving an option to the users to flip the switch when updating and I would like to avoid that.
So, is there a way where the USB drive is mounted readonly by default and if I need to write it, I need a password or an unlocking key or similar that can be achieved via a trusted script/package?