I work on a project where DVDs with configuration files and software updates are delivered periodically to end users, and our software loads those discs. For example, we might load a disc with an updated set of hostnames and IP addresses when the network topology is updated, or we might get a disc with virus definition updates.
Is there any way to sign those discs with GPG or similar such that they could be verified in an offline environment? The systems in question don't have Internet access. Ideally I would like to embed the GPG signature on the discs so they can be self-verifying.
When I look at how this is typically handled, folks like Debian and Ubuntu will provide a GPG signature alongside their ISO. It's not in the ISO; it's a separate detached file. That doesn't work for us since we deliver physical discs, not ISOs.
- Currently we sign individual files on the DVDs. It works, but it's not ideal on a DVD with tens or hundreds of files.
- My understanding is that embedded signatures only work with file formats that are designed for them, such as RPM. ISOs don't have such a mechanism. Is that correct?
- I suppose we could tar up the contents of the DVDs and store a tarball and signature on the discs instead. Is that the best answer? Any better ideas?
I'm open to non-GPG-based solutions. If there's a way to embed a SHA-2 checkum, for instance, that could also work.