Encrypting Tool Packages with AES-GCM

Every package is encrypted with AES-GCM. The package is decrypted in the isolated context and executed without persisting.

What is encrypted?

Every package. The encryption applies at package level.

Where is it decrypted?

Inside the isolated context, before execution. The package is not persisted to disk after decryption.

Is encryption a substitute for signing?

No. Encryption protects contents; signing detects change. Both apply. They are separate layers of security.

Why AES-GCM?

It provides authenticated encryption. It ensures both the confidentiality and integrity of the package contents.

What happens to the tool package?

The package is encrypted at rest, decrypted in the isolated context, and executed. The decrypted package is not persisted to disk.