Proper way to encrypt a .deb package

Question

I want to be able to send my customer "firmware" updates to machines already sold to them. They aren't networked devices so it needs to be something done manually. Those hooks for getting the files onto the system are already in place.

I don't want them to be able to see the code in these updates, so I see two options:

• Compress a directory of files to deploy. Encrypt that directory. Upload to device. Decrypt at device. Have a script manually deploy code where it needs to go.
• Create a .deb package to let dpkg deal with deployment. Encrypt that package. Upload to device. Have a (simpler) script unpack the .deb package.

I'm leaning more towards the second option, as it feels cleaner. That being said, I don't have a lot of experience in security and want to do it as nicely as possible.

My first instinct is to do something like this answer for either case. I.E. using openssl to encrypt and decrypt on the respective sides.

BUT, is there a better way? Perhaps there's something in dpkg (or its relatives) that encrypts it in some specific way? Manually encrypting a package just feels wrong to me. Am I doing it correctly?

---

EDIT 1

To clarify, my question is not necessarily a recommendation for what tool to use. I will use openssl unless otherwise enlightened. I am asking if using openssl is inferior to some other tool for this purpose, and to understand those difference, if applicable.

---

Answer 1

dpkg not intended to use encryption, so you need external tool.

Main question - where decryption key is stored and how it used.

It must be at least already stored in customer machine and used automatically by "firmware".

"firmware" must know how update itself from encrypted file.

UPD 1

In aspect of security GPG and OpenSSL look almost same, but mostly use incompatible formats and certificates. As security.stackexchange say.

About "manual" encryption. Must be good include package encryption in automated build process.