Security

Secure Automated Deployments

Every file transfer verified with SHA-256 checksums. Deploy manifests create a cryptographic record of exactly what was deployed.

The problem

Standard SFTP and SCP transfers provide transport-level encryption but no artifact integrity. A file can be corrupted during transfer, partially uploaded, or silently modified after landing on the server. There is no built-in mechanism to verify that what you deployed is what actually ended up on disk. No record of which files were deployed, when, or by whom.

Without deploy verification

  • - Silent file corruption goes undetected
  • - Partial uploads leave broken deployments
  • - No proof that deployed files match local originals
  • - No manifest of what was deployed or when
  • - Manual checksum verification is error-prone and forgotten

How sshDCommander solves it

sshDCommander computes SHA-256 checksums during transfer in a single pass. No second read of the file needed. The --manifest flag records every deployed file in a JSON manifest with checksums, sizes, and timestamps. The verify command checks every file on the server against the manifest.

Streaming SHA-256

Checksums computed during transfer — no second pass. Every byte verified before the upload is considered complete.

Deploy Manifests

JSON manifest records filename, checksum, size, and timestamp for every deployed file. A cryptographic snapshot of your deployment.

Post-Deploy Verification

The verify command reads the manifest and checks every file on the server. Modified, missing, or unexpected files flagged instantly.

Resume Transfers

Interrupted transfers resume from the .part file. No corrupted uploads going live. Failed transfers never replace good files.

In practice

deploy with manifest verification
# Upload files and record checksums in a deploy manifest
$ sshdcp --client-id deploy upload ./release/ /opt/app/ --manifest deploy-2026-04-04.json
SHA-256 verified 14 files, 24.7 MB in 1.2s
# Verify the deployment matches the manifest
$ sshdcp --client-id deploy verify deploy-2026-04-04.json
All files verified. 14/14 passed.
# Days later — check if anything changed
$ sshdcp --client-id ops verify deploy-2026-04-04.json
MODIFIED /opt/app/config.json — checksum mismatch
13/14 passed. 1 modified.

Deploy with cryptographic confidence

5-day free trial. No credit card required.

Start Free Trial