Systems and methods providing a processing device to receive, by a software build process executing in a trusted execution environment (TEE) of a first computer system, software source code from a second computer system. The processing device generates a software package by compiling the software source code. The processing device also generates a first signature of the software package and sends the first signature to the second computer system. Responsive to receiving, from the second computer system, a second signature comprising the first signature signed by the second computer system, the processing device further deploys the software package on the first computer system.