5 ms·
It has code signing. It's just optional, inconvenient, and so unused because of Tragedy of the Commons and complacency. https://guides.rubygems.org/security/ ht
by burnt-resistor 1y ago
It has code signing. It's just optional, inconvenient, and so unused because of Tragedy of the Commons and complacency. https://guides.rubygems.org/security/ https://guides.rubygems.org/security/
https://www.benjaminfleischer.com/2013/11/08/how-to-sign-your-rubygem-cert/ https://www.benjaminfleischer.com/2013/11/08/how-to-sign-you...
- phoronixrly 1y agoAs I said, it's as good as no code signing. The very lack of a chain of trust stemming from rubygems that can be used to verify gem authenticity makes the whole thing useless.