Can Gems be served from OCI Container/Artifact registries, which (also) already support signatures? From https://news.ycombinator.com/item?id=44991636 https://

Can Gems be served from OCI Container/Artifact registries, which (also) already support signatures? From https://news.ycombinator.com/item?id=44991636 https://news.ycombinator.com/item?id=44991636 : > Native Containers are bare-metal host images as OCI Images which can be stored in OCI Container Registries (or Artifact registries because packages too). GitHub, GitLab, Gitea, GCP, and AWS all host OCI Container/Artifact Registries So, packages there too would simplify. Re: "RPM 6.0 Released with OpenPGP Improvements and Signature Checking by Default" (2025) and Sigstore and PyPI and SLSA.dev and key revocation transparency: https://news.ycombinator.com/item?id=45354568 https://news.ycombinator.com/item?id=45354568 Nerdctl supports various snapshot, lazy start, and distributed cloud storage container stores: https://news.ycombinator.com/item?id=45270468 https://news.ycombinator.com/item?id=45270468 Ruby has: gem cert --build your@email.com gem install gemname -P HighSecurity And also for signatures now there's sigstore-ruby and Trusted Publishing. sigstore-ruby: https://github.com/sigstore/sigstore-ruby https://github.com/sigstore/sigstore-ruby guides.rubygems.org/trusted-publishing: https://guides.rubygems.org/trusted-publishing/ https://guides.rubygems.org/trusted-publishing/ : > Trusted publishing is a mechanism for uploading gems to RubyGems.org without using long-lived secret credentials. [..] > Trusted Publishing is a term for using OpenID Connect (OIDC) to exchange short-lived identity tokens between a trusted third-party service and RubyGems.org. This allows obtaining short-lived API tokens in an automated environment (such as CI) without having to store long-lived API tokens or username/password credentials.