3 ms·
I'd wager that most gem developers don't understand how it works, and there are basically no resources out there on it. Here's the chapter on it in the RubyGem
by mratzloff 14y ago
I'd wager that most gem developers don't understand how it works, and there are basically no resources out there on it.
Here's the chapter on it in the RubyGems manual:
http://docs.rubygems.org/read/chapter/21 http://docs.rubygems.org/read/chapter/21
And that's all that I can find. Try to find something else, like a blog tutorial.
- Xylakant 14y agoEven if most gem developers would understand, there's still a problem with the trust model: If you choose "high security", you cannot install a single gem without signature - so things won't work unless _all_ authors sign their gems. Gem signing would have to be a requirement, similar to packages on ubuntu's ppa. If you choose a lower security setting, a gem may just be repackaged and signed again by the attacker or the signature removed.
- mratzloff 14y agoA solution that doesn't solve 100% of the problem is still not a bad solution. The most popular gems would all be signed, thereby dramatically reducing attack vectors.
- Xylakant 14y agoNo, as I said, this doesn't help. You would need to sign the most popular gems and all their dependencies and the dependencies dependencies. Given that a pretty much standard rails app can easily pull in hundred or more gems that's quite a bit of work. It's doable, but I only see that coming if for example rubygems requires a key and gem signatures. Then there's still the unsolved problem of providing key trust - the current implementation relies on self-signed certificates.