4 ms·

How would signing gems have prevented this situation?

• cbhl 14y ago
  It would allow you to verify the authenticity of the gems, even if the server had been compromised. (This isn't a new technique -- for example, .deb packages distributed through APT are usually signed with gpg -- IIRC, this was a measure introduced years ago in response to a Debian mirror being compromised.)
  • quadhome 14y ago
    (my knowledge is circa early 2000s) Debian has (had?) a high barrier to entry to become a developer, and every developer signs their packages. The release binaries are arranged on a secured box and the release key itself is held by a limited set of people. In short, the signatures work because of the human element and organizational structure of Debian. Rubygems accepts submissions from the general public. So, again, I don't see how it would have helped.