3 ms·
One interesting thing I've learned about most rubygems keys is they don't have chains back to CAs - they tend to be self-signed, and the docs encourage this. In
by bradleybuda 14y ago
One interesting thing I've learned about most rubygems keys is they don't have chains back to CAs - they tend to be self-signed, and the docs encourage this. In fact, AFAICT there aren't any default trusted CAs for rubygems (unlike, say, the list your browser or OS has) - every signer has to be trusted manually with `gem cert --add`. So you end up with a PGP-like trust model on top of X.509 certs.
I don't know exactly what this rationale was behind this model - I plan to explore this further in subsequent posts. I'm a relative neophyte to code signing - part of the reason I'm writing these posts is to teach myself how things work.
- kgo 14y agoBasically because a proper X.509 implementation requires a CA to be in place first, so you have a place to submit a CSR, but there is no CA, so you're forced to self sign. I've written a rant on the topic here: http://www.rubygems-openpgp-ca.org/blog/gem-signing-x509-and-openpgp.html http://www.rubygems-openpgp-ca.org/blog/gem-signing-x509-and... I've been trying to get people to sign with OpenPGP because that can be done first and then you can put an authentication system into place after the fact. You can't do this with X.509, if/when a CA comes into play all gems would need to be resigned and republished.