[ruby-core:90596] Re: Suggestion for gem verification

From: "Urabe, Shyouhei" <shyouhei@...>
Date: 2018-12-18 03:59:07 UTC
List: ruby-core #90596
JFYI Rubygems packages can be signed.  See also:
https://guides.rubygems.org/security/

On Mon, Dec 17, 2018 at 10:18 PM <[email protected]> wrote:
>
>
> Hello
>
> Many OpenBSD, BSD-license inventions have become adopted elsewhere. Examples:
> SSH - everywhere
> PF firewall - MacOS, iOS, FreeBSD
> LibreSSL - Alpine Linux
> dhclient - many Linux distros
> sudo - many Linux distros, MacOS
>
> One that has had perhaps less attention is 'signify'.
> It is similar to gpgv but probably simpler, with a BSD license.
>
> At present the security of Ruby gems depends 100% on HTTPS and the integrity of
> the servers that run rubygems.org. So it requires alot of trust.
>
> However, with signify, you would only have to trust the developer, after a
> trust-on-first-use model. Or signify public keys could be downloaded via the OS
> package manager, for example.
>
> All major operating systems nowadays use cryptographic signatures for package
> verification. Perhaps Ruby should be leading the way for package managers of
> scripting languages?
> The enterprise may find this appealing too.
>
> A few ports of signify are available on a few Linux distributions. Admittedly,
> I don't know how much work it would take to make a highly portable port.
>
> You can read the introduction to signify here:
> https://www.openbsd.org/papers/bsdcan-signify.html
>
>
> Unsubscribe: <mailto:[email protected]?subject=unsubscribe>
> <http://lists.ruby-lang.org/cgi-bin/mailman/options/ruby-core>

Unsubscribe: <mailto:[email protected]?subject=unsubscribe>
<http://lists.ruby-lang.org/cgi-bin/mailman/options/ruby-core>

In This Thread

Prev Next