From: autosend@... Date: 2018-12-17T13:18:05+00:00 Subject: [ruby-core:90586] Suggestion for gem verification Hello Many OpenBSD, BSD-license inventions have become adopted elsewhere. Examples: SSH - everywhere PF firewall - MacOS, iOS, FreeBSD LibreSSL - Alpine Linux dhclient - many Linux distros sudo - many Linux distros, MacOS One that has had perhaps less attention is 'signify'. It is similar to gpgv but probably simpler, with a BSD license. At present the security of Ruby gems depends 100% on HTTPS and the integrity of the servers that run rubygems.org. So it requires alot of trust. However, with signify, you would only have to trust the developer, after a trust-on-first-use model. Or signify public keys could be downloaded via the OS package manager, for example. All major operating systems nowadays use cryptographic signatures for package verification. Perhaps Ruby should be leading the way for package managers of scripting languages? The enterprise may find this appealing too. A few ports of signify are available on a few Linux distributions. Admittedly, I don't know how much work it would take to make a highly portable port. You can read the introduction to signify here: https://www.openbsd.org/papers/bsdcan-signify.html Unsubscribe: