[ruby-core:90586] Suggestion for gem verification

Hello

Many OpenBSD, BSD-license inventions have become adopted elsewhere. Examples:
SSH - everywhere
PF firewall - MacOS, iOS, FreeBSD
LibreSSL - Alpine Linux
dhclient - many Linux distros
sudo - many Linux distros, MacOS

One that has had perhaps less attention is 'signify'.
It is similar to gpgv but probably simpler, with a BSD license.

At present the security of Ruby gems depends 100% on HTTPS and the integrity of
the servers that run rubygems.org. So it requires alot of trust.

However, with signify, you would only have to trust the developer, after a
trust-on-first-use model. Or signify public keys could be downloaded via the OS
package manager, for example.

All major operating systems nowadays use cryptographic signatures for package
verification. Perhaps Ruby should be leading the way for package managers of
scripting languages?
The enterprise may find this appealing too.

A few ports of signify are available on a few Linux distributions. Admittedly,
I don't know how much work it would take to make a highly portable port.

You can read the introduction to signify here:
https://www.openbsd.org/papers/bsdcan-signify.html


Unsubscribe: <mailto:[e-mail]?subject=unsubscribe>
<http://lists.ruby-lang.org/cgi-bin/mailman/options/ruby-core>