From: "Urabe, Shyouhei" Date: 2018-12-18T12:59:07+09:00 Subject: [ruby-core:90596] Re: Suggestion for gem verification JFYI Rubygems packages can be signed. See also: https://guides.rubygems.org/security/ On Mon, Dec 17, 2018 at 10:18 PM wrote: > > > Hello > > Many OpenBSD, BSD-license inventions have become adopted elsewhere. Examples: > SSH - everywhere > PF firewall - MacOS, iOS, FreeBSD > LibreSSL - Alpine Linux > dhclient - many Linux distros > sudo - many Linux distros, MacOS > > One that has had perhaps less attention is 'signify'. > It is similar to gpgv but probably simpler, with a BSD license. > > At present the security of Ruby gems depends 100% on HTTPS and the integrity of > the servers that run rubygems.org. So it requires alot of trust. > > However, with signify, you would only have to trust the developer, after a > trust-on-first-use model. Or signify public keys could be downloaded via the OS > package manager, for example. > > All major operating systems nowadays use cryptographic signatures for package > verification. Perhaps Ruby should be leading the way for package managers of > scripting languages? > The enterprise may find this appealing too. > > A few ports of signify are available on a few Linux distributions. Admittedly, > I don't know how much work it would take to make a highly portable port. > > You can read the introduction to signify here: > https://www.openbsd.org/papers/bsdcan-signify.html > > > Unsubscribe: > Unsubscribe: