From: Dan Fitzpatrick <dan@...>
Date: 2006-03-30T16:05:39+09:00
Subject: Re: Digital signing of Ruby scripts

John Lam wrote:
> It's not copy protection that I'm worried about. Nor is it someone being
> able to look at the source code. What I'm worried about is someone
> *tampering* with the source code. So what I'm interested in is code signing
> of Ruby scripts combined with a policy enforcement mechanism (e.g. only an
> admin can install the Ruby interpreter, which is signed and only an admin
> can define the execution policy of the Ruby interpreter which can say things
> like "run all scripts" to "run only scripts whose public keys are defined by
> the admin").
>
> Now, maybe rich client applications built using Ruby will be more like web
> pages - the real business logic lives on the server with only lightweight
> validation logic on the client. However, it would be a shame to limit Ruby
> apps to just that.
>
> -John
> http://www.iunknown.com
>   
John,

One solution may be to compile a small app that takes an MD5, SHA, or 
some other checksum of the ruby code and only executes it if it is in an 
internal hash of allowed files. You could have user-based hashes of 
allowed files based on who is logged in. Of course you will have to 
rebuild this app every time you change the ruby code but that could be 
automated. But a user could run the ruby code directly unless you build 
in some dependency to the compiled app. If they can see the source code, 
they can copy it, tamper with it, and run it.

Dan