News for hackers. Stuff that matters.

A comment on Making popular Ruby packages more secure. Parent comment

Re:Making popular Ruby packages more secure by jshawl on Monday June 13, 2022 @08:21PM (#31733342)
FWIW signed packages are available out of the box with rubygems: <http://docs.seattlerb.org/rubygems/Gem/Security.html>
[ Parent | on HN ]
Re:Making popular Ruby packages more secure by jacques_chester on Monday June 13, 2022 @08:25PM (#31733378)
Yes, but rarely used -- it's clunky. When I scraped the top 10k gems, < 1% had valid and up-to-date signatures.
[ Parent | on HN ]
Re:Making popular Ruby packages more secure by jupp0r on Wednesday June 15, 2022 @11:03AM (#31753997)
Notably, signatures are not checked by bundler when installing gems.
[ Parent | on HN ]