Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Expand gem security build/install instructions; add checksum #70

Merged
merged 7 commits into from
Nov 21, 2013
Merged

Expand gem security build/install instructions; add checksum #70

Changes from 1 commit
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
e9dcef6
Expand gem security build/install instructions; add checksum
bf4 Nov 21, 2013
dae8880
Add rubygems-openpgp video/slides by @grant-olsen, working link
bf4 Nov 21, 2013
d2e08a0
Recommend against signing gems with rubygems-openpgp
bf4 Nov 21, 2013
90f453f
Highlight gem checksum before the not-recommended openpgp
bf4 Nov 21, 2013
2fe098c
Add caveat to using gem cert signed gems
bf4 Nov 21, 2013
df1aee3
Remove most OpenPGP discussion per @grant-olson @yorickpeterse
bf4 Nov 21, 2013
bb47d31
Synch general security content with the details that follow
bf4 Nov 21, 2013
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Add caveat to using gem cert signed gems
  • Loading branch information
@bf4
bf4 committed Nov 21, 2013
commit 2fe098c7175f836d50b576d6e85b26c74000dff8
2 changes: 2 additions & 0 deletions security.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,8 @@ Using Gems
* `gem install gemname -P MediumSecurity`: All signed dependent gems must be verified.
* `bundle --trust-policy MediumSecurity`: Same as above, except Bundler only recognizes
the long `--trust-policy` flag, not the short `-P`.
* Caveat: Gem certificates are trusted globally, such that adding a cert.pem for one gem automatically trusts
all gems signed by that cert.
* Risks of being pwned, as described by [Benjamin Smith's Hacking with Gems talk](http:https://lanyrd.com/2013/rulu/scgxzr/)

Building Gems
Expand Down