Gem Security

[Will Green]

One of the points that was brought up on the Herding Code episode was
the need for security of gems (since we distribute binary assemblies
in .NET). So, I did a quick search in the Gem manual to see if the
smart guys behind Ruby Gems (if you don't know the guys behind Ruby
Gems, they are *wicked* smart people) had given any thought to
security.

Lo and behold: http://rubygems.rubyforge.org/rdoc/Gem/Security.html

Thoughts?

==
Will Green

[Nick Quaranto]

Just a heads up, the ruby 'brainiacs' here aren't even using signed gems yet for the most part. The main problem is solving WHO signs it, and how you'd trust a gem. As far as I know, only Hoe (a kind of ancient Jeweler that is really, really invasive to your gem project) actually signs gems.

Some background: http://blog.segment7.net/articles/2009/02/04/a-rubygems-github-proposal

We've had a request or two for some kind of cert publishing but nothing has come up so far. http://github.com/rubygems/gemcutter/issues#issue/96