Rubygems.org: Comparing gem's source code on source repository and what's inside the .gem in rubygems

Created on 3 Apr 2019 · 2Comments · Source: rubygems/rubygems.org

Hi,

I think that would be great to have some kind of "reproducible builds" (like Debian does).

Uploaded gems can provide a source repository already (typically github)
From this, the gem could be built from source (from git tags ideally, or maybe some heuristics by looking at the last commit that updated the version)
Then checksum of the built gem (if building it succeeds) could be compared to the checksum of the published gem
Users could ask for "safe" gems only in their Gemfile (could become the default possibly once most popular gems have reproducible builds) (and could add exceptions for usafe gems)

This doesn't totally prevent issues like hidden backdoors but could be a good step (the attacker would need commit access on Github and push access on rubygems).

Source

localhostdotdev

👍2

Most helpful comment

Thanks for this. I'm not a rubygems maintainer, but have a big interest in this issue (I run Dependabot, which creates dependency update PRs on GitHub and links to the source code diff for those updates).

I'm super keen to help in any way on this one. If we need to link up with folks at GitHub then I work with them pretty closely thanks to Dependabot. If we want a third party to do the work of gem verifying then Dependabot could do that work (there's already an issue on our feedback repo suggesting that). If it needs a bunch of engineering time then I can put in time on this.

greysteil on 5 Apr 2019

👍6

All 2 comments

greysteil on 5 Apr 2019

👍6

It's a great idea. My only minor concern is that this interconnects (and thus mandates) GitHub, but not everyone on rubygems.org may have (or want) to have an account at GitHub.

I understand that third party may mean less work though. If possible, my personal favourite here would be to be able to do so through the account on rubygems.org - what is done behind the scene would then be not so important (for me as a user), but I think it would be fairly bad if users would be forced to have multiple accounts at several separate/disparate websites.