Rubygems.org: Audit trail when sharing maintainership

[mike-burns]

thoughtbot has a handful of gems on Rubygems. Each person who can push a new release is added individually so they can use their own account. This helps us control access.

If I look at the profile for a co-maintainer, I'd like to know whether that is the correct account for a person who should be a co-maintainer, as opposed to someone who got access incorrectly.

The most likely attack vector would be through someone else's insecure account. If we discover that one of our co-maintainers has a weak password and no 2FA, for example, we'd like to know who they have granted access to so we can check that those people should be real co-maintainers.

So, features proposals:

• Show who gave a maintainer access to a gem, and when.
• Show all the people that someone has given maintainer access to, and when.
• Show whether someone has 2FA enabled.
• Show whether all maintainers of a gem have 2FA enabled.

[sonalkr132]

Hi, we implemented all of your suggestions in https://github.com/rubygems/rubygems.org/pull/2357. You can check this at https://rubygems.org/gems/<gems_name>/owners

Feel free to reopen if you feel we missed something.

[mike-burns]

Thank you!