RubyGems.org has little in the way of defenses against tampering. Right now, new gems could be uploaded to S3 and distributed to users worldwide without detection, and the only thing preventing this is the security of the AWS credentials presently stored on world-facing web servers. S3 Versioning is a step that could be taken immediately to reduce the severity of compromise, but a larger solution is required.
This document proposes a .gemsig
file as a means of verifying that a gem has not been modified during distribution. This file would be distributed alongside the .gem
files, allowing clients to verify authenticity.