Tag

gem-signing

Safeguard articles tagged "gem-signing" — guides, analysis, and best practices for software supply chain and application security.

1 article

Engineering

Ruby Gems Security: Signing, Yanking and Trusted Publishing

Gem signing never took off, yanking is weaker than people assume, and trusted publishing finally fixes the credential problem. What to actually rely on in a Ruby pipeline.

Mar 20, 20266 min read