rubygems/rubygems.org

Introduce concept of "Alumni" to RubyGems.org

Open

#6,534 opened on May 8, 2026

View on GitHub
 (3 comments) (24 reactions) (0 assignees)Ruby (1,003 forks)auto 404
help wanted

Repository metrics

Stars
 (2,431 stars)
PR merge metrics
 (PR metrics pending)

Description

Problem

In the process of preparing the RubyGems Fracture Incident report https://rubycentral.org/news/rubygems-fracture-incident-report/. I noted that the loss of owner access on RubyGems.org negatively affects vanity download metrics. I.e. Right now I get credit for all 556,295,102 downloads to Puma under my profile https://rubygems.org/profiles/schneems. As soon as I'm removed as an owner from that gem, that number goes to zero. This creates an incentive problem where developers want to hang on to owner access even if they don't need it. This contradicts the principle of least privilege (PoLP) access.

Proposed fix

Reward/remember maintainers for their contributions of the past, even if they're not currently active. Decrease the perceived social cost of removing someone as an owner to subtly encourage following PoLP.

Implementation sketch

This doesn't have to be what the final feature looks like, but it's easier to start with something concrete:

  • Add an "Alumni" section to each gem page and show anyone who's previously owned the gem.
  • Add an "Alumni" section to the profile page.
  • Track all gems that someone previously had ownership in this section
  • Have the total gem download count include those alumni numbers

For a specific example, since bundler GitHub access was part of what motivated this suggestion, let's use bundler. You can see historical owners https://web.archive.org/web/20240725164923/https://rubygems.org/gems/bundler who are no longer on the project. I would expect to see all of the owners on that wayback archived page on the current https://rubygems.org/gems/bundler. In addition, if I click through to one of their profiles, I would expect to see "bundler" listed under an "Alumni" section, and the total gem download count on their profile to include the 3,387,724,053 downloads (and counting).

Impact

Another practical example is https://rubygems.org/profiles/chrisseaton. Chris passed in 2022 shortly after RubyConf Houston, where I met him IRL for the first time. He was my friend. His impact on the Ruby community is immense. He's still listed as a maintainer of concurrent-ruby, which right now has 1,270,131,969 downloads. Chris deserves each and every one of those to his name, and the current gem owners shouldn't have to hesitate about removing some security surface area (if someone were to get his credentials and MFA).

Maintainers burn out, get tired, get sick, and leave willingly or unwillingly for a million different reasons. Their influence and impact didn't go away the second they did. Their actions are still felt long after they're gone. Let's celebrate everyone who's helped get these libraries to where they are today. Let's give all maintainers the credit they deserve. Let's add the concept of "Alumni" to RubyGems.org.

Contributor guide