open-telemetry/opentelemetry-ruby-contrib
Use Supply Chain Security Features for Gems
開放
#1,289 建立於 2024年12月5日
help wantedkeep
倉庫指標
- 星標
- (135 顆星)
- PR 合併指標
- (PR 指標待抓取)
描述
We must take action to reduce the risk of compromising Ruby Gems published from our repositories.
- Cryptographically Sign Gems: https://guides.rubygems.org/security/
- Create or obtain a certificate from the opentelemetry community
- Document the process for managing certs
- Sign gems as part of the release process
- Adopt Roles and stop sharing credentials: https://blog.rubygems.org/2024/11/07/maintainer-role.html
- Document the process for managing maintainers and owners to our RubyGems account