open-telemetry/opentelemetry-ruby-contrib
Use Supply Chain Security Features for Gems
开放
#1,289 创建于 2024年12月5日
help wantedkeep
仓库指标
- 星标
- (135 个星标)
- PR 合并指标
- (PR 指标待抓取)
描述
We must take action to reduce the risk of compromising Ruby Gems published from our repositories.
- Cryptographically Sign Gems: https://guides.rubygems.org/security/
- Create or obtain a certificate from the opentelemetry community
- Document the process for managing certs
- Sign gems as part of the release process
- Adopt Roles and stop sharing credentials: https://blog.rubygems.org/2024/11/07/maintainer-role.html
- Document the process for managing maintainers and owners to our RubyGems account