The State of RubyGems
summary
RubyGems reports concrete wins: a trusted publishing rollout with ~2,400 gem versions from ~350 gems (≈260M downloads), a Sigstore Ruby client and ongoing sigstore integration, a Trail of Bits security audit with followup fixes, 24 releases across RubyGems and Bundler in 2024 and zero downtime, a beta organization accounts feature for team ownership, and membership in OpenSSF and the clip Foundation to meet supply‑chain and compliance needs.
AI-written summary · about
chapters (31)
- 0:00Introduction
- 1:26Ruby Central hired security engineer
- 3:58Security’s role in RubyGems
- 7:12Trusted publishing and supply chain security
- 10:04Indexing gems for security events
- 11:07Sigstore and cryptographic verification
- 12:35Security audit and future plans
- 13:17New speaker Martin MD
- 13:39RubyGems design refresh and dark mode
- 15:50RubyGems evolution over two decades
- 16:33Organization accounts for gem teams
- 18:19Naming and beta testing org accounts
- 19:01Transition to Sarah Novotny
- 19:22Open Source Program at Ruby Central
- 20:27Formation of Open Source Committee
- 21:09Open Source mission and projects
- 22:112024 highlights and report
- 23:11Infrastructure upgrades and releases
- 23:57On-call rotations and uptime
- 24:17Joining foundations for supply chain
- 24:59Four pillars for 2025
- 25:41Improving developer experience
- 26:232025 security and compliance plans
- 26:45Stability and disaster recovery
- 27:28Sustainability and funding infrastructure
- 28:12RubyGems funding history
- 29:14RubyGems funding sources
- 30:182024 funding partners
- 31:01Corporate sponsorship program
- 31:44Call to action for funding
- 32:05Team growth and closing
