bake-modernize 0.65.0 → 0.66.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 32e279a2cd64b6db3d274c56caed5dd93cc3f8a5854c6cad52252354ab110968
-  data.tar.gz: e8314e50b8118a0d0a6f897088b791c4b1d743a648cb7d92e9ab3338e0c7c17e
+  metadata.gz: 86088eb1ce54261f44c72af7f45c7b52e407aeb0e1d4d09a91e27bb0ddbcff1c
+  data.tar.gz: f415b2e231df146da6fd9679e64a0a97321f02cae27e30460bbd47be204e6a1e
 SHA512:
-  metadata.gz: 4c90c6778c2878f35d4ec00c79e7a17c48af5a0da3ff949db6ee8705169f3ab6c2d087633497d4ee1889e3dac1d135d53ae0bd25aace031374a23a19a6fcbaad
-  data.tar.gz: f4d0775f78dea54d1cd5ac739ecf17fe12169d39f9123fac195b1159b9e7e0c1291622782a76e4b703978445dc17a994d805d4149bb6664496812b2bb960c4c0
+  metadata.gz: e25e523c96e28bc7296b7038bb4a9850ba6804f197ed3388a67c85a948a6ae0b1d5632deb2ae30ad665ee3fc5c8528accae97678b3847e386494d49818d31c49
+  data.tar.gz: 36f5a150a52eb7fb8f74e3044f14d6f08850ee17af0e9ff9d017653ac7df3ac0c9ff9ec48f46ac4c159c1b7d8bac89d9bd22590dec6f871514177f6419b1d981

data/bake/modernize/gemspec.rb

@@ -24,7 +24,6 @@ def update(path: default_gemspec_path, output: $stdout)
 	spec = ::Gem::Specification.load(path)
 	
 	root = File.dirname(path)
-	signing = Bake::Modernize::Signing.new(spec)
 	version_path = version_path(root, spec.name)
 	
 	constant = File.read(File.join(root, version_path))
@@ -52,14 +51,6 @@ def update(path: default_gemspec_path, output: $stdout)
 	output.puts "\tspec.authors = #{spec.authors.inspect}"
 	output.puts "\tspec.license = #{spec.license.inspect}"
 	
-	certificate_path = File.expand_path("release.cert", root)
-	
-	if File.exist?(certificate_path)
-		output.puts "\t"
-		output.puts "\tspec.cert_chain  = [\"release.cert\"]"
-		output.puts "\tspec.signing_key = #{signing.private_key_expression}"
-	end
-	
 	if spec.homepage and !spec.homepage.empty?
 		output.puts "\t"
 		output.puts "\tspec.homepage = #{spec.homepage.inspect}"
@@ -201,6 +192,7 @@ end
 GITHUB_PROJECT = /github.com\/(?<account>.*?)\/(?<project>.*?)(\/|\Z)/
 
 def update_metadata(spec)
+	spec.metadata.delete("signing_owner")
 	spec.metadata["bug_tracker_uri"] ||= detect_bug_tracker_uri(spec)
 	spec.metadata["changelog_uri"] ||= detect_changelog_uri(spec)
 	spec.metadata["documentation_uri"] ||= detect_documentation_uri(spec)

data/bake/modernize.rb

@@ -12,7 +12,6 @@ def modernize
 		"modernize:gemfile",
 		"modernize:actions",
 		"modernize:rubocop",
-		"modernize:signing",
 		"modernize:gemspec",
 		"modernize:license",
 		"modernize:contributing",

data/context/getting-started.md

@@ -25,7 +25,7 @@ If `bake-modernize` is already installed, use `bundle update bake-modernize --co
 
 ## Update a gem
 
-Start from an up-to-date checkout with a clean working tree and create a branch for the modernization. Check the gem's supported Ruby versions, CI jobs, release process, signing configuration, and custom Bake tasks before updating them.
+Start from an up-to-date checkout with a clean working tree and create a branch for the modernization. Check the gem's supported Ruby versions, CI jobs, release process, and custom Bake tasks before updating them.
 
 List the available tasks, then run the default modernization from the gem's root directory:
 
@@ -45,7 +45,9 @@ bundle exec bake modernize:license
 bundle exec bake modernize:releases
 ```
 
-Check the resulting Ruby compatibility requirements, gem dependencies, workflow names and required status checks, gemspec file list, signing paths, and release hooks. Preserve custom tasks and project-specific CI. Copyright generation ignores author names ending in `[bot]`; `.mailmap`, `.contributors.yaml`, and human authorship through file renames remain supported.
+Check the resulting Ruby compatibility requirements, gem dependencies, workflow names and required status checks, gemspec file list, and release hooks. Preserve custom tasks and project-specific CI. Copyright generation ignores author names ending in `[bot]`; `.mailmap`, `.contributors.yaml`, and human authorship through file renames remain supported.
+
+Modernization removes legacy `cert_chain`, `signing_key`, and `signing_owner` settings from gemspecs. It does not copy RubyGems signing certificates or configure private keys. Release provenance is provided by Trusted Publishing and the attestations generated by `bake-gem-github`.
 
 Run the project's checks before opening a PR. For gems using the standard Sus, RuboCop, and Decode tasks:
 
@@ -80,7 +82,7 @@ bundle exec bake gem:github:setup:plan
 
 For an existing `config/release.yaml`, use `bundle exec bake gem:github:setup:update` to regenerate managed files instead. Review and commit the generated workflows, rulesets, configuration, and readme changes. Keep the readme's `Making Releases` section short: a release command and a link to [bake-gem-github](https://github.com/socketry/bake-gem-github).
 
-Complete the setup described by [bake-gem-github](https://github.com/socketry/bake-gem-github): configure the RubyGems Trusted Publisher for `release-publish.yaml` and the `rubygems` environment, restrict that environment to the default branch, and install a matching signing key if signing is enabled. Select environment reviewers per repository when a separate publishing approval is wanted, for example `reviewers: [socketry/managers]`. Omitting reviewers leaves the environment's existing reviewer configuration unchanged.
+Complete the setup described by [bake-gem-github](https://github.com/socketry/bake-gem-github): configure the RubyGems Trusted Publisher for `release-publish.yaml` and the `rubygems` environment, and restrict that environment to the default branch. Select environment reviewers per repository when a separate publishing approval is wanted, for example `reviewers: [socketry/managers]`. Omitting reviewers leaves the environment's existing reviewer configuration unchanged.
 
 After the setup PR is merged and the required CI jobs are available, an administrator reviews the plan and runs `bundle exec bake gem:github:setup:apply`. Generating files or upgrading gems does not apply remote settings. Workflow execution approvals, PR reviews, and publishing environment approvals are separate controls.
 

data/context/index.yaml

@@ -7,7 +7,6 @@ metadata:
   changelog_uri: https://github.com/ioquatix/bake-modernize/blob/main/releases.md
   documentation_uri: https://ioquatix.github.io/bake-modernize/
   funding_uri: https://github.com/sponsors/ioquatix/
-  signing_owner: socketry
   source_code_uri: https://github.com/ioquatix/bake-modernize.git
 files:
 - path: getting-started.md

data/lib/bake/modernize/version.rb

@@ -5,6 +5,6 @@
 
 module Bake
 	module Modernize
-		VERSION = "0.65.0"
+		VERSION = "0.66.0"
 	end
 end

data/lib/bake/modernize.rb

@@ -5,7 +5,6 @@
 
 require_relative "modernize/git"
 require_relative "modernize/license"
-require_relative "modernize/signing"
 require_relative "modernize/version"
 
 require "build/files/glob"

data/readme.md

@@ -14,6 +14,10 @@ Please see the [project documentation](https://ioquatix.github.io/bake-modernize
 
 Please see the [project releases](https://ioquatix.github.io/bake-modernize/releases/index) for all releases.
 
+### v0.66.0
+
+  - Remove certificate signing tasks and gemspec settings. GitHub releases use Trusted Publishing and attestations without a separate RubyGems signing key.
+
 ### v0.64.0
 
   - Prefer the configured signing owner or GitHub owner when selecting RubyGems signing certificates and private keys.

data/releases.md

@@ -1,5 +1,9 @@
 # Releases
 
+## v0.66.0
+
+  - Remove certificate signing tasks and gemspec settings. GitHub releases use Trusted Publishing and attestations without a separate RubyGems signing key.
+
 ## v0.64.0
 
   - Prefer the configured signing owner or GitHub owner when selecting RubyGems signing certificates and private keys.

metadata

@@ -1,39 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: bake-modernize
 version: !ruby/object:Gem::Version
-  version: 0.65.0
+  version: 0.66.0
 platform: ruby
 authors:
 - Samuel Williams
 - Olle Jonsson
 - Copilot
 bindir: bin
-cert_chain:
-- |
-  -----BEGIN CERTIFICATE-----
-  MIIEFDCCAnygAwIBAgIBATANBgkqhkiG9w0BAQsFADAwMREwDwYDVQQKDAhTb2Nr
-  ZXRyeTEbMBkGA1UEAwwSU29ja2V0cnkgUnVieSBHZW1zMB4XDTI2MDkyMTA3NTgx
-  NFoXDTI3MDkyMTA3NTgxNFowMDERMA8GA1UECgwIU29ja2V0cnkxGzAZBgNVBAMM
-  ElNvY2tldHJ5IFJ1YnkgR2VtczCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoC
-  ggGBAM/QgjVgDzDo/xJEQoFvAzcVFP7msnswkhPJB2UDsbxXCZmers5jV512TM5s
-  NwLHfzJiC4DcI5ax9ZYKM9Q+dS21YYagNqjtg3YPyDqR6phoibEA0VoMuInUQW68
-  i5OkCJzYKGD2pYYVZnuFNqyM2ECUvXh/fBmvPoHbncAHhWPaCBH8mQJ8sRNc6+RV
-  SoZZu1Yo/aW1zQ+SpZwad7s1ZmigfDNHKhJ22KwZHk+/5Zw1QXVfcajjswV0Mm2P
-  irgjKN3fyNVkwlly63EBlR4VydT+g9QtJtqh7ee0ThhI+v4wYovf4dbLNcEBTHu1
-  x1pGbXGx/2fBAST5eVwaXIx1V8VU22AJcBk1H2o5/1F0HfbD2HQjmFOA112KUwBW
-  9TtspZD3g6rCQFX53XvL9h6j2y1ukl7s5AdEzOe/x6r1MO8tSDtgcYoF89wgF/88
-  Q/Eski0FckQ+znfESZcFcpzs2sPDoYW6SNVX4tZcNty85Y6WBHfHKio14x63PeyC
-  CG1gMwIDAQABozkwNzAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHQ4EFgQU
-  SuMc0x24Xshtaa8SQVkBr2Z5WzIwDQYJKoZIhvcNAQELBQADggGBABI62ey5lDWm
-  j8jsTQaNBMBb7LbKS3XkBwyL1UNGEwlicp399rJDeuNgVSHqBCZ/nE4yleNjgW9Y
-  N6DKdxXCvXmFUoHvUINeAvThHxmlEGhSfXl1x55xHEig0rEP4jgdjnYdQI4fqeOM
-  zIDN0F3ruArke4Y62SQgWVN7vspdAA41hBIRl1vsvs0KWG8DIVQ8cmR+TG6zjOmK
-  iUiUZGNPnStV1O1xW83c+Ba4Am0krP6/forxDPhRvTehqkVYvMdPfYcICNb5IM58
-  5vaYvuj5AtfZuZWN0F/0KtSphhNC17rh6h8QmuYdMJ1clvlrkiEaO1UjPVwjgtxC
-  x/ARh5X6q0/YTXl4r7EfSJEeqW7qhgu9EUj3mGIPHYdX0Dqih/NgK20F3GvQtTfB
-  7sse0duKBHXONYVwKAsceUVvqtCfyF608bCilCkbhw3QaInRj+BkRQKJ5Tuj2PZR
-  76a/hwaV2wWn5RtAFBaUQzQdo/xTqJ7IkwaFjOZe/QyvyoRjCK9Rdg==
-  -----END CERTIFICATE-----
+cert_chain: []
 date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
@@ -152,17 +127,14 @@ files:
 - bake/modernize/readme.rb
 - bake/modernize/releases.rb
 - bake/modernize/rubocop.rb
-- bake/modernize/signing.rb
 - context/getting-started.md
 - context/index.yaml
 - lib/bake/modernize.rb
 - lib/bake/modernize/git.rb
 - lib/bake/modernize/license.rb
-- lib/bake/modernize/signing.rb
 - lib/bake/modernize/version.rb
 - license.md
 - readme.md
-- release.cert
 - releases.md
 - template/actions/.github/workflows/documentation-coverage.yaml
 - template/actions/.github/workflows/documentation.yaml
@@ -187,7 +159,6 @@ metadata:
   changelog_uri: https://github.com/ioquatix/bake-modernize/blob/main/releases.md
   documentation_uri: https://ioquatix.github.io/bake-modernize/
   funding_uri: https://github.com/sponsors/ioquatix/
-  signing_owner: socketry
   source_code_uri: https://github.com/ioquatix/bake-modernize.git
 rdoc_options: []
 require_paths:

data/bake/modernize/signing.rb

@@ -1,19 +0,0 @@
-# frozen_string_literal: true
-
-# Released under the MIT License.
-# Copyright, 2021-2026, by Samuel Williams.
-
-require "bake/modernize"
-
-def signing(root: Dir.pwd)
-	update(root: root)
-end
-
-def update(root:)
-	signing = Bake::Modernize::Signing.load(root)
-	certificate_path = File.expand_path("release.cert", root)
-	
-	if signing.certificate_path
-		FileUtils.cp(signing.certificate_path, certificate_path)
-	end
-end

data/lib/bake/modernize/signing.rb

@@ -1,85 +0,0 @@
-# frozen_string_literal: true
-
-# Released under the MIT License.
-# Copyright, 2026, by Samuel Williams.
-
-module Bake
-	module Modernize
-		# Resolve the RubyGems signing certificate and private key for a project.
-		class Signing
-			GEM_CREDENTIALS_PATH = File.expand_path("~/.gem")
-			GITHUB_OWNER = %r{\Ahttps?://github\.com/([\w.-]+)/}
-			
-			# Load signing configuration from a project's gemspec.
-			# @parameter root [String] The project root.
-			# @returns [Signing] The signing configuration.
-			def self.load(root)
-				gemspec_path = Dir["*.gemspec", base: root].first
-				gemspec = Gem::Specification.load(File.join(root, gemspec_path)) if gemspec_path
-				
-				return new(gemspec)
-			end
-			
-			# @parameter gemspec [Gem::Specification | Nil] The project gemspec.
-			def initialize(gemspec)
-				@gemspec = gemspec
-			end
-			
-			# The preferred certificate, if available.
-			# @returns [String | Nil] The certificate path.
-			def certificate_path
-				paths = []
-				
-				if owner = signing_owner
-					paths << File.join(GEM_CREDENTIALS_PATH, "#{owner}-release.cert")
-				end
-				
-				paths << File.join(GEM_CREDENTIALS_PATH, "release.cert")
-				return paths.find{|path| File.file?(path)}
-			end
-			
-			# The private key path, preserving an existing gemspec setting.
-			# @returns [String] The private key path.
-			def private_key_path
-				return @gemspec.signing_key if @gemspec&.signing_key
-				
-				if certificate_path = self.certificate_path
-					return certificate_path.sub(/\.cert\z/, ".pem")
-				end
-				
-				return File.join(GEM_CREDENTIALS_PATH, "release.pem")
-			end
-			
-			# Format a private key path for use in a gemspec.
-			# @returns [String] A Ruby expression.
-			def private_key_expression
-				prefix = GEM_CREDENTIALS_PATH + File::SEPARATOR
-				path = self.private_key_path
-				
-				if path.start_with?(prefix)
-					relative_path = path.delete_prefix(prefix)
-					path = "~/.gem/#{relative_path}"
-					return "File.expand_path(#{path.inspect})"
-				end
-				
-				return path.inspect
-			end
-			
-			private
-			
-			def signing_owner
-				return unless @gemspec
-				
-				owner = @gemspec.metadata["signing_owner"]
-				return owner if owner&.match?(/\A[\w.-]+\z/)
-				
-				urls = [@gemspec.metadata["source_code_uri"], @gemspec.homepage].compact
-				urls.each do |url|
-					if match = GITHUB_OWNER.match(url)
-						return match[1]
-					end
-				end
-			end
-		end
-	end
-end

data/release.cert

@@ -1,24 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIEFDCCAnygAwIBAgIBATANBgkqhkiG9w0BAQsFADAwMREwDwYDVQQKDAhTb2Nr
-ZXRyeTEbMBkGA1UEAwwSU29ja2V0cnkgUnVieSBHZW1zMB4XDTI2MDkyMTA3NTgx
-NFoXDTI3MDkyMTA3NTgxNFowMDERMA8GA1UECgwIU29ja2V0cnkxGzAZBgNVBAMM
-ElNvY2tldHJ5IFJ1YnkgR2VtczCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoC
-ggGBAM/QgjVgDzDo/xJEQoFvAzcVFP7msnswkhPJB2UDsbxXCZmers5jV512TM5s
-NwLHfzJiC4DcI5ax9ZYKM9Q+dS21YYagNqjtg3YPyDqR6phoibEA0VoMuInUQW68
-i5OkCJzYKGD2pYYVZnuFNqyM2ECUvXh/fBmvPoHbncAHhWPaCBH8mQJ8sRNc6+RV
-SoZZu1Yo/aW1zQ+SpZwad7s1ZmigfDNHKhJ22KwZHk+/5Zw1QXVfcajjswV0Mm2P
-irgjKN3fyNVkwlly63EBlR4VydT+g9QtJtqh7ee0ThhI+v4wYovf4dbLNcEBTHu1
-x1pGbXGx/2fBAST5eVwaXIx1V8VU22AJcBk1H2o5/1F0HfbD2HQjmFOA112KUwBW
-9TtspZD3g6rCQFX53XvL9h6j2y1ukl7s5AdEzOe/x6r1MO8tSDtgcYoF89wgF/88
-Q/Eski0FckQ+znfESZcFcpzs2sPDoYW6SNVX4tZcNty85Y6WBHfHKio14x63PeyC
-CG1gMwIDAQABozkwNzAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHQ4EFgQU
-SuMc0x24Xshtaa8SQVkBr2Z5WzIwDQYJKoZIhvcNAQELBQADggGBABI62ey5lDWm
-j8jsTQaNBMBb7LbKS3XkBwyL1UNGEwlicp399rJDeuNgVSHqBCZ/nE4yleNjgW9Y
-N6DKdxXCvXmFUoHvUINeAvThHxmlEGhSfXl1x55xHEig0rEP4jgdjnYdQI4fqeOM
-zIDN0F3ruArke4Y62SQgWVN7vspdAA41hBIRl1vsvs0KWG8DIVQ8cmR+TG6zjOmK
-iUiUZGNPnStV1O1xW83c+Ba4Am0krP6/forxDPhRvTehqkVYvMdPfYcICNb5IM58
-5vaYvuj5AtfZuZWN0F/0KtSphhNC17rh6h8QmuYdMJ1clvlrkiEaO1UjPVwjgtxC
-x/ARh5X6q0/YTXl4r7EfSJEeqW7qhgu9EUj3mGIPHYdX0Dqih/NgK20F3GvQtTfB
-7sse0duKBHXONYVwKAsceUVvqtCfyF608bCilCkbhw3QaInRj+BkRQKJ5Tuj2PZR
-76a/hwaV2wWn5RtAFBaUQzQdo/xTqJ7IkwaFjOZe/QyvyoRjCK9Rdg==
------END CERTIFICATE-----