gemsmith 19.5.1 → 19.5.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dc3a0499a53c54d89593afe7c592fd22d9a27278d0aa061716dfd3a6b811cea1
-  data.tar.gz: 06bf7794ef447198c05297c57da2719eda6cb57e4311ea8c3a7ee88a2efeedce
+  metadata.gz: b0bab61fb9a27a5e8d869fb0dadcd0c8e50783e7a5774bca1ef860aa63312563
+  data.tar.gz: d5709a594be8f2f26d68c203be0b79abc49f06131bebf39a15af11f41e8fc799
 SHA512:
-  metadata.gz: bdf22fbd50a35af130baa5cf843a89c89587b7b59ea680463e39632b15e80e90b7db4c48abbe64fdca1c9b6aa14892e1bbc59c0f6d11c5580987819a4184e208
-  data.tar.gz: 152610ac1b68aa77b42983dbfbfe24f4b746b0a7a1c3b13400b4dba7a81a37728c16baae36858964eb044f3a5df9598af060d0321b68d9ecd80e1a896a541e16
+  metadata.gz: 5c1410312afb797e4f59d8d06aa4de04f4bcfab090935ec16c557e615db40238ceb59f73260eb10fdd0419b7d8cddd2fc747d4d5a44ceb82f7c6d3c5b060436e
+  data.tar.gz: 1467120baf6b1d6a561d8920ad930afb9b98c5ee73fb2970b2e5a51d470594097a5b683476c088b170b215aaec60aadf1dc7b6abc27e26e995b48cc3e7da062f

data/README.adoc

@@ -2,6 +2,8 @@
 :toclevels: 5
 :figure-caption!:
 
+:ruby_gems_link: link:https://rubygems.org[RubyGems]
+
 = Gemsmith
 
 Gemsmith is a command line interface for smithing Ruby gems. Perfect for when you need a
@@ -23,7 +25,7 @@ toc::[]
 
 . A UNIX-based system.
 . link:https://www.ruby-lang.org[Ruby].
-. link:https://rubygems.org[RubyGems].
+. {ruby_gems_link}.
 
 == Setup
 
@@ -291,13 +293,20 @@ To create a certificate for your gems, run the following:
 
 [source,bash]
 ----
-cd ~/.ssh
-gem cert --build you@example.com
-chmod 600 gem-*.pem
+cd ~/.gem
+gem cert --build you@example.com --days 730
+gem cert --add gem-public_cert.pem
+cp gem-public_cert.pem <path/to/server/public/folder>/gems.pem
 ----
 
-The resulting `.pem` key files can be referenced via the `signing_key` and `cert_chain` of your
-`.gemspec` which Gemsmith provides for you via the `--security` build option. Example:
+The above breaks down as follows:
+
+* *Source*: The `~/.gem` directory is where your credentials and certificates are stored. This is also where the `Gem.default_key_path` and `Gem.default_cert_path` methods look for your certificates. I'll talk more about these shortly.
+* *Build*: Builds your `gem-private_key.pem` and `gem-public_cert.pem` certificates with a two year duration (i.e. `365 * 2`) before expiring. You can also see this information on the {ruby_gems_link} page for your gem (scroll to the bottom). Security-wise, this isn't great but the way {ruby_gems_link} certification is implemented and enforced is weak to begin with. Regardless, this is important to do in order to be a good citizen within the ecosystem. You'll also be prompted for a private key passphrase so make sure it is long and complicated and then store it in your favorite password manager.
+* *Add*: Once your public certificate has been built, you'll need to add it to your registry so {ruby_gems_link} can look up and verify your certificate upon gem install.
+* *Web*: You'll need to copy your public certificate to the public folder of your web server so you can host this certificate for others to install. I rename my public certificate as `gems.pem` to keep the URL simple but you can name it how you like and document usage for others. For example, here's how you'd add my public certificate (same as done locally but via a URL this time): `gem cert --add <(curl --compressed --location https://alchemists.io/gems.pem)`.
+
+Earlier, I mentioned `Gem.default_key_path` and `Gem.default_cert_path` are paths to where your certificates are stored in your `~/.gem` directory. Well, the `signing_key` and `cert_chain` of your `.gemspec` needs to use these paths. Gemsmith automates for you when the `--security` build option is used (enabled by default). For example, when using Gemsmith to build a new gem, you'll see the following configuration generated in your `.gemspec`:
 
 [source,ruby]
 ----
@@ -310,13 +319,19 @@ Gem::Specification.new do |spec|
 end
 ----
 
-To learn more about gem certificates, read about RubyGems
-link:https://guides.rubygems.org/security[Security].
+The above wires all of this functionality together so you can easily build and publish your gems with minimal effort while increasing your security. 🎉 To test the security of your newly minted gem, you can install it with the `--trust-policy` set to high security for maximum benefit. Example:
+
+[source,bash]
+----
+gem install <your_gem> --trust-policy HighSecurity
+----
+
+To learn more about gem certificates, check out the RubyGems
+link:https://guides.rubygems.org/security[Security] documentation.
 
 === Private Gem Servers
 
-By default, the following command will publicly publish your gem to
-link:https://rubygems.org[RubyGems]:
+By default, the following command will publicly publish your gem to {ruby_gems_link}:
 
 [source,bash]
 ----

data/gemsmith.gemspec

@@ -2,7 +2,7 @@
 
 Gem::Specification.new do |spec|
   spec.name = "gemsmith"
-  spec.version = "19.5.1"
+  spec.version = "19.5.2"
   spec.authors = ["Brooke Kuhlmann"]
   spec.email = ["brooke@alchemists.io"]
   spec.homepage = "https://alchemists.io/projects/gemsmith"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: gemsmith
 version: !ruby/object:Gem::Version
-  version: 19.5.1
+  version: 19.5.2
 platform: ruby
 authors:
 - Brooke Kuhlmann
@@ -10,25 +10,32 @@ bindir: exe
 cert_chain:
 - |
   -----BEGIN CERTIFICATE-----
-  MIIC/jCCAeagAwIBAgIBBTANBgkqhkiG9w0BAQsFADAlMSMwIQYDVQQDDBpicm9v
-  a2UvREM9YWxjaGVtaXN0cy9EQz1pbzAeFw0yMjAzMTkxNzI0MzJaFw0yMzAzMTkx
-  NzI0MzJaMCUxIzAhBgNVBAMMGmJyb29rZS9EQz1hbGNoZW1pc3RzL0RDPWlvMIIB
-  IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6l1qpXTiomH1RfMRloyw7MiE
-  xyVx/x8Yc3EupdH7uhNaTXQGyORN6aOY//1QXXMHIZ9tW74nZLhesWMSUMYy0XhB
-  brs+KkurHnc9FnEJAbG7ebGvl/ncqZt72nQvaxpDxvuCBHgJAz+8i5wl6FhLw+oT
-  9z0A8KcGhz67SdcoQiD7qiCjL/2NTeWHOzkpPrdGlt088+VerEEGf5I13QCvaftP
-  D5vkU0YlAm1r98BymuJlcQ1qdkVEI1d48ph4kcS0S0nv1RiuyVb6TCAR3Nu3VaVq
-  3fPzZKJLZBx67UvXdbdicWPiUR75elI4PXpLIic3xytaF52ZJYyKZCNZJhNwfQID
-  AQABozkwNzAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHQ4EFgQU0nzow9vc
-  2CdikiiE3fJhP/gY4ggwDQYJKoZIhvcNAQELBQADggEBAJbbNyWzFjqUNVPPCUCo
-  IMrhDa9xf1xkORXNYYbmXgoxRy/KyNbUr+jgEEoWJAm9GXlcqxxWAUI6pK/i4/Qi
-  X6rPFEFmeObDOHNvuqy8Hd6AYsu+kP94U/KJhe9wnWGMmGoNKJNU3EkW3jM/osSl
-  +JRxiH5t4WtnDiVyoYl5nYC02rYdjJkG6VMxDymXTqn7u6HhYgZkGujq1UPar8x2
-  hNIWJblDKKSu7hA2d6+kUthuYo13o1sg1Da/AEDg0hoZSUvhqDEF5Hy232qb3pDt
-  CxDe2+VuChj4I1nvIHdu+E6XoEVlanUPKmSg6nddhkKn2gC45Kyzh6FZqnzH/CRp
-  RFE=
+  MIIEeDCCAuCgAwIBAgIBATANBgkqhkiG9w0BAQsFADBBMQ8wDQYDVQQDDAZicm9v
+  a2UxGjAYBgoJkiaJk/IsZAEZFgphbGNoZW1pc3RzMRIwEAYKCZImiZPyLGQBGRYC
+  aW8wHhcNMjMwMzIyMTYxNDQxWhcNMjUwMzIxMTYxNDQxWjBBMQ8wDQYDVQQDDAZi
+  cm9va2UxGjAYBgoJkiaJk/IsZAEZFgphbGNoZW1pc3RzMRIwEAYKCZImiZPyLGQB
+  GRYCaW8wggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQCro8tj5/E1Hg88
+  f4qfiwPVd2zJQHvdYt4GHVvuHRRgx4HGhJuNp+4BId08RBn7V6V1MW6MY3kezRBs
+  M+7QOQ4b1xNLTvY7FYQB1wGK5a4x7TTokDrPYQxDB2jmsdDYCzVbIMrAvUfcecRi
+  khyGZCdByiiCl4fKv77P12tTT+NfsvXkLt/AYCGwjOUyGKTQ01Z6eC09T27GayPH
+  QQvIkakyFgcJtzSyGzs8bzK5q9u7wQ12MNTjJoXzW69lqp0oNvDylu81EiSUb5S6
+  QzzPxZBiRB1sgtbt1gUbVI262ZDq1gR+HxPFmp+Cgt7ZLIJZAtesQvtcMzseXpfn
+  hpmm0Sw22KGhRAy/mqHBRhDl5HqS1SJp2Ko3lcnpXeFResp0HNlt8NSu13vhC08j
+  GUHU9MyIXbFOsnp3K3ADrAVjPWop8EZkmUR3MV/CUm00w2cZHCSGiXl1KMpiVKvk
+  Ywr1gd2ZME4QLSo+EXUtLxDUa/W3xnBS8dBOuMMz02FPWYr3PN8CAwEAAaN7MHkw
+  CQYDVR0TBAIwADALBgNVHQ8EBAMCBLAwHQYDVR0OBBYEFAFgmv0tYMZnItuPycSM
+  F5wykJEVMB8GA1UdEQQYMBaBFGJyb29rZUBhbGNoZW1pc3RzLmlvMB8GA1UdEgQY
+  MBaBFGJyb29rZUBhbGNoZW1pc3RzLmlvMA0GCSqGSIb3DQEBCwUAA4IBgQAX+EGY
+  9RLYGxF1VLZz+G1ACQc4uyrCB6kXwI06kzUa5dF9tPXqTX9ffnz3/W8ck2IQhKzu
+  MKO2FVijzbDWTsZeZGglS4E+4Jxpau1lU9HhOIcKolv6LeC6UdALTFudY+GLb8Xw
+  REXgaJkjzzhkUSILmEnRwEbY08dVSl7ZAaxVI679vfI2yapLlIwpbBgmQTiTvPr3
+  qyyLUno9flYEOv9fmGHunSrM+gE0/0niGTXa5GgXBXYGS2he4LQGgSBfGp/cTwMU
+  rDKJRcusZ12lNBeDfgqACz/BBJF8FLodgk6rGMRZz7+ZmjjHEmpG5bQpR6Q2BuWL
+  XMtYk/QzaWuhiR7pWjiF8jbdd7RO6or0ohq7iFkokz/5xrtQ/vPzU2RQ3Qc6YaKw
+  3n5C8/6Zh9DYTkpcwPSuIfAga6wf4nXc9m6JAw8AuMLaiWN/r/2s4zJsUHYERJEu
+  gZGm4JqtuSg8pYjPeIJxS960owq+SfuC+jxqmRA54BisFCv/0VOJi7tiJVY=
   -----END CERTIFICATE-----
-date: 2023-03-07 00:00:00.000000000 Z
+date: 2023-03-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: cogger
@@ -293,7 +300,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.7
+rubygems_version: 3.4.9
 signing_key:
 specification_version: 4
 summary: A command line interface for smithing Ruby gems.