RubyGems VS SharpZipLib

The following code snippet highlights the real-life use case that inspired me to build a continuous aggregates macro for better time-series data aggregations. It’s part of a RubyGems contribution I made, and it’s still a work in progress. However, it’s worth validating how this idea can reduce the Ruby code you’ll have to maintain.

However, let's examine a typical partial, such as the one from the . rubygems.org search show page

github.com/rubygems/rubygems.org (26k lines): Where Ruby gems are hosted.

If anyone is looking to do some open source contributions on a mature, production Ruby on Rails site, I highly recommend contributing to the rubygems.org project. The code is extremely clean and the repo is very, very well run.

https://github.com/rubygems/rubygems.org

RubyGems does have gem signing, but it's not widely used.

There's a proposal for a new "one button" approach using sigstore[0].

Other ecosystems are also looking at sigstore too, and a lot of us are cooperating in the OpenSSF Securing Software Repos WG [1]. Package signing is a regular topic of discussion and there are various efforts underway.

Disclosure: I am involved with both of these.

[0] https://github.com/rubygems/rubygems.org/pull/2944

[1] https://github.com/ossf/wg-securing-software-repos

You need a ZIP library that supports writing this NTFS extra field. I came across SharpZipLib. It hasn’t been updated since August 2023, but it works perfectly fine for a server-side packaging solution.

Not python but I have story of team that depended on a C# library for saving zip files (SharpZipLib); turns out SharpZipLib had an issue: it could corrupt zip files ( https://github.com/icsharpcode/SharpZipLib/issues/391 ). This was a desktop app and reports from users came pouring in about they not being able to open their files. In response the company had to first manually recover their user's data; and nowadays they stress test sharpziplib to make sure it does not produce corrupted files in newer versions.