RubyGems VS Canvas LMS

However, let's examine a typical partial, such as the one from the . rubygems.org search show page

github.com/rubygems/rubygems.org (26k lines): Where Ruby gems are hosted.

If anyone is looking to do some open source contributions on a mature, production Ruby on Rails site, I highly recommend contributing to the rubygems.org project. The code is extremely clean and the repo is very, very well run.

https://github.com/rubygems/rubygems.org

In fact, you can now scope API tokens per-gem as well: https://github.com/rubygems/rubygems.org/pull/2944

RubyGems does have gem signing, but it's not widely used.

There's a proposal for a new "one button" approach using sigstore[0].

Other ecosystems are also looking at sigstore too, and a lot of us are cooperating in the OpenSSF Securing Software Repos WG [1]. Package signing is a regular topic of discussion and there are various efforts underway.

Disclosure: I am involved with both of these.

[0] https://github.com/rubygems/rubygems.org/pull/2944

[1] https://github.com/ossf/wg-securing-software-repos

SSH is such a different use case that the analogies break down. With respect, thinking about this for a few minutes should convince you that while TOFU works fine for immutable artifact signatures, it is unworkable for a system where you ever upgrade packages.

Consider that most nontrivial projects on rubygems have multiple maintainers that can publish a version. Normal collaboration models would imply that they each have a personal signing key; sharing a single signing key per project isn’t realistic (as you mentioned, rotation is another reason for this). And TOFU doesn’t work when there are multiple possible keys, such a system requires an external trust chain.

Assume for the sake of argument the above is solved. What exactly do you do when tooling alerts you that an upgraded dependency has changed keys since the last publish? Either you blindly accept the new key or you investigate. If the latter hopefully you have a way to directly contact the author to verify that the rotation was legitimate. Since you probably don’t you should just compare the diff of the published artifacts. But you should have been doing this anyway, so what has the signature bought you here except false security?

I’m all for pragmatic solutions that measurably improve security. I just think changes like https://github.com/rubygems/rubygems.org/pull/2499 and https://github.com/rubygems/rubygems.org/pull/2242 qualify to a much greater extent than thinking of crypto as magic dust that can be sprinkled on a system to increase its security.

This test seems to be a good example of the vulnerability: https://github.com/rubygems/rubygems.org/commit/58c755a7a62a...

See https://github.com/rubygems/rubygems.org/pull/2865 for the web part

> From the replies it sounds like this is talking about client software?

Yes the command line is a client to the rubygems server

> An unattended client should not be able to do WebAuthn as the whole point is that a human is present and authorising the authentication step

You either need a PIN, a fingerprint, a press, or no action just owning the device or the software.

> if I have 100% full of Bob's device I still can't touch the sensor or button to authenticate as Bob.

If you have a perfect copy of a Yubikey or the same fingerprint you should be able to authenticate I think

> OpenSSH works with Yubikeys

Nice, I will look into it

github.com/instructure/canvas-lms (745k lines): A popular LMS (learning management system).

No it's not. From a practical standpoint, I'm not even sure how that could work. You would have to require all browsers to be open source AGPL in order to load a web page served by it. By way of analogy it seems the equivalent of requiring the mouse and keyboard firmware to be licensed the same as the operating system.

A real life example is Instructure, which makes Canvas (which is agpl) but has other proprietary services that interact heavily with it. It's never been a problem

1: https://github.com/instructure/canvas-lms

Not a template, but look at https://github.com/discourse/discourse or https://github.com/instructure/canvas-lms or https://gitlab.com/gitlab-org/gitlab for some good examples.

https://github.com/instructure/canvas-lms - The Canvas source code

Rather than reinventing the wheel, try something like Canvas instead.

Block box tweaks is not what I meant. Have a look at Instructure Canvas (the Learning Management System) as an example of what I did mean. Full and current source is publicly available here: https://github.com/instructure/canvas-lms But the developers make their money by providing the software as SASS to large orgs that want the service, and the funding they get from the SASS product pays for the development of fixes and new features.

I work on Canvas, and we mostly use straight rails migrations. We have some ActiveRecord extensions, linter rules, and careful manual review steps to ensure we do our migrations with minimal locking and other important things to avoid knocking over production databases, and we tag migrations as "predeploy" or "postdeploy" so they run at the correct time relative to when the code is deployed. But we have automation that runs predeploy migrations (just with rake db:migrate:predeploy) across hundreds of databases (and thousands of postgres schemas) before we deploy, and we run the post deploy migrations also automatically after the deploy (with rake db:migrate).

On a similar scale... https://github.com/instructure/canvas-lms/commit/c2cba46851df512ab26e827e4bdad76b848f6db9