RubyGems VS gemstash

The following code snippet highlights the real-life use case that inspired me to build a continuous aggregates macro for better time-series data aggregations. It’s part of a RubyGems contribution I made, and it’s still a work in progress. However, it’s worth validating how this idea can reduce the Ruby code you’ll have to maintain.

However, let's examine a typical partial, such as the one from the . rubygems.org search show page

github.com/rubygems/rubygems.org (26k lines): Where Ruby gems are hosted.

If anyone is looking to do some open source contributions on a mature, production Ruby on Rails site, I highly recommend contributing to the rubygems.org project. The code is extremely clean and the repo is very, very well run.

https://github.com/rubygems/rubygems.org

RubyGems does have gem signing, but it's not widely used.

There's a proposal for a new "one button" approach using sigstore[0].

Other ecosystems are also looking at sigstore too, and a lot of us are cooperating in the OpenSSF Securing Software Repos WG [1]. Package signing is a regular topic of discussion and there are various efforts underway.

Disclosure: I am involved with both of these.

[0] https://github.com/rubygems/rubygems.org/pull/2944

[1] https://github.com/ossf/wg-securing-software-repos

Sorry to hear. I'd say, never "bundle install" in the init script. If using docker, make "bundle install" an intermediate container. If you have your own servers, try network FS sharing your deps (and see if you're ok with the "require" latencies). Alternatively, use a gem cache proxy. You can use "geminabox" with a rubygems mirror, if you can tolerate the space and long mirroring times, or use a purposed "middleman" proxy, like gemstash, or nexus if your company is multilang.