Rfcs Alternatives

Similar projects and alternatives to rfcs

rubygems

212 3,550 9.9 Ruby rfcs VS rubygems

Library packaging and distribution for Ruby.
RubyGems

25 2,297 9.8 Ruby rfcs VS RubyGems

The Ruby community's gem hosting service.
WorkOS

workos.com featured

The modern identity platform for B2B SaaS. The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning.
gem-compare

2 247 0.0 Ruby rfcs VS gem-compare

A RubyGems plugin that compares versions of the given gem
wg-securing-software-repos

2 78 6.8 rfcs VS wg-securing-software-repos

OpenSSF Working Group on Securing Software Repositories

NOTE: The number of mentions on this list indicates mentions on common posts plus user suggested alternatives. Hence, a higher number means a better rfcs alternative or higher similarity.

Suggest an alternative to rfcs

rfcs reviews and mentions

Posts with mentions or reviews of rfcs. We have used some of these posts to build our list of alternatives and similar projects. The last one was on 2022-05-07.

Unauthorized gem takeover for some gems
7 projects | news.ycombinator.com | 7 May 2022

Point 2 (Rubygems does not support package signing) is not true.
Rubygems has supported package signing (`gem help cert`) since very early on, and it has an install flag `--trust-policy` which can be used to verify various things, including certs (https://github.com/rubygems/rubygems/blob/96e5cff3df491c4d94...).
The experience in using it, however, sucks on every level. No one can really use the `High Security` policy level, because most gems aren’t signed. Most gems aren’t signed because there’s no clear benefit and it’s non-trivial to have shared certificates that can be used by multiple people authorized to release a particular gem. Most gems aren’t signed because there’s nowhere that public gem certs are published (there used to be with rubyforge), and you have to track down each cert you want to verify and download it separately.
I used to sign my gems, but then stopped.
Shopify has proposed a new RFC for signing gems based on sigstore. This RFC has many of the same points that I have already made as a reason for changing mechanisms. https://github.com/Shopify/rfcs/blob/new-signing-mechanism/t...
I’ve just discovered this, so I haven’t really evaluated it, but I would prefer to sign the gems I publish.