Wg-securing-software-repos Alternatives
Similar projects and alternatives to wg-securing-software-repos
-
-
-
InfluxDB
Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.
-
-
-
gem-compare
A RubyGems plugin that compares versions of the given gem
-
wg-securing-software-repos reviews and mentions
-
Making popular Ruby packages more secure
RubyGems does have gem signing, but it's not widely used.
There's a proposal for a new "one button" approach using sigstore[0].
Other ecosystems are also looking at sigstore too, and a lot of us are cooperating in the OpenSSF Securing Software Repos WG [1]. Package signing is a regular topic of discussion and there are various efforts underway.
Disclosure: I am involved with both of these.
-
Unauthorized gem takeover for some gems
In particular, check out the Securing Software Repos WG: https://github.com/ossf/wg-securing-software-repos
So far folks have turned up from RubyGems, PyPI, NPM, Maven Central, Drupal and I'm probably forgotten someone.
Stats
ossf/wg-securing-software-repos is an open source project licensed under GNU General Public License v3.0 or later which is an OSI approved license.