This is such great news for ruby. Here’s hoping with these resources rubygems and bundler can add improved support for signature verification. Rubygems supports gem signing but without a good scheme for trust, key rotation, etc it is not particularly usable. Sprucing this aspect of the ecosystem up would go a long way towards allowing ruby to maintain its historical role at the vanguard of language specific package management.

Another thing I would love to see is the ability to incorporate a signed attestation that a gem was built from a given signed commit. A common dirty trick by supply-chain blackhats is to publish a gem which contains code other than that of the corresponding tag in source control. Given that rubygems has no means to browse package contents other than downloading and extracting the tarballs for manual inspection this means that people typically reference changelog or diff links on source control hosts, despite the fact that those diffs will only be accurate for gems published by good-faith actors following platform norms.

There are a number of ways to fix this and I sure hope one of them gets implemented.