gemreg

Documentation

Overview

Package gemreg asks RubyGems.org what it knows about the versions a diff introduces:

• Sigstore provenance: RubyGems records attestations per release. A bump that silently DROPS them where every previous release attested is what publishing with a stolen gem-push token looks like — a token thief can publish, but cannot make the project's trusted-publishing pipeline attest. Same three gates as npm/PyPI/crates.io: outgoing pin attested, practice established right below the incoming version, and the release is young (≤30 days) or too new to be indexed.
• The compact index re-verifies Unlisted flags set by the deps.dev layer, which can lag RubyGems by days: a version the index serves is not unlisted; a version RubyGems itself lacks keeps the flag. Yanked gems vanish from the index entirely (RubyGems removes the .gem file), so a bump onto a yanked or admin-deleted (malicious) release is exactly what this flag catches.
• The index also carries authoritative created_at times, so release ages and the ⏱ cooldown flag work even for versions deps.dev has not indexed yet — brand-new releases are precisely the risky ones.

One anonymous GET per changed gem against the compact index (the same Fastly-cached endpoint Bundler itself hammers), plus per-version attestation lookups only for the rare young provenance candidates. Neither endpoint sends CORS headers, so the browser (wasm) build skips this package and keeps its deps.dev-only behaviour for RubyGems.

Index

• Variables
• func Annotate(diffs []diffx.FileDiff, freshDays int) error

Variables

var APIURL = "https://rubygems.org/api/v1"

APIURL is the RubyGems.org API base; a var so tests can fake it.

var IndexURL = "https://index.rubygems.org"

IndexURL is the compact-index base; a var so tests can fake it.

var Now = time.Now

Now is a var so tests can pin the clock.

Functions

func Annotate

func Annotate(diffs []diffx.FileDiff, freshDays int) error

Annotate fills RubyGems registry signals on the diffs; see the package comment for what it flags. Call it AFTER depsdev.Annotate (it re-verifies deps.dev-based Unlisted flags and backfills ages deps.dev lacks). freshDays mirrors the -fresh-days flag for the ⏱ backfill. Best-effort: network errors return an error but leave diffs usable.