rubygems/rubygems.org — pull request #626 by xaviershay (2013-11-23 20:31:43+00:00)
Title: Proof of concept implementation of The Update Framework (TUF).

This allows a gem to be published with TUF metadata, and to be fetched
securely using a custom fetch script.

See the README for details of getting it running.

Still a lot of work remains. Some of the bigger items:

* Numerous TODOs in code.
* Support thresholds.
* Support timestamps and expiry.
* New endpoint allowing developers to uploaded targets for their gems,
delegating to them from recently-claimed role.
* Ability for maintainers to easily promote recently-claimed to claimed.
* Move/integrate most of the TUF code to rubygems client, since it is needed to
fetch gems using the framework.
* Integrate fetching code into actual gem CLI.
* Bundler support.
* Test coverage.
* Update code base to work with latest ruby/rubygems.
* Document emergency procedures, such as re-issuing root.txt.
* High-level documentation tying this implementation to the spec.
* Establish the manual procedure and key distribution for updating the
claimed role.

@tarcieri @nealharris @jkingdon @justine-square @sandersch (note: this is pretty different from the last code I showed you - pretty sure I've settled down on the architecture now.)