Implement `gem install --verify-signatures` as an alias of `gem verify` + `gem install`.

Shopify / ruby-sigstore

Rubygems sigstore signing plugin

Apache License 2.0

7 stars 6 forks source link

Implement `gem install --verify-signatures` as an alias of `gem verify` + `gem install`. #34

Closed rochlefebvre closed 2 years ago

rochlefebvre commented 2 years ago

We currently have a stub implementation for verify_extend.rb. The pre_install hook should be fleshed out to call GemVerifier.run and return from pre_install accordingly.

--verify-signatures makes sense to me, moreso than --verify, but consider whether that's true.

jchestershopify commented 2 years ago

Is this still planned in light of #35 and #51?

jchestershopify commented 2 years ago

Looking at this again today: it predates #35 and #51, where we decided to update the UI to be built around gem signatures. To avoid stray issues I'm going to close this one.