Shopify / ruby-sigstore

Rubygems sigstore signing plugin
Apache License 2.0
7 stars 6 forks source link

Validate file is a gem on signature command #56

Closed aellispierce closed 2 years ago

aellispierce commented 2 years ago

Previously, we could sign any random file. However, when the verification retrieved and verified the signature, it would blow up. This makes it so that the gemminess of a file is verified before we sign it, so that only legit gems can be signed.

Closes https://github.com/Shopify/ruby-sigstore/issues/37