Resilience & Security

[NathanZook]

This is a proposal for a substantial project. I want to gauge community support before undertaking work on it.

I want gemstash to be able to satisfy the resilience and security needs of an organization strongly. Specifically, I wish for the following features, which gemstash appears to currently lack.

1. The ability to operate off a whitelist--serve only accepted versions of accepted gems. Allowlist only certain gems to cache #320
   This is not a small piece of work. Generally, we want to fetch everything and log new version availability for review. We need a monitor mode so that devs can pull in new gems & gem versions & trigger a review. We need permissions to update the whitelist.
2. Log (WARN) if a cached version of a gem is yanked. what is the expected behavior when the gem was yanked from rubygems? #291
   Server to be configurable as to whether or not cached gems continue to be served. Erroring out is an option.
   Configuration to be global with individual version overrides
3. Log (WARN) if an upstream gem changes without a version update.
   Both versions kept, but response is configurable.
4. Resolve Support hosts in FIPS mode #194 / GEMSTASH-194 Support for FIPS Mode #195 / added fips flag #290

Implicitly, these change likely require addressing at least #408 and/or #409, #154 , and #67.

The ability to remap gem versions might also be useful.

[martinemde]

This has been on the back of my mind too. I want a gemstash that acts a bit more like a gem firewall.

We should add #392 to this list because without compact index, relying on gemstash as primary gem source will be much slower and lacks checksums.

[LWFlouisa]

Why does this use MD5 for credentials? Thats been deprecated for a long time now.

[simi]

Why does this use MD5 for credentials? Thats been deprecated for a long time now.

Can you share where is MD5 used for credentials?

[LWFlouisa]

Why does this use MD5 for credentials? Thats been deprecated for a long time now.

Can you share where is MD5 used for credentials?

When someone installs Gemstash, when you type authorize, it almost always defaults to MD5, and researching ( with no much results ) on whether it can be configured for SHA2.