Skip to content

Draft: Use bundler-checksum to verify gems

Dustin Collins requested to merge 361737-run-bundler-checksum into master

What does this MR do and why?

Adds a bundler-checksum bundler plugin that caches checksums for remote gems in a Gemfile.checksum file in this repository. On bundle install the plugin will verify that the checksum shown on Rubygems is the same as what has previously been downloaded, mitigating supply chain problems. If local and remote checksums do not match the bundle command fails.

The bundler-checksum plugin is being developed in this MR: gitlab-org/distribution/bundler-checksum!2 (diffs).

Relates to #361737 (closed)

Screenshots or screen recordings

These are strongly recommended to assist reviewers and reduce the time to merge your change.

How to set up and validate locally

Numbered steps to set up and validate the change are strongly suggested.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Merge request reports