Home on The Traveling Engineer

Ruby Release Reproducibility

Tue, 15 Apr 2025 10:52:43 +0900

I wanted to outline a few findings around the reproducibility of the official Ruby releases.

Goals for Binary Gems ("Wheels")

Mon, 24 Feb 2025 04:30:00 +0100

We want to encourage gem authors to ship precompiled binaries of their gems whenever possible (instead of the gem building an extension at install time). This is better for security – no code running at install time, and more ergonomic for users – no need to install build tools, deal with build errors, waiting for slow compilation.

Problem statement: Dealing with gems that have different implementations and requirements across different OSes, CPU architectures, libc Ruby Engines, Ruby versions, (and ruby engine versions) is challenging for both gem authors and consumers.

January 2025 Residency Update

Thu, 30 Jan 2025 22:30:00 -0800

A quick update on what’s been happening in the past month. Abbreviated, since there was both vacation and a sick week somehow squeezed in there.

2024 in Review

Fri, 24 Jan 2025 13:17:12 -0800

2024 was an eventful year, both personally & as the Ruby Central Security Engineer in Residence.

In my first year working full-time on the Ruby packaging ecosystem I shipped some bugs, a few big projects, and built relationships with some incredible folks working in the software supply chain space.

Oh, I also got married. Can’t forget that.

Read on for some of the highlights, keeping in mind that there’s always ongoing maintenance work on Bundler, RubyGems, and RubyGems.org.