Skip to content

Commit d380e5f

Browse files
Watson1978claude
andauthored
Gemfile: use HTTPS for the RubyGems source (#180)
The gem source was declared as `http://rubygems.org`, so `bundle install` fetched dependency metadata and gem archives over plaintext HTTP. That connection is neither encrypted nor authenticated, letting an on-path attacker substitute the index response and serve arbitrary gem code, which Bundler unpacks and loads on developer machines and in CI. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Signed-off-by: Shizuo Fujita <fujita@clear-code.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
1 parent 57b999f commit d380e5f

2 files changed

Lines changed: 2 additions & 2 deletions

File tree

Gemfile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
1-
source "http://rubygems.org"
1+
source "https://rubygems.org"
22
gemspec

Gemfile.v0.12

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
source "http://rubygems.org"
1+
source "https://rubygems.org"
22

33
gem 'json', '= 1.8.6'
44
gem 'fluentd', '~> 0.12.0'

0 commit comments

Comments
 (0)