From 6e1724af9eaa585ad07f2a6da2a99c6fd7d072ea Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 23 Jul 2026 05:21:43 +0000 Subject: [PATCH] Harden gemspec with MFA requirement and metadata URIs Add supply-chain hardening metadata to bunko.gemspec ahead of the public RubyGems release: - rubygems_mfa_required: require MFA to push the gem to rubygems.org - source_code_uri: link to the source repository - bug_tracker_uri: link to the issue tracker Closes #67 Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01Rbmv18Gwr12r5CYH9SUvcn --- CHANGELOG.md | 3 +++ bunko.gemspec | 3 +++ 2 files changed, 6 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index b85d562..157da97 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,9 @@ Building toward 1.0.0 release. Using 0.x versions during active development. **Fixed:** - `PagesController` now reads the page slug from the route's `defaults: {page: ...}` (via `params[:page]`) instead of parsing `request.path`, fixing 404s for root-path pages (`bunko_page :home, path: "/"`) and pages with custom paths (`bunko_page :about, path: "about-us"`) (#57) +**Security:** +- Gemspec hardening: require MFA for RubyGems pushes (`rubygems_mfa_required`) and add `source_code_uri` and `bug_tracker_uri` metadata. + ## [0.2.0] - 2025-11-14 First functional release of Bunko - a lightweight Rails CMS based on the "one model, infinite collections" philosophy. diff --git a/bunko.gemspec b/bunko.gemspec index 7c3e06b..7cf7ada 100644 --- a/bunko.gemspec +++ b/bunko.gemspec @@ -15,7 +15,10 @@ Gem::Specification.new do |spec| spec.required_ruby_version = ">= 4.0" spec.metadata["homepage_uri"] = spec.homepage + spec.metadata["source_code_uri"] = spec.homepage spec.metadata["changelog_uri"] = "https://github.com/kanejamison/bunko/blob/main/CHANGELOG.md" + spec.metadata["bug_tracker_uri"] = "#{spec.homepage}/issues" + spec.metadata["rubygems_mfa_required"] = "true" # Specify which files should be added to the gem when it is released. # The `git ls-files -z` loads the files in the RubyGem that have been added into git.