From 2b54344460a304ceec97749c89a205f194429323 Mon Sep 17 00:00:00 2001 From: Shizuo Fujita Date: Mon, 10 Aug 2026 17:40:17 +0900 Subject: [PATCH] Gemfile: use HTTPS for the RubyGems source The gem source was declared as http://rubygems.org, so bundle install fetched dependency metadata and gem archives over plaintext HTTP. That connection is neither encrypted nor authenticated, letting an on-path attacker substitute the index response and serve arbitrary gem code, which Bundler unpacks and loads on developer machines and in CI. Co-Authored-By: Claude Opus 5 (1M context) Signed-off-by: Shizuo Fujita --- Gemfile | 2 +- Gemfile.v0.12 | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Gemfile b/Gemfile index 1aa98e4..3be9c3c 100644 --- a/Gemfile +++ b/Gemfile @@ -1,2 +1,2 @@ -source "http://rubygems.org" +source "https://rubygems.org" gemspec diff --git a/Gemfile.v0.12 b/Gemfile.v0.12 index 2978157..b910d4c 100644 --- a/Gemfile.v0.12 +++ b/Gemfile.v0.12 @@ -1,4 +1,4 @@ -source "http://rubygems.org" +source "https://rubygems.org" gem 'json', '= 1.8.6' gem 'fluentd', '~> 0.12.0'