Loading post…
Shopify2023-10-18Explainer
Finding Relationships Between Ruby’s Top 100 Packages and Their Dependencies
Summary
RubyGems’ phased MFA rollout required owners of gems with at least 180 million downloads to use MFA, but raised a supply-chain question: could a popular gem depend on a less-downloaded gem that remained an account-takeover target? The investigation loaded rubygems.org data dumps to identify 112 gems above the threshold, queried the API for direct dependencies, and used Bundler with Gemfile.lock files to resolve transitive dependencies. It found 13 big gems with small direct dependencies and 24 with small dependencies overall, attributing the mismatch mainly to newer dependencies and gems shipped with Ruby, such as racc and rexml. Graph visualizations, breadth-first traversal, and a custom depth-first search then mapped dependency structure and paths; the post leaves open whether to do nothing or enforce MFA early for the 24 technically insecure gems.
Context
RubyGems was gradually rolling out MFA and needed a first cohort that included at least the top 100 gems without allowing packages to fall out later. It set the cohort threshold at 180 million downloads, but this raised the possibility that big gems could depend on smaller gems whose owners were not yet required to use MFA.
Approach / What changed
The investigation used rubygems.org database dumps and a Rails query to identify gems with at least 180 million downloads. It checked direct dependencies through the rubygems.org API, resolved transitive dependencies by generating Gemfiles and Gemfile.lock files with Bundler, and used graph visualizations, breadth-first search, and a custom depth-first search to examine dependency relationships and paths.
Takeaways
The 180 million download threshold produced a list of 112 big gems, while the rubygems.org stats pages did not provide a complete list below the relevant cutoff.
The API identified 13 big gems with small direct dependencies; Bundler’s transitive dependency analysis increased that number to 24.
The post attributes lower download counts mainly to newer dependencies and gems shipped with Ruby, and proposes either waiting for universal MFA or enforcing it early for the 24 affected gems.
Source and freshness
- Source
- shopify.engineering
- Published
- Added to Yomu
- Last updated
Summaries are generated from the original by a language model. Check the original before relying on it.
Keep reading
Related reading
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
The best engineering reads, once a week
One useful email. Unsubscribe anytime.