Add cryptographic signature to the gem

[cheald]

In light of the recent Rubygems security issues, I think it would be prudent to add a signature to the gem and include it in releases. This isn't something I can issue a PR for, since you (the project owner) would need to own the cert files.

The how-to is here:

http://docs.rubygems.org/read/chapter/21

TL;DR:

1. gem cert --build your@email.com

2. Copy the private key somewhere safe

3. Add the public key to the repo (git add gem-public_cert.pem)

4. Update the gemspec with something like:

   s.signing_key = '/home/chris/.gemcert/gem-private_key.pem'
   s.cert_chain = ['gem-public_cert.pem']

5. Push and rake release

While this would be a self-signed certificate, the presence of the pubkey in the canonical repo will allow people verify that the gem they installed from Rubygems (or where ever) was signed by the project maintainer, and has not been altered.

[pietern]

Thanks for opening this issue. Definitely something to take care of in the short term.

[djanowski]

This method hasn't gained traction, and I still don't see major gems signed. Let's wait until a widely adopted method is in place.