Push with auto-attestation by hsbt · Pull Request #9325 · ruby/rubygems

hsbt · 2026-02-10T10:09:36Z

What was the end-user or developer problem that led to this PR?

We should expand to use attestation of rubygems. The current toolchain only enabled attestation by https://github.com/rubygems/release-gem or --attestation option with local sigstore json file.

What is your fix for the problem, implemented in this PR?

Integrate rubygems-attestation-patch.rb to gem push command. After that, gem push command perfome:

Enable attestation with sigstore-cli and that result.
When --attestation option provided, gem push only uses that.
When sigstore-cli failed, gem push perform without atttestation
Disable auto-attestation with JRuby or not rubygems.org host

TODO: After merging this, we should avoid to load rubygems-attestation-patch.rb at rubygems/release-gem with RubyGems >= 4.1.

Make sure the following tasks are checked

Describe the problem / feature
Write tests for features and bug fixes
Write code to solve the problem
Make sure you follow the current code style and write meaningful commit messages without tags

Copilot

Pull request overview

This PR adds automatic Sigstore attestation support to gem push (targeting rubygems.org), generating an attestation bundle via sigstore-cli when no --attestation is provided and falling back to a non-attested push if attestation fails.

Changes:

Updated Gem::Commands::PushCommand to push with multipart attestations by default (rubygems.org-only), and retry without attestations on errors.
Added attest! implementation using gem exec sigstore-cli:0.2.2 sign ... --bundle ....
Refactored push command tests to validate multipart attestation requests via a shared helper and added tests for auto-attestation and fallback behavior.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 5 comments.

File	Description
lib/rubygems/commands/push_command.rb	Implements auto-attestation flow, multipart request building, and fallback-to-non-attested push logic.
test/rubygems/test_gem_commands_push_command.rb	Adds/updates tests for multipart attestation requests, auto-attestation behavior, and fallback behavior.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-10T10:13:59Z

lib/rubygems/commands/push_command.rb

@@ -92,23 +92,64 @@ def send_gem(name)
  private

  def send_push_request(name, args)


The early return for RUBY_ENGINE == "jruby" || !attestation_supported_host? skips all attestation, including when the user explicitly passes --attestation. That changes existing behavior and also contradicts the PR description (“When --attestation option provided, gem push only uses that.”). Consider only disabling auto attestation here (i.e., still call send_push_request_with_attestation when options[:attestations].any?), and gate the attest! path separately for JRuby/unsupported hosts.

Suggested change

def send_push_request(name, args)

def send_push_request(name, args)

if options[:attestations].any?

begin

return send_push_request_with_attestation(name, args)

rescue StandardError => e

alert_warning "Failed to push with attestation, retrying without attestation.\n#{e.full_message}"

return send_push_request_without_attestation(name, args)

end

end

Copilot · 2026-02-10T10:13:59Z

lib/rubygems/commands/push_command.rb

+    begin
+      send_push_request_with_attestation(name, args)
+    rescue StandardError => e
+      alert_warning "Failed to push with attestation, retrying without attestation.\n#{e.full_message}"


alert_warning includes e.full_message, which typically contains a full backtrace and can be extremely verbose/noisy (and may leak local paths). Consider logging only e.message by default and printing the full backtrace only under Gem.configuration.really_verbose (or similar), while still retrying without attestation.

Suggested change

alert_warning "Failed to push with attestation, retrying without attestation.\n#{e.full_message}"

message = "Failed to push with attestation, retrying without attestation."

if Gem.configuration.really_verbose

message = "#{message}\n#{e.full_message}"

else

message = "#{message}\n#{e.message}"

end

alert_warning message

Copilot · 2026-02-10T10:14:00Z

lib/rubygems/commands/push_command.rb

+    bundle = "#{name}.sigstore.json"
+    env = defined?(Bundler.unbundled_env) ? Bundler.unbundled_env : ENV.to_h
+    out, st = Open3.capture2e(
+      env,
+      Gem.ruby, "-S", "gem", "exec",
+      "sigstore-cli:0.2.2", "sign", name, "--bundle", bundle,
+      unsetenv_others: true
+    )
+    raise Gem::Exception, "Failed to sign gem:\n\n#{out}" unless st.success?
+
+    bundle
+  end


attest! writes the bundle to a deterministic path next to the gem file (#{name}.sigstore.json) and never cleans it up. This can overwrite an existing file and leaves artifacts behind after a successful push. Consider using a Tempfile/tmpdir for the bundle (or at least avoid overwriting existing files) and deleting it after the multipart request is constructed/sent.

@copilot open a new pull request to apply changes based on this feedback

Copilot · 2026-02-10T10:14:00Z

lib/rubygems/commands/push_command.rb

+  def attestation_supported_host?
+    (@host || Gem.host) == "https://rubygems.org"
  end


attestation_supported_host? uses exact string equality against "https://rubygems.org". If the host is configured as https://rubygems.org/ (trailing slash) or otherwise equivalent, auto-attestation will be incorrectly disabled. Consider normalizing/parsing the URI (scheme + host) or comparing against Gem::DEFAULT_HOST after normalization.

Copilot · 2026-02-10T10:14:00Z

test/rubygems/test_gem_commands_push_command.rb

+  def test_execute_attestation_auto
+    @response = "Successfully registered gem: freewill (1.0.0)"
+    @fetcher.data["#{Gem.host}/api/v1/gems"] = HTTPResponseFactory.create(body: @response, code: 200, msg: "OK")

-    p1 = parts.shift
-    p2 = parts.shift
-    assert_equal "\r\n", parts.shift
-    assert_empty parts
+    attestation_path = "#{@path}.sigstore.json"
+    File.write(attestation_path, "auto-attestation")
+    @cmd.options[:args] = [@path]

-    assert_equal [
-      "Content-Disposition: form-data; name=\"gem\"; filename=\"#{@path}\"",
-      "Content-Type: application/octet-stream",
-      nil,
-      Gem.read_binary(@path),
-    ].join("\r\n").b, p1
-    assert_equal [
-      "Content-Disposition: form-data; name=\"attestations\"",
-      nil,
-      "[#{Gem.read_binary("#{@path}.sigstore.json")}]",
-    ].join("\r\n").b, p2
+    @cmd.stub(:attest!, attestation_path) do
+      @cmd.execute
+    end
+
+    assert_equal Gem::Net::HTTP::Post, @fetcher.last_request.class
+    content_length = @fetcher.last_request["Content-Length"].to_i
+    assert_equal content_length, @fetcher.last_request.body.length
+    assert_attestation_multipart Gem.read_binary(attestation_path)
+  end
+
+  def test_execute_attestation_fallback
+    @response = "Successfully registered gem: freewill (1.0.0)"
+    @fetcher.data["#{Gem.host}/api/v1/gems"] = HTTPResponseFactory.create(body: @response, code: 200, msg: "OK")
+
+    @cmd.options[:args] = [@path]
+
+    @cmd.stub(:attest!, proc { raise Gem::Exception, "boom" }) do
+      use_ui @ui do
+        @cmd.execute
+      end
+    end


New behavior adds branching for skipping auto-attestation on JRuby and on non-rubygems.org hosts, but the tests added here only cover the auto-attestation happy path and the fallback-on-error path. Add coverage that verifies: (1) on a non-rubygems.org host, attest! is not called and the request is a raw application/octet-stream push, and (2) on JRuby (can be simulated by stubbing RUBY_ENGINE access), auto-attestation is skipped.

@copilot open a new pull request to apply changes based on this feedback

Copilot · 2026-02-10T10:15:28Z

@hsbt I've opened a new pull request, #9326, to work on those changes. Once the pull request is ready, I'll request review from you.

Copilot · 2026-02-10T10:23:10Z

@hsbt I've opened a new pull request, #9327, to work on those changes. Once the pull request is ready, I'll request review from you.

Co-authored-by: hsbt <12301+hsbt@users.noreply.github.com>

colby-swandale · 2026-02-19T22:48:17Z

I'm not sure making Attestations the default path going forward would be a net positive in its current form. I don't have the stats in front of me, but I believe the vast majority of gem pushes to rubygems.org are still from local dev machines, so the vast majority of gem push will start showing “Failed to push with attestation, retrying without attestation” on every push, which could confuse users. And even when sigstore-cli is installed, it will still fail, since rubygems.org rejects anything not published via GitHub Actions (as of now).

hsbt added 3 commits February 10, 2026 18:11

Merge rubygems-attestation-patch.rb from rubygems/release-gem

5c2b561

Refactor push request to support attestations

24bd719

Added test for auto-attestation

580814f

Copilot AI review requested due to automatic review settings February 10, 2026 10:09

Copilot started reviewing on behalf of hsbt February 10, 2026 10:10 View session

hsbt added the rubygems: feature label Feb 10, 2026

Copilot AI reviewed Feb 10, 2026

View reviewed changes

Copilot AI mentioned this pull request Feb 10, 2026

Add test coverage for auto-attestation skipping on non-rubygems.org hosts and JRuby #9326

Merged

4 tasks

Copilot AI mentioned this pull request Feb 10, 2026

Use Tempfile for auto-attestation bundles to avoid file conflicts and cleanup issues #9327

Merged

4 tasks

Copilot AI and others added 4 commits February 10, 2026 19:32

Add test coverage for skipping auto-attestation

59ca60d

Co-authored-by: hsbt <12301+hsbt@users.noreply.github.com>

Remove raise from stub to rely on flag for test assertions

3c15708

Co-authored-by: hsbt <12301+hsbt@users.noreply.github.com>

Use Tempfile for auto-attestation bundles and clean up after use

c8765d7

Co-authored-by: hsbt <12301+hsbt@users.noreply.github.com>

Omit tests of auto-attestation with JRuby

da9e8e4

hsbt force-pushed the push-with-attestation branch from 9f87b0f to da9e8e4 Compare February 10, 2026 10:35

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Comments

Push with auto-attestation#9325

Push with auto-attestation#9325
hsbt wants to merge 7 commits intomasterfrom
push-with-attestation

hsbt commented Feb 10, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 10, 2026

Uh oh!

Copilot AI Feb 10, 2026

Uh oh!

Copilot AI Feb 10, 2026

Uh oh!

hsbt Feb 10, 2026

Uh oh!

Copilot AI Feb 10, 2026

Uh oh!

Copilot AI Feb 10, 2026

Uh oh!

hsbt Feb 10, 2026

Uh oh!

Copilot AI commented Feb 10, 2026

Uh oh!

Copilot AI commented Feb 10, 2026

Uh oh!

colby-swandale commented Feb 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		@@ -92,23 +92,64 @@ def send_gem(name)
		private

		def send_push_request(name, args)

-      alert_warning "Failed to push with attestation, retrying without attestation.\n#{e.full_message}"
+      message = "Failed to push with attestation, retrying without attestation."
+      if Gem.configuration.really_verbose
+        message = "#{message}\n#{e.full_message}"
+      else
+        message = "#{message}\n#{e.message}"
+      end
+      alert_warning message

Uh oh!

Comments

Conversation

hsbt commented Feb 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What was the end-user or developer problem that led to this PR?

What is your fix for the problem, implemented in this PR?

Make sure the following tasks are checked

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

hsbt Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

hsbt Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Feb 10, 2026

Uh oh!

Copilot AI commented Feb 10, 2026

Uh oh!

colby-swandale commented Feb 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

hsbt commented Feb 10, 2026 •

edited

Loading