Five former maintainers of the RubyGems.org projects, RubyGems, and Bundler, including the owner of the Bundler trademark, announced the creation of an alternative project — Gem Cooperative, which is community-controlled and uses an open governance model inspired by the Homebrew project. At this stage, the project has launched the gem server gem.coop, containing all packages from the RubyGems.org catalog and synchronized with it. Full compatibility with the RubyGems package management system and the Bundler dependency manager is claimed.
The server is currently operating in mirror mode for RubyGems.org, with functionality for package publication planned to be added in the coming months. To switch to the alternative server it is enough to change the source parameter value in the gemfile from "https://rubygems.org" to "https://gem.coop.
The founders of Gem Cooperative were removed from their positions following an incident with Ruby Central, a non-profit organization overseeing the RubyConf conferences and responsible for maintaining the infrastructure for RubyGems.org. In September, Ruby Central gained full control over the GitHub repositories where RubyGems, rubygems.org, and Bundler are developed and decided to exclude all external maintainers. Additionally, external maintainers were denied access to the gem packages bundler and rubygems-update.
The removal of maintainers who were not working under contract with Ruby Central was carried out after consultations with lawyers and based on the results of a security audit of the infrastructure. The centralization of control in one entity was cited as a concern for security and protection against attacks of the “supply chain” class. Ruby Central is attempting to minimize access to repositories and eliminate full privileged access to repositories by individuals who are unaccountable and bear no direct responsibility.
In addition to the forcibly excluded maintainers, one of the founders of the alternative service Gem Cooperative is Ellen Dash, who resigned from Ruby Central in September and stepped down from her maintainer duties in protest against actions by Ruby Central, which Ellen characterized as a hostile takeover of the project. According to Ellen, Ruby Central's actions were unfair, resulting in deserving individuals losing access — people who earned their reputations and had been supporting RubyGems and Bundler for over ten years.
Joel Drapper, maintainer of the Phlex and Literal gem packages, and a former employee of Shopify, a key sponsor of Ruby Central, also views Ruby Central's actions as a takeover of GitHub repositories that were previously community-controlled. He believes that Ruby Central, which operates RubyGems.org, had no need to appropriate the repositories at github.com/rubygems, as it fully controlled what code to use for the operation of RubyGems.org. Claiming rights to the repositories with the code used to run the service is likened to claiming rights to a library of functions based solely on its use in an application.
Meanwhile, a new conflict is brewing in the Ruby developer community — an open letter has been published calling for a fork of the Ruby on Rails framework, independent of its creator, David Heinemeier Hansson. David is accused of making racist and transphobic remarks unworthy of a community leader (for example, the racist remarks stem from him mentioning in one of his posts that London is no longer full of native Britons). Over 140 participants have already signed the open letter. Among those who signed are Tim Bray (co-author of the XML specification), Jeff Atwood (co-founder of Stack Overflow and Discourse), and Evgeny Rochko (creator of the Mastodon social network).
Source: opennet.ru
