Five former maintainers of the RubyGems.org, RubyGems, and Bundler projects, including the owner of the Bundler trademark, have announced the creation of an alternative project, Gem Cooperative, which is community-driven and uses an open governance model inspired by the Homebrew project. Currently, the project has launched a gem server, gem.coop, which contains all packages from the RubyGems.org catalog and is synchronized with it. Full compatibility with the RubyGems package management system and the Bundler dependency manager is claimed.
The server currently operates as a RubyGems.org mirror, and package publishing functionality is planned to be added in the coming months. To switch to an alternative server It is enough to replace the value of the source parameter in the gemfile from βhttps://rubygems.orgβ to βhttps://gem.coop.
The founders of the Gem Cooperative were suspended following an incident involving Ruby Central, the non-profit company that oversees the RubyConf conference and is responsible for maintaining the infrastructure for the RubyGems.org service. In September, Ruby Central gained full control of the GitHub repositories where RubyGems is developed, rubygems.org, and Bundler, and decided to expel all external maintainers. Furthermore, external maintainers were denied access to the bundler and rubygems-update gem packages.
The removal of non-contracted Ruby Central maintainers was carried out after consultation with lawyers and based on the results of an infrastructure security audit. Security concerns were cited as the reason for consolidating control. protection from attacks class "supply chain. Ruby Central attempts to minimize access to repositories and prevent individuals who are not directly accountable and responsible from having full privileged access to repositories.
In addition to the forcibly removed maintainers, Ellen Dash is among the founders of the alternative service Gem Cooperative. She resigned from Ruby Central in September and resigned as maintainer in protest of Ruby Central's actions, which she characterized as a hostile takeover of the project. Dash believes Ruby Central's actions were unfair, and that access was denied to dedicated individuals who had earned their reputations and spent over a decade maintaining RubyGems and Bundler.
Joel Drapper, maintainer of the Phlex and Literal gem packages and a former employee of Shopify, a key sponsor of Ruby Central, also views Ruby Central's actions as a takeover of GitHub repositories previously controlled by the community. He argues that Ruby Central, which powers RubyGems.org, had no need to appropriate the github.com/rubygems repositories because it had full control over the code used to run RubyGems.org. Appropriating repositories containing code used to run the service is comparable to appropriating a function library simply because it is used in an application.
Meanwhile, another conflict is brewing in the Ruby developer community: an open letter has been published calling for a fork of the Ruby on Rails framework, independent of its creator, David Heinemeier Hansson. Heinemeier Hansson is accused of making racist and transphobic remarks unbecoming of a community leader (for example, his racist remarks boil down to a post in which he mentioned that London is no longer full of British people). The open letter has already been signed by over 140 people. Among the signatories are Tim Bray (co-author of the XML specification), Jeff Atwood (co-founder of Stack Overflow and Discourse), and Evgeny Rochko (creator of the social network Mastodon).
Source: opennet.ru
