Sign gem and add bf4.pem

HISTORY.md

@@ -7,6 +7,7 @@ As such, a _Feature_ would map to either major or minor. A _bug fix_ to a patch.
 ### Master
 
 * Features
+  * Signed gem; added certs/bf4.pem
   * Run metrics without shelling out; use Open3.popen3 (Benjamin Fleischer, #157)
     - GemRun runs external libraries, outputs nice error messages
     - GemVersion returns version requirements for a gem dependency; replaces metric_fu_requires

README.md

@@ -12,6 +12,11 @@ If you have trouble installing the gem
 - try adding metric_fu to your Gemfile and bundling.
 - file a ticket on the issues page.
 
+MetricFu is cryptographically signed. To be sure the gem you install hasn't been tampered with:
+- Add my public key (if you haven't already) as a trusted certificate `gem cert --add <(curl -Ls https://raw.github.com/metricfu/metric_fu/master/certs/bf4.pem)`
+- `gem install metric_fu -P HighSecurity`
+- This may cause installation to fail if non-signed dependent gems are also being installed.
+
 ## Usage
 
 From your application root. Running via Rake is still supported.

certs/bf4.pem

@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDjjCCAnagAwIBAgIBATANBgkqhkiG9w0BAQUFADBGMQwwCgYDVQQDDANkZXYx
+ITAfBgoJkiaJk/IsZAEZFhFiZW5qYW1pbmZsZWlzY2hlcjETMBEGCgmSJomT8ixk
+ARkWA2NvbTAeFw0xMzExMDcyMTQ0MDBaFw0xNDExMDcyMTQ0MDBaMEYxDDAKBgNV
+BAMMA2RldjEhMB8GCgmSJomT8ixkARkWEWJlbmphbWluZmxlaXNjaGVyMRMwEQYK
+CZImiZPyLGQBGRYDY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
+ncZFu7VMbliIBhiGj6J5aKXSuHF6gXZuA8gkpgM7dgVzkLhuud6hSYXoC8UZIr+M
+N9hvV/F2F3gLlj2J7aLHr8C0for4KVjc5N/b249vGoH9nIl0qZVE3qI+R7MIdYlO
+ONoeHgiymSKyssCzGFRzv8ZVrpWuUmcB3qixb6d2aiv1kcsZZnLjY4EO5jVW9X92
+d9VMuNdYYtZ0l88prmUM+1fVfaDdY+KGrigeffHUGD0j7pHOZnRCYKwGHG/7Nkg8
+0vEtYVBKSpHIQThBMWXIQu69gIpr6AmQd/kVnhejAdQgvsDz43n9h5iZvrwcedWY
+x2wz+FrUdJzZZhitUFGrnwIDAQABo4GGMIGDMAkGA1UdEwQCMAAwCwYDVR0PBAQD
+AgSwMB0GA1UdDgQWBBTGwGJtyo8nUoRuxbYfcI5bzuHL3zAkBgNVHREEHTAbgRlk
+ZXZAYmVuamFtaW5mbGVpc2NoZXIuY29tMCQGA1UdEgQdMBuBGWRldkBiZW5qYW1p
+bmZsZWlzY2hlci5jb20wDQYJKoZIhvcNAQEFBQADggEBAI/gyzcFn4XvrzXhqKWc
+zLUbOp0349rVIF6f0PlQvf3ZJZS76HKZ2EqSQJwzpcAboypvsRWk0kVmOwvzae4Y
+bB0ac2WuRf7AntS84VkZQmI/1AIxkaQUIQvHJacaw8yJKNggbDBKugHjcrIWWg2V
+vDvyjvJx4sQFpJ84LSDbAVkB92YaP6CUwoeXwrcsvvfrvo9x5AkBECz9KZGD532g
+o78P4WmzIWLgan5GIyNFtGxCsYAug+h0jnC4yujauKqr8hKDLu4K+quCGjX/6LL6
+WONz9vT6h053kHZYMrd4Gs/NdaA4tJSxrhZlXdajAm/0vAOzLIqUHHQk3R0tf7aY
+d/w=
+-----END CERTIFICATE-----

metric_fu.gemspec

@@ -11,6 +11,9 @@ Gem::Specification.new do |s|
   author_file   = File.expand_path('AUTHORS', File.dirname(__FILE__))
   s.authors     = File.readlines(author_file).map(&:strip)
 
+  # used with gem i metric_fu -P HighSecurity
+  s.cert_chain  = ['certs/bf4.pem']
+
   s.rubyforge_project           = 'metric_fu'
   s.license                     = 'MIT'
   s.platform                    = Gem::Platform::RUBY