From e1b9743455e67d7929e4b8b1568cf3c866b488ea Mon Sep 17 00:00:00 2001
From: Shizuo Fujita <fujita@clear-code.com>
Date: Mon, 10 Aug 2026 17:40:36 +0900
Subject: [PATCH] Gemfile: use HTTPS for the RubyGems source

The gem source was declared as http://rubygems.org, so bundle install
fetched dependency metadata and gem archives over plaintext HTTP. That
connection is neither encrypted nor authenticated, letting an on-path
attacker substitute the index response and serve arbitrary gem code,
which Bundler unpacks and loads on developer machines and in CI.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Signed-off-by: Shizuo Fujita <fujita@clear-code.com>
---
 Gemfile.v0.12 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Gemfile.v0.12 b/Gemfile.v0.12
index 779530a..2fac3e6 100644
--- a/Gemfile.v0.12
+++ b/Gemfile.v0.12
@@ -1,4 +1,4 @@
-source "http://rubygems.org"
+source "https://rubygems.org"
 
 gem 'json', '= 1.8.3'
 gem 'fluentd', '~> 0.12.0'