From 40737e4dc10d294d2f28d500a84655a5e23bd73e Mon Sep 17 00:00:00 2001 From: Shizuo Fujita Date: Mon, 10 Aug 2026 17:40:32 +0900 Subject: [PATCH] Gemfile: use HTTPS for the RubyGems source The gem source was declared as http://rubygems.org, so bundle install fetched dependency metadata and gem archives over plaintext HTTP. That connection is neither encrypted nor authenticated, letting an on-path attacker substitute the index response and serve arbitrary gem code, which Bundler unpacks and loads on developer machines and in CI. Co-Authored-By: Claude Opus 5 (1M context) Signed-off-by: Shizuo Fujita --- Gemfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Gemfile b/Gemfile index c80ee36..b4e2a20 100644 --- a/Gemfile +++ b/Gemfile @@ -1,3 +1,3 @@ -source "http://rubygems.org" +source "https://rubygems.org" gemspec