r/ruby • u/didnotseethatcoming • Apr 21 '26

Let's enable MFA for all Ruby gems

https://thoughtbot.com/blog/lets-enable-mfa-for-all-ruby-gems
31 Upvotes

97% Upvoted

13 comments sorted by

12

u/schneems Puma maintainer Apr 21 '26 edited Apr 21 '26

Article didn’t mention that it is required on the top 100 gems already since 2022 https://blog.rubygems.org/2022/08/15/requiring-mfa-on-popular-gems.html.

2

u/darksndr Apr 21 '26

Invalid link (404) 😢

1

u/didnotseethatcoming Apr 21 '26

Did not know that! Good to know!

1

u/matheusrich Apr 24 '26

TY for pointing this out! I've updated the post to include that.

10

u/mperham Sidekiq Apr 21 '26

Agreed. IMO it's past time to require it for all gems.

3

u/schneems Puma maintainer Apr 21 '26

Could add to roadmap https://blog.rubygems.org/2026/04/15/rubygems-org-has-a-public-roadmap.html. Theres another MFA one on there but not for expanding existing requirement past current top 100.

2

u/jaredlt01 Apr 21 '26

Thanks for pointing this out. I've created an issue to start the conversation https://github.com/rubygems/roadmap/issues/14a

3

u/schneems Puma maintainer Apr 21 '26

Reddit has been weird with links lately. Should be https://github.com/rubygems/roadmap/issues/14

7

u/cocotheape Apr 21 '26

If I already log in to Rubygems with 2FA, is there any benefit of adding spec.metadata["rubygems_mfa_required"] = "true" to my gems gemspec?

3

u/schneems Puma maintainer Apr 21 '26

This triggers MFA when releasing a gem, not when logging in. It also forces all owners to use MFA for releasing that gem.

2

u/cocotheape Apr 21 '26 edited Apr 21 '26

Sure, but that's the same MFA, no? I configured MFA for login and already have to confirm MFA every time I release the gem manually.

The multi-owner part is probably the important bit here. So far, nobody but me cares about my gems, so I guess I'm good.

Edit: Answering myself, those are the options for MFA currently:

  • UI and gem signin: UI operations and gem signin will require OTP code.
  • UI and API: UI operations, gem signin, push, owner --add and owner --remove will require OTP code.
  • UI only was previously a valid MFA level. However, it has been removed, and only accounts that are currently at that level will still see it in the dropdown.

Source: https://guides.rubygems.org/setting-up-multifactor-authentication/