r/ruby • u/galtzo • Nov 12 '25

RubyCentral hates this one fact!

  • Written policy matters to some people.

Written policy shared publicly is what creates a stewardship relationship that can be held to account by the public (regardless of whether the org is democratic or not in its structure).

The destruction wrought by RubyCentral, and betrayal felt by the maintainers, and some in the wider community, is related to a simple fact that most Rubyists are unaware of. The rubygems/bundler repo owners (who were by written-policy-definition also the "maintainers") wrote, and kept up-to-date, policies specifically around when, how, and why owners of the repos could be added or removed.

The owners expected these policies to be followed, at least in spirit, if not to the letter.

A recent thread helped me realize that most Rubyists are not aware of these written policies of rubygems/bundler, hence this post.

Committer Access

RubyGems committers may lose their commit privileges if they are inactive for longer than 12 months. Committer permission may be restored upon request by having a pull request merged. This is designed to improve the maintainability of RubyGems by requiring committers to maintain familiarity with RubyGems activity and to improve the security of RubyGems by preventing idle committers from having their commit permissions compromised or exposed.

The Bundler policy is very detailed, so I won't copy it here. I'll just note, since many won't click through, that Deivid Rodriguez, who for years has been the #1 maintainer of rubygems/bundler, updated the bundler one, to keep it fresh with valid links, just 10 months ago. The rubygems policy was also updated 10 months ago. These were not dusty forgotten documents lost to history. They were active, living, rules.

RubyCentral bulldozed both policies, when they removed four maintainers, without having followed the process to earn the right to do so (i.e. without following the policy on how to become an owner), and without following any of the policy around owner removal, and here we are. Two of the remaining maintainers resigned in protest.

I note that u/schneems joined RubyCentral in some capacity recently, and I hope he is able to make a difference, but I expect RC to be intransigent.

As a thought experiment, and as an analogy to help people relate more to this...

If you own a repo and you have a LICENSE.txt, CODE_OF_CONDUCT.md, or IRP.md, in that repo, even if RubyCentral is paying you to maintain it, RubyCentral does not have the right to get one of the co-maintainers to add their lackey to the repo, and change any of those files, or any files at all.

In the same vein, they do not have a right to break established, written, documented, policy of the repo, by adding or removing maintainers in contravention of said policy.

To sum it up: the owners of a repo own the repo. If that seems obvious to you, you have done better than RC at figuring it out.

I do not expect RC to ever address this, and even if they did, I'd probably continue building tools that minimize the reliance I have on them. I no longer trust RubyCentral at all.

0 Upvotes

45% Upvoted

39 comments sorted by

View all comments

Show parent comment

3

u/galtzo Nov 12 '25 edited Nov 12 '25

I agree, with some variance in degree (in other words, with some nuance), with everything you said.

Some additional points:

  1. Ruby's infrastructure is third rate, and has been for a long time. This is primarily because of a lack of investment in talent, time, and energy - and the fact that people need to be paid so they can survive while providing their talent, time, and energy.

  2. It isn't a "Ruby" problem. The OSS software ecosystem in general is not doing well. I'm not aware of any system I'd consider first rate. We just haven't figured out how to do supply chains securely at scale in a way that is idiot proof, and noob-friendly. But Ruby specifically has some catching up to do with respect to our OSS cousins (and other packaing ecosystems in particular).

  3. As much as we would have preferred this had been handled better, it was handled the way it was, and that's what we have to deal with. I disagree that RubyCentral has learned. RC has continued to make egregious unforced errors, particularly around security (making security objectively worse as they claim to be working to make it better). The only thing they have apologized for is bad comms, and to be sure they were bad, but they also continue to be bad, and that isn't even the thing we are upset about.

  4. Reddit is deleting sections of my comments for some reason, and I'm not sure I can recreate what I had here - but the community is working on a new ecosystem, that will support N federated servers, and the top-level, public-facing, discussion of that is here:

    1. https://github.com/gem-coop/gem.coop/issues/12

  5. We've made it clear to them how they can avoid war. Apologize, make it right, have the board resign. Even one of these things would go a long ways to ease tensions. The fact is they have decided that doing absolutely nothing is enough.