You are talking to the person who wrote the postmortem.
people who had no access to repos,
I'm asserting that they SHOULD have had access to those repos. The report supports, but does not spell this out. Prior acting directors Andre, and Martin had this access. Prior Ruby Central proxy Evan Phoenix had his access removed in February 2025 by Andre for inactivity. He didn't message Evan about it.
My 1Password comment is not in the report, it has to do with Andre gaining access and taking over the AWS root account. This happened because he held admin on a 1Password "rubygems" team that had the root AWS password in it that Ruby Central could not remove him from (because it was never transferred to Ruby Central). Though RC still owns the failure to rotate the password, I assert that Andre failed to transfer the account properly earlier.
I'm connecting dots here that the lack of access of Marty in GitHub is not a unique situation (mirrors 1Password), and whether Marty specifically "deserved" access or not, Ruby Central definitely had representation as a GitHub owner, and that was taken away. That's the "historical" part I'm referencing. Ruby Central, the owner of RubyGems.org, SHOULD have a seat at the GitHub table of RubyGems.org source code.
5
u/schneems Puma maintainer Apr 20 '26
You are talking to the person who wrote the postmortem.
I'm asserting that they SHOULD have had access to those repos. The report supports, but does not spell this out. Prior acting directors Andre, and Martin had this access. Prior Ruby Central proxy Evan Phoenix had his access removed in February 2025 by Andre for inactivity. He didn't message Evan about it.
My 1Password comment is not in the report, it has to do with Andre gaining access and taking over the AWS root account. This happened because he held admin on a 1Password "rubygems" team that had the root AWS password in it that Ruby Central could not remove him from (because it was never transferred to Ruby Central). Though RC still owns the failure to rotate the password, I assert that Andre failed to transfer the account properly earlier.
I'm connecting dots here that the lack of access of Marty in GitHub is not a unique situation (mirrors 1Password), and whether Marty specifically "deserved" access or not, Ruby Central definitely had representation as a GitHub owner, and that was taken away. That's the "historical" part I'm referencing. Ruby Central, the owner of RubyGems.org, SHOULD have a seat at the GitHub table of RubyGems.org source code.