{"action":"created","issue":{"url":"https://api.github.com/repos/thoughtbot/paperclip/issues/1195","labels_url":"https://api.github.com/repos/thoughtbot/paperclip/issues/1195/labels{/name}","comments_url":"https://api.github.com/repos/thoughtbot/paperclip/issues/1195/comments","events_url":"https://api.github.com/repos/thoughtbot/paperclip/issues/1195/events","html_url":"https://github.com/thoughtbot/paperclip/issues/1195","id":11996484,"number":1195,"title":"Sign future gems with PGP","user":{"login":"FooBarWidget","id":819,"avatar_url":"https://avatars.githubusercontent.com/u/819?v=3","gravatar_id":"","url":"https://api.github.com/users/FooBarWidget","html_url":"https://github.com/FooBarWidget","followers_url":"https://api.github.com/users/FooBarWidget/followers","following_url":"https://api.github.com/users/FooBarWidget/following{/other_user}","gists_url":"https://api.github.com/users/FooBarWidget/gists{/gist_id}","starred_url":"https://api.github.com/users/FooBarWidget/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/FooBarWidget/subscriptions","organizations_url":"https://api.github.com/users/FooBarWidget/orgs","repos_url":"https://api.github.com/users/FooBarWidget/repos","events_url":"https://api.github.com/users/FooBarWidget/events{/privacy}","received_events_url":"https://api.github.com/users/FooBarWidget/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2013-03-13T22:20:03Z","updated_at":"2015-01-06T17:05:48Z","closed_at":null,"body":"Please sign your future gem releases with PGP, as described at https://www.rubygems-openpgp-ca.org. This allows attackers who forge Paperclip releases to be easily detected. We at Phusion are [already signing all our gems](http://www.phusion.nl/about/gpg).\r\n\r\nI realize that you may not necessarily trust this CA, but that is fine. By signing with PGP users can still verify files from your key directly, and if rubygems.org ever starts an official CA they can sign your keys without requiring actions from your side."},"comment":{"url":"https://api.github.com/repos/thoughtbot/paperclip/issues/comments/68895046","html_url":"https://github.com/thoughtbot/paperclip/issues/1195#issuecomment-68895046","issue_url":"https://api.github.com/repos/thoughtbot/paperclip/issues/1195","id":68895046,"user":{"login":"grant-olson","id":255776,"avatar_url":"https://avatars.githubusercontent.com/u/255776?v=3","gravatar_id":"","url":"https://api.github.com/users/grant-olson","html_url":"https://github.com/grant-olson","followers_url":"https://api.github.com/users/grant-olson/followers","following_url":"https://api.github.com/users/grant-olson/following{/other_user}","gists_url":"https://api.github.com/users/grant-olson/gists{/gist_id}","starred_url":"https://api.github.com/users/grant-olson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/grant-olson/subscriptions","organizations_url":"https://api.github.com/users/grant-olson/orgs","repos_url":"https://api.github.com/users/grant-olson/repos","events_url":"https://api.github.com/users/grant-olson/events{/privacy}","received_events_url":"https://api.github.com/users/grant-olson/received_events","type":"User","site_admin":false},"created_at":"2015-01-06T17:05:48Z","updated_at":"2015-01-06T17:05:48Z","body":"The [rubygems-openpgp](https://github.com/grant-olson/rubygems-openpgp) adds all the PGP functionality, but hasn't been widely adopted."}}