TechPrufer
Sign inGet started

Blogs›Shopify›Ruby Dependency Security and Analysis

Ruby Dependency Security and Analysis

Ruby Dependency Security and Analysis

1
posts
2022

This feature thread tracks the development and enhancement of Shopify's Ruby Dependency Security initiatives, focusing on analyzing the relationships between Ruby packages and their dependencies to identify potential security vulnerabilities and improve the overall security posture of the Ruby ecosystem. This includes efforts related to Multi-Factor Authentication (MFA) rollout on RubyGems, dependency analysis to uncover indirect vulnerabilities, and the development of tools and visualizations to understand these relationships at scale.

2022

Finding Relationships Between Ruby’s Top 100 Packages and Their Dependencies - Shopify

10/19/2022

This post details an investigation into the dependency relationships between large (>= 180M downloads) and small (< 180M downloads) RubyGems. It describes methods used to identify these relationships, including direct dependency checks via the RubyGems API and sub-dependency analysis using Bundler. The post also covers the creation of visualizations using the 'graph' gem and a custom graph data type to illustrate these dependencies and identify paths from large to small gems. The findings highlight reasons for small dependencies on large packages, such as newer gems or gems shipped with Ruby.