@janl oh boy, I still can remember the idea of a central place to finance Ruby open source projects and Rubycentral introduced a year or two later. I never would have guessed that something like this would come out of that.

Although the writing may be up the walls for a long time, I remember hearing a few years later that rubycentral doesn't get that well along with Rubygems or Bundler... 🤔

@janl

It wouldn't be hard to just pull the gems from git directly, then put the commit IDs into a checked-in lock file the way mruby does it. From there, you could automate pushing the clones to your own repos if you need them.

@janl ok so yes this looks really really bad but:

""we were offered millions of dollars from a hostile donor in exchange for control of the RubyGems infrastructure” <-- that's a HELL of an accusation to make, and I can't see any evidence of that whatsoever. Is there something I'm missing?

Because otherwise until we learn more this really seems like a "never attribute to malice what you can attribute to incompetence" sort of situation - right?