Remove RubyGems certificate signing. (#37)

Signed-off-by: Samuel Williams <samuel.williams@oriontransfer.co.nz>

Author: ioquatix

.github/workflows/release-publish.yaml

@@ -68,7 +68,6 @@ jobs:
         id: build
         env:
           GITHUB_TOKEN: ${{ github.token }}
-          GEM_SIGNING_KEY: ${{ secrets.GEM_SIGNING_KEY }}
         run: bundle exec bake gem:github:release:build
       - name: Sign RubyGems attestation
         if: steps.build.outputs.restored != 'true'

bake-gem-github.gemspec

@@ -15,9 +15,7 @@ Gem::Specification.new do |spec|
 		"changelog_uri" => "https://github.com/socketry/bake-gem-github/blob/main/releases.md",
 		"source_code_uri" => "https://github.com/socketry/bake-gem-github.git",
 	}
-	spec.cert_chain = ["release.cert"]
-	spec.signing_key = File.expand_path("~/.gem/socketry-release.pem")
-	spec.files = Dir.glob(["{bake,context,lib,templates}/**/*", "*.md", "release.cert"], base: __dir__)
+	spec.files = Dir.glob(["{bake,context,lib,templates}/**/*", "*.md"], base: __dir__)
 	spec.required_ruby_version = ">= 3.3"
 	spec.add_dependency "bake-gem", ">= 0.15.0"
 	spec.add_dependency "bake-releases", "~> 0.6"

bake/gem/github.rb

@@ -9,10 +9,9 @@
 # @parameter branch [String] Default branch name; discovered through GitHub when omitted.
 # @parameter approvals [Integer] Number of approving reviews.
 # @parameter reviewers [Array(String)] Publishing environment reviewers: user logins or organization/team names. Omit to leave environment settings unmanaged.
-# @parameter signing [Boolean] Require certificate signing; when omitted, enable it if `release.cert` exists.
 # @parameter ruby [String] Ruby version for release workflows.
 # @returns [Array(String)] Generated paths relative to the repository root.
-def setup(checks:, repository: nil, branch: nil, approvals: 2, reviewers: nil, signing: nil, ruby: "3.4")
+def setup(checks:, repository: nil, branch: nil, approvals: 2, reviewers: nil, ruby: "3.4")
 	require "bake/gem/github/setup"
 	require "bake/gem/shell"
 
@@ -31,7 +30,6 @@ def setup(checks:, repository: nil, branch: nil, approvals: 2, reviewers: nil, s
 		reviewers: reviewers,
 		ruby: ruby,
 	}
-	options[:signing] = signing unless signing.nil?
 
 	Bake::Gem::GitHub::Setup.new(context.root).generate(**options)
 end

config/release.yaml

@@ -15,7 +15,6 @@ checks:
 - validate
 - Release validation
 approvals: 2
-signing: true
 ruby: '3.4'
 environment: rubygems
 reviewers:

context/getting-started.md

@@ -66,11 +66,11 @@ bundle exec bake gem:github:setup:plan publisher=true
 
 This adds `trusted_publisher_status` to the plan, including `configured` and the matching registration. The default plan only reports expected RubyGems values and does not authenticate to RubyGems. Authentication, ownership, and API failures stop the task rather than being reported as a missing registration.
 
-For a gem that has never been published, configure a pending publisher manually. Account ownership, MFA enrollment, the GitHub environment, and signing bootstrap remain manual setup steps. See [RubyGems Trusted Publishing](https://guides.rubygems.org/trusted-publishing/) for account setup. Trusted Publishing supplies the publishing credential for each release, so a long-lived RubyGems API key is unnecessary.
+For a gem that has never been published, configure a pending publisher manually. Account ownership, MFA enrollment, and the GitHub environment remain manual setup steps. See [RubyGems Trusted Publishing](https://guides.rubygems.org/trusted-publishing/) for account setup. Trusted Publishing supplies the publishing credential for each release, so a long-lived RubyGems API key is unnecessary.
 
-When `release.cert` exists, setup enables certificate signing. Commit the public certificate and install its matching private key as `GEM_SIGNING_KEY`, either in the `rubygems` environment or as an organization secret available to the repository. The publisher checks certificate validity, key matching, and package signatures. Use `signing=false` during setup to disable certificate signing.
+Publishing builds gems without RubyGems certificate signatures. Sigstore and GitHub provenance attestations bind the package to its source and release workflow; no separate certificate or private signing key is required.
 
-Ensure another maintainer can administer the repository and recover its RubyGems account and signing key.
+Ensure another maintainer can administer the repository and recover its RubyGems account.
 
 ## Authorize publishing
 
@@ -133,6 +133,8 @@ git diff
 
 This updates managed files in the working tree and returns their changed paths. Review the diff and selectively retain repository customizations before committing. The task does not stage, commit, or change remote settings. Repeated updates produce no further changes unless customizations differ from the templates. Apply changed rulesets after the corresponding workflows are running.
 
+Updating removes the obsolete `signing` configuration and `GEM_SIGNING_KEY` workflow reference. The publisher ignores legacy certificate-signing settings and always builds unsigned packages. Remove `cert_chain`, `signing_key`, and unused public certificates from your gem project when migrating. Attestation verification and RubyGems Trusted Publishing remain required.
+
 To enable rebase merging on an existing installation, regenerate and merge `release-validate.yaml` so it runs `gem:github:release:validate`, which requires single-commit release PRs. Then review `gem:github:setup:plan` and run `gem:github:setup:apply` to allow rebase merging in the managed rules. Enable rebase merging in repository settings as well. Upgrading the gem alone does not update workflows or live rules.
 
 Regenerate existing workflows to adopt publishing on `push` instead of `pull_request_target`. The workflow filename and `rubygems` environment remain the same, so the RubyGems Trusted Publisher configuration does not change. No exception to GitHub's `pull_request_target` execution policy is needed. The resolve task continues to accept PR numbers from older workflows while you migrate.

context/preparing-releases.md

@@ -36,7 +36,7 @@ Merging into the configured default branch triggers `release-publish.yaml` throu
 
 Each release must land as the tip of its own push, as it does when merging a PR through GitHub. Later pushes do not change a pending release's source: inspection and publishing remain pinned to the original commit, and reruns use the same event. Do not combine a release and later changes into one direct push. If you automate merging, use a GitHub App or personal access token; pushes made using a workflow's `GITHUB_TOKEN` do not trigger another workflow.
 
-Only validated releases enter the publishing queue and request approval from the `rubygems` environment when required. Ordinary pushes cannot replace them in that queue. The publishing job retains the existing signing, attestation, and artifact recovery checks.
+Only validated releases enter the publishing queue and request approval from the `rubygems` environment when required. Ordinary pushes cannot replace them in that queue. The publishing job retains attestation and artifact recovery checks.
 
 ## Resume interrupted preparation
 

context/verifying-releases.md

@@ -6,7 +6,7 @@ Use this when checking a completed release or confirming which source commit pro
 
 ## What publishing verifies
 
-After squash, rebase, or merge, the publishing workflow verifies GitHub's merged PR record and ancestry, then checks out the exact resulting commit. Each release PR contains one commit, so the resulting commit's **first parent** is the default branch immediately before the release landed. Later development on the default branch is allowed. Publishing regenerates against that first parent, builds in a clean worktree, optionally certificate-signs, and creates two attestations over the final bytes:
+After squash, rebase, or merge, the publishing workflow verifies GitHub's merged PR record and ancestry, then checks out the exact resulting commit. Each release PR contains one commit, so the resulting commit's **first parent** is the default branch immediately before the release landed. Later development on the default branch is allowed. Publishing regenerates against that first parent, builds an unsigned gem in a clean worktree, and creates two attestations over the final bytes:
 
 - A Sigstore bundle submitted explicitly with `gem push --attestation` using RubyGems 4.0.21.
 - GitHub's native SLSA provenance covering both the gem and `release.json`. This signed receipt binds the gem digest to the exact release commit, even when the workflow's own default-branch revision is newer.

fixtures/bake/gem/github/publication_context.rb

@@ -28,7 +28,7 @@ module GitHub
 				end
 
 				before do
-					Setup.new(root).generate(repository: "socketry/example", checks: ["Test"], signing: false)
+					Setup.new(root).generate(repository: "socketry/example", checks: ["Test"])
 
 					FileUtils.mkdir_p(File.join(root, "pkg"))
 					File.write(File.join(root, "pkg", receipt.fetch(:file)), "Exact signed bytes")

fixtures/bake/gem/github/repository_context.rb

@@ -48,7 +48,7 @@ def after_gem_release_version_increment(version)
 						end
 					RUBY
 					File.write(File.join(repository, ".gitignore"), "/pkg/\n")
-					Setup.new(repository).generate(repository: "socketry/example", checks: ["Tests"], signing: false)
+					Setup.new(repository).generate(repository: "socketry/example", checks: ["Tests"])
 					git("init", "--quiet", "--initial-branch=main")
 					git("config", "core.hooksPath", File::NULL)
 					git("config", "commit.gpgsign", "false")

guides/getting-started/readme.md

@@ -66,11 +66,11 @@ bundle exec bake gem:github:setup:plan publisher=true
 
 This adds `trusted_publisher_status` to the plan, including `configured` and the matching registration. The default plan only reports expected RubyGems values and does not authenticate to RubyGems. Authentication, ownership, and API failures stop the task rather than being reported as a missing registration.
 
-For a gem that has never been published, configure a pending publisher manually. Account ownership, MFA enrollment, the GitHub environment, and signing bootstrap remain manual setup steps. See [RubyGems Trusted Publishing](https://guides.rubygems.org/trusted-publishing/) for account setup. Trusted Publishing supplies the publishing credential for each release, so a long-lived RubyGems API key is unnecessary.
+For a gem that has never been published, configure a pending publisher manually. Account ownership, MFA enrollment, and the GitHub environment remain manual setup steps. See [RubyGems Trusted Publishing](https://guides.rubygems.org/trusted-publishing/) for account setup. Trusted Publishing supplies the publishing credential for each release, so a long-lived RubyGems API key is unnecessary.
 
-When `release.cert` exists, setup enables certificate signing. Commit the public certificate and install its matching private key as `GEM_SIGNING_KEY`, either in the `rubygems` environment or as an organization secret available to the repository. The publisher checks certificate validity, key matching, and package signatures. Use `signing=false` during setup to disable certificate signing.
+Publishing builds gems without RubyGems certificate signatures. Sigstore and GitHub provenance attestations bind the package to its source and release workflow; no separate certificate or private signing key is required.
 
-Ensure another maintainer can administer the repository and recover its RubyGems account and signing key.
+Ensure another maintainer can administer the repository and recover its RubyGems account.
 
 ## Authorize publishing
 
@@ -133,6 +133,8 @@ git diff
 
 This updates managed files in the working tree and returns their changed paths. Review the diff and selectively retain repository customizations before committing. The task does not stage, commit, or change remote settings. Repeated updates produce no further changes unless customizations differ from the templates. Apply changed rulesets after the corresponding workflows are running.
 
+Updating removes the obsolete `signing` configuration and `GEM_SIGNING_KEY` workflow reference. The publisher ignores legacy certificate-signing settings and always builds unsigned packages. Remove `cert_chain`, `signing_key`, and unused public certificates from your gem project when migrating. Attestation verification and RubyGems Trusted Publishing remain required.
+
 To enable rebase merging on an existing installation, regenerate and merge `release-validate.yaml` so it runs `gem:github:release:validate`, which requires single-commit release PRs. Then review `gem:github:setup:plan` and run `gem:github:setup:apply` to allow rebase merging in the managed rules. Enable rebase merging in repository settings as well. Upgrading the gem alone does not update workflows or live rules.
 
 Regenerate existing workflows to adopt publishing on `push` instead of `pull_request_target`. The workflow filename and `rubygems` environment remain the same, so the RubyGems Trusted Publisher configuration does not change. No exception to GitHub's `pull_request_target` execution policy is needed. The resolve task continues to accept PR numbers from older workflows while you migrate.