RubyGems Outage History

Due to an ongoing DDoS attack against rubygems.org, we have temporarily disabled registrations. We'll share an update once we've made changes to protect legitimate users and prevent further abuse.

The malicious spam activity against rubygems.org has stopped. The bot accounts responsible have been blocked and removed, and the 500+ malicious packages pushed during the attack have been yanked from the registry. Registrations will remain closed while we coordinate with Fastly to enable WAF protection and tighten rate limiting on account creation. We expect this to take two to three days. We'll post another update when we're closer being ready to re-enable user registrations. Gem installs and pushes for existing users are unaffected.

The issue has been identified and a fix is being implemented.

We've identified and are addressing the underlying issue affecting RubyGems.org search. Service restoration is underway, and we anticipate normal operations to resume within the next hour.

Gem pushes utilising the attestation feature are failing and will respond with an application error. We've identified the issue and are currently working to push a fix.

We have implemented a fix for gem pushes that use attestations on rubygems.org. However, gems that rely on the release-gem GitHub Action (https://github.com/rubygems/release-gem) to deploy to rubygems.org will still experience errors. The release-gem action will automatically retry pushing to rubygems.org without attestations, which continue to function as expected. We are closely monitoring the situation and collaborating with the Sigstore team to resolve this issue.

We're continuing to work with the sigstore team to help resolve users being unable to gem pushes with attestations. For the time being, we recommend users update their workflows to retry gem pushes without attestations.

This issue has been resolved. Please ensure that you're using the latest version of the https://github.com/rubygems/release-gem in your Github Actions tasks.