gem_guard - A Ruby dependency security scanner and SBOM genera

项目说明

GemGuard

![Gem ]()
![CI]()
![Release]()
![License: MIT]()
![Security Policy]()

A Ruby dependency security scanner and SBOM generator. GemGuard checks your Gemfile.lock against fi sources, flags gems whose names look like typosquats of popular ones, and generates SPDX or CycloneDX SBOMs — all from one CLI, with CI-friendly exit codes.

bundler-audit checks one source and stops there. GemGuard exists because that's not enough co for anything running in production, and because scanning, typosquat detection, and SBOM generation are three tasks most teams end up bolting together from separate tools when they could be one.

Status: actively maintained, single-maintainer project. Solid test co and a real release pipeline (see below), still early in adoption. If you're e it for a team, read the source — it's small enough to actually do that before you depend on it.

What it does

Installation

Or add it to your Gemfile:

Quick start

Usage

scanning

Exit codes: 0 success, 1 found (only with --fail-on-), 2 error.

Example output:

Auto-fixing dependencies

A backup (Gemfile.lock.backup.YYYYMMDD_HHMMSS) is created only when at least one fix is applied. fix requires both Gemfile and Gemfile.lock to exist; interactive mode requires a TTY.

Exit codes: 0 success, 2 error.

Interactive mode

Scans, shows results, then offers to drop into interacti.

Typosquat detection

Exit codes: 0 no high/critical risk, 1 high/critical risk found, 2 error.

SBOM generation

Configuration

Project-le via .gemguard.yml:

| Option | Description | Default |
|---|---|---|
| lockfile_path | Path to Gemfile.lock | "Gemfile.lock" |
| output_format | table or json | "table" |
| fail_on_ | Exit 1 if found | true |
| se | Minimum se to report | "low" |
| output_file | Write output to file | null |
| ignore_ | CVE/GHSA IDs to ignore | [] |
| typosquat.similarity_threshold | Detection sensitivity | 0.8 |
| typosquat.enabled | Enable typosquat detection | true |
| sbom.format | spdx or cyclone-dx | "spdx" |
| sbom.project_name | Project name in SBOM | "ruby-project" |
| scan.sources | sources checked | all five |

CI/CD

GitHub Actions

GitLab CI

CircleCI

Troubleshooting

In — GemGuard couldn't parse Gemfile.lock. Regenerate it with bundle install. If that doesn't fix it, delete the lockfile and reinstall from scratch, and confirm it hasn't been hand-edited.

FileError — GemGuard couldn't read or write a required file. Common causes: missing Gemfile (pass --gemfile PATH), missing Gemfile.lock (run bundle install or pass --lockfile PATH), no write permission for backups or output (chmod u+w ., or write to a mounted like /tmp in CI). Add -- for diagnostics.

De

Releases are automated: bump lib/gem_guard/.rb, push to main, and GitHub Actions tags, tests across Ruby , and publishes to RubyGems.

Contributing

1. Fork and branch off main
2. Write tests first — this codebase uses outside-in TDD
3. bundle exec rspec and bundle exec rake standard before opening a PR
4. Keep commits descriptive; keep abstractions minimal and intention-re

Roadmap

License

MIT. See LICENSE.txt.

Security

Found a in GemGuard itself? See SECURITY.md for disclosure.

Acknowledgments

data from OSV.dev, the Ruby Ad Database, GitHub Security Ad, NVD, and the Curesec Ad Database.

项目信息

开发语言：Ruby

Star 数：15

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A Ruby dependency security scanner and SBOM generator. GemGuard checks your Gemfile.lock against five vulnerability sources, flags gems whose names look like typosquats of popular ones, and generates SPDX or CycloneDX SBOMs — all from one CLI, with CI-friendly exit codes.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。