Skip to content

Commit

Permalink
Update mfa requirement docs
Browse files Browse the repository at this point in the history
Currently the docs outline that the rubygems_mfa_required will require owners to enter an OTP for all privileged operations.
In actuality, rubygems_mfa_required will require owners to have just to have MFA enabled (and not specifically at the ui_and_api level).
  • Loading branch information
jenshenny committed Dec 6, 2023
1 parent 84fa8e9 commit cde0737
Showing 1 changed file with 3 additions and 15 deletions.
18 changes: 3 additions & 15 deletions mfa-requirement-opt-in.md
Original file line number Diff line number Diff line change
Expand Up @@ -7,8 +7,7 @@ next: /using-s3-source
---
<em class="t-gray">How to opt-in for MFA requirement.</em>

You can make your gems more secure by requiring that all privileged
operations by any of the owners require OTP.
You can make your gems more secure by requiring all owners to enable MFA on their account.

## Opt-in to MFA requirement

Expand All @@ -22,8 +21,8 @@ You can opt-in a gem you are managing by releasing a version that has
...
end

The version being released with `rubygems_mfa_required` set and all the following version
will require that you provide an OTP for all privileged operations.
The version being released with `rubygems_mfa_required` set and all the following versions
will require you to have MFA enabled.
Once enabled, the gem page will show `NEW VERSIONS REQUIRE MFA` in the sidebar, and all versions published with `rubygems_mfa_required` set will also show `VERSION PUBLISHED WITH MFA`:
![MFA status indicators](/images/mfa-required-since.png){:class="t-img t-img--small"}

Expand All @@ -34,17 +33,6 @@ a new version for a gem that requires MFA:
Pushing gem to https://rubygems.org...
Rubygem requires owners to enable MFA. You must enable MFA before pushing new version.


## privileged operations

Following operations will require OTP verification if you have MFA requirement
set on the gem.

- `gem push`
- `gem yank`
- `gem owner --add/remove`
- **adding or removing owners using gem ownership page**

## Disabling MFA requirement

You can disable the MFA requirement by setting `rubygems_mfa_required` to `"false"` or any [`ActiveRecord::Type::Boolean::FALSE_VALUES`](https://api.rubyonrails.org/classes/ActiveModel/Type/Boolean.html).
Expand Down

0 comments on commit cde0737

Please sign in to comment.