ruby/rubygems · error · Gem::Security::Exception

unsigned gems are not allowed by the #{name} policy

Error message

unsigned gems are not allowed by the #{name} policy

What it means

Error "unsigned gems are not allowed by the #{name} policy" thrown in ruby/rubygems.

Source

Thrown at lib/rubygems/security/policy.rb:209

    certificate.subject.to_s
  end

  def inspect # :nodoc:
    format("[Policy: %s - data: %p signer: %p chain: %p root: %p " \
     "signed-only: %p trusted-only: %p]", @name, @verify_chain, @verify_data, @verify_root, @verify_signer, @only_signed, @only_trusted)
  end

  ##
  # For +full_name+, verifies the certificate +chain+ is valid, the +digests+
  # match the signatures +signatures+ created by the signer depending on the
  # +policy+ settings.
  #
  # If +key+ is given it is used to validate the signing certificate.

  def verify(chain, key = nil, digests = {}, signatures = {}, full_name = "(unknown)")
    if signatures.empty?
      if @only_signed
        raise Gem::Security::Exception,
          "unsigned gems are not allowed by the #{name} policy"
      elsif digests.empty?
        # lack of signatures is irrelevant if there is nothing to check
        # against
      else
        alert_warning "#{full_name} is not signed"
        return
      end
    end

    opt       = @opt
    digester  = Gem::Security.create_digest
    trust_dir = opt[:trust_dir]
    time      = Time.now

    _, signer_digests = digests.find do |_algorithm, file_digests|
      file_digests.values.first.name == Gem::Security::DIGEST_NAME
    end

View on GitHub (pinned to 86cbb817a3)

Solutions

1. Sign the gem (gem cert / gem sign) so it satisfies the security policy
2. Or install with a lower policy such as `--trust-policy LowSecurity`

When it happens

Trigger: Thrown at lib/rubygems/security/policy.rb:209 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruby/rubygems@86cbb817a3 (2026-08-23). Data as JSON: /api/errors/104d4060eca5745a. Report an issue: GitHub.