# Securely Manage and Govern Ruby Projects

When you rely on [Ruby](https://www.ruby-lang.org/en/) or [RubyGems](https://rubygems.org/), you need a robust way to manage dependencies, enforce security, and gain insight into your software supply chain. Sonatype helps you integrate Ruby support and RubyGems package management into your end-to-end secure SDLC.

.png?width=1968&height=2893&name=Header-LR-Gray-(RIGHT).png)

.png?width=1467&height=2893&name=Header-LR-Gray-(LEFT).png)

## Understanding the Ruby Ecosystem and Sonatype's Role

Ruby powers many web and server-side apps. RubyGems is the main way Ruby code is packaged and shared, offering a standard format and tools for distributing libraries and applications. Beyond public RubyGems, you might host internal gems or proxy remote ones for better performance, governance, and security. [Sonatype Nexus Repository](/content/products/sonatype-nexus-repository/index.html) supports hosted, proxy, and grouped gem repositories for RubyGems. Empower your Ruby projects with the [Sonatype Platform](/content/products/nexus-one-platform/index.html), ensuring secure gem distribution, consistent policy enforcement, and complete auditability from development through delivery.

## Supported Features

### Proxy and Cache

Proxy RubyGems (or other gem repositories) and cache gems locally to reduce downloads and speed builds.

### Hosted Gems

Publish internal or vetted third-party gems to a private, stable RubyGems repository.

### Repository Groups

Unify multiple gem repositories (hosted + proxy) under one URL to simplify gem sources for developers.

### Dependency Insight

Track gem versions, dependencies, and transitive risk for Ruby projects throughout your SDLC.

### Supply Chain Security

Scan your Ruby gems for vulnerabilities, license issues, and governance problems.

### SBOM and Auditing

Generate SBOM and audit gems to meet compliance, regulatory, or policy requirements.

## Explore the Benefits for Ruby and RubyGems Projects

Whether you're building a new Ruby application or maintaining an existing one, the key is integrating RubyGems and Ruby into your secure software supply chain.

- #### Improved Reliability
  
  Host and cache gems internally so builds are faster, more predictable, and less dependent on external repositories.

- #### Reduced Risk
  
  Track and enforce gem-level policies (version, vulnerability, license) so you reduce exposure from untrusted, outdated or malicious gems.

- #### Unified Governance
  
  Integrate Ruby into your multi-language package management strategy. Combine RubyGems with npm, Maven, PyPI, and more under consistent controls.

Take Control of Your Ruby Applications

[Book a Demo](/content/request-a-personalized-demo/index.html)

## Resources

+

### RubyGems Repositories + Nexus Repository Support

[See Documentation](https://help.sonatype.com/en/rubygems-repositories.html)

+.png?width=149&height=170&name=NexusLifecycle_Icon%20(1).png)

### Ruby Application Analysis in Sonatype Lifecycle

[See Documentation](https://help.sonatype.com/en/ruby-application-analysis.html)

### RubyGems on OSS Index

[Get Started](https://ossindex.sonatype.org/ecosystem/rubygems)

## Frequently Asked Questions

### What is a “gem” in the Ruby ecosystem?

A gem is a packaged Ruby library or application distributed via the RubyGems tool and repository system.

### Why should I proxy or host gems instead of pulling directly from RubyGems?

Proxying or hosting helps reduce build latency, avoid external outages, ensure availability of specific gem versions, and enforce internal governance.

### How does this support integrate with Sonatype’s products?

While this page focuses on language and package support generally, Sonatype enables such functionality via Nexus Repository (for managed gem repositories), [Lifecycle](/content/products/open-source-security-dependency-management/index.html) (for open source security and dependency management), [Repository Firewall](/content/products/sonatype-repository-firewall/index.html) (for filtering malicious or risky components), and [SBOM Manager](/content/products/sonatype-sbom-manager/index.html) (for bill-of-materials creation).