Resilience & Security

This is a proposal for a substantial project. I want to gauge community support before undertaking work on it. I want gemstash to be able to satisfy the resilience and security needs of an organization strongly. Specifically, I wish for the following features, which gemstash appears to currently lack. 1) The ability to operate off a whitelist--serve only accepted versions of accepted gems. #320 This is not a small piece of work. Generally, we want to fetch everything and log new version availability for review. We need a monitor mode so that devs can pull in new gems & gem versions & trigger a review. We need permissions to update the whitelist. 2) Log (WARN) if a cached version of a gem is yanked. #291 Server to be configurable as to whether or not cached gems continue to be served. Erroring out is an option. Configuration to be global with individual version overrides 3) Log (WARN) if an upstream gem changes without a version update. Both versions kept, but response is configurable. 4) Resolve #194 / #195 / #290 Implicitly, these change likely require addressing at least #408 and/or #409, #154 , and #67. The ability to remap gem versions might also be useful.