Hello,

chkrootkit reports the following file as suspect,
while this is most likely a false positive, they also seem to be unnecessary

The file:
 /usr/lib/ruby/vendor_ruby/rubygems/ssl_certs/.document

Also when looking at /usr/lib/ruby/vendor_ruby/rubygems/ssl_certs/rubygems.org/
it strange to see that rubygems probably isn't using the trusted system wide ca-certificates for verification
(similar issue in the past: #689069)

hth,
Wim