confium 0.2.0 → 0.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (59) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +126 -0
  3. data/Cargo.lock +2534 -0
  4. data/Cargo.toml +9 -0
  5. data/README.adoc +114 -14
  6. data/Rakefile +8 -3
  7. data/confium.gemspec +42 -21
  8. data/ext/confium_native/Cargo.toml +62 -0
  9. data/ext/confium_native/build.rs +72 -0
  10. data/ext/confium_native/extconf.rb +10 -0
  11. data/ext/confium_native/src/attributes.rs +88 -0
  12. data/ext/confium_native/src/audit.rs +169 -0
  13. data/ext/confium_native/src/composite.rs +302 -0
  14. data/ext/confium_native/src/deployment.rs +176 -0
  15. data/ext/confium_native/src/ers.rs +93 -0
  16. data/ext/confium_native/src/lib.rs +56 -0
  17. data/ext/confium_native/src/openpgp.rs +55 -0
  18. data/ext/confium_native/src/path.rs +118 -0
  19. data/ext/confium_native/src/pki.rs +431 -0
  20. data/ext/confium_native/src/tc.rs +420 -0
  21. data/ext/confium_native/src/transparency.rs +341 -0
  22. data/ext/confium_native/src/util.rs +196 -0
  23. data/lib/confium/audit.rb +125 -0
  24. data/lib/confium/cfm.rb +2 -4
  25. data/lib/confium/crypto.rb +50 -0
  26. data/lib/confium/digest.rb +7 -7
  27. data/lib/confium/errors/coerce.rb +49 -0
  28. data/lib/confium/errors/crypto_error.rb +13 -0
  29. data/lib/confium/errors/index_error.rb +13 -0
  30. data/lib/confium/errors/not_found_error.rb +13 -0
  31. data/lib/confium/errors/parse_error.rb +13 -0
  32. data/lib/confium/errors/policy_violation_error.rb +13 -0
  33. data/lib/confium/errors/threshold_error.rb +14 -0
  34. data/lib/confium/errors/unresolved_signer_error.rb +12 -0
  35. data/lib/confium/errors/validation_error.rb +15 -0
  36. data/lib/confium/errors/verification_error.rb +13 -0
  37. data/lib/confium/errors.rb +26 -0
  38. data/lib/confium/ffi.rb +23 -0
  39. data/lib/confium/lib.rb +2 -39
  40. data/lib/confium/openpgp.rb +34 -0
  41. data/lib/confium/pki/certificate_builder.rb +60 -0
  42. data/lib/confium/pki/cms/signed_data_builder.rb +92 -0
  43. data/lib/confium/pki/cms.rb +15 -0
  44. data/lib/confium/pki/cnml.rb +80 -0
  45. data/lib/confium/pki.rb +13 -0
  46. data/lib/confium/policy.rb +138 -0
  47. data/lib/confium/secure_bytes.rb +124 -0
  48. data/lib/confium/tc/coordinator.rb +67 -0
  49. data/lib/confium/tc/session.rb +49 -0
  50. data/lib/confium/tc/session_stub.rb +43 -0
  51. data/lib/confium/tc/share_file.rb +87 -0
  52. data/lib/confium/tc.rb +17 -0
  53. data/lib/confium/transparency/ots.rb +63 -0
  54. data/lib/confium/version.rb +1 -1
  55. data/lib/confium.rb +50 -20
  56. metadata +142 -25
  57. data/CODE_OF_CONDUCT.md +0 -84
  58. data/Gemfile +0 -10
  59. data/sig/confium.rbs +0 -4
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 6d39e1a2e73e52614bf8b6d41c3f0f798b794c08d575cd67ddbfc7f1935a47ef
4
- data.tar.gz: 21fdba648e4d72df7a3ceda358481778bbcfd741dc31bba35fe31cc8147c5c16
3
+ metadata.gz: 36b9e9d9aa6a0b038c85ea24caefa5d0e16e9a4efda0bc9a73b1558cc2b52d97
4
+ data.tar.gz: d2490e0cf9169a5bf7f05a74600d0a0de115a13d2bb08d58e3e5e121cbe39d2c
5
5
  SHA512:
6
- metadata.gz: 77f5d64871d7870c749f1ead130665433ee6a60bfd5382238f10281e9c473c547a7571e227e27ccbae116530eb812755ce9304bd42a83f5b3d4e9e4b2618ba45
7
- data.tar.gz: 77010b37fd365b3bb6189d49c8561763640986794e755d92df1a621ad0b7652fda226cac5f7a9fd570dbdc1f56d8fddf144d52f960a271da0cfe27f211903a69
6
+ metadata.gz: fd4fde001b8e29ce40d58df86914b2ef6f5322d48bee02858df0a954a7e1575ef4ce42750acd27830bbe1e4ad6e247df56931c9bd8ee1eff0f25b9477fed8602
7
+ data.tar.gz: 8b99c6f42ee573a1075fc950dc49ec167b3bde4180243df990c2fcab946d2c5a10af6f226434005158e740441dd84097f0efcd2ce0ee72e187e5792237dbc8df
data/CHANGELOG.md ADDED
@@ -0,0 +1,126 @@
1
+ # Changelog
2
+
3
+ ## [0.3.0] — 2026-08-04
4
+
5
+ Synced with Confium Rust workspace v0.3.0 (product restructuring).
6
+
7
+ ### Changed
8
+
9
+ - **Rust edition bumped to 2024** (was 2021). Requires Rust 1.85+.
10
+ - **All confium dependencies now from crates.io** (removed path deps for
11
+ `confium-tc-cmp20` and `confium-tc-gg18`). `gem install confium` now works
12
+ without a local workspace checkout.
13
+ - **Version synced to 0.3.0** (was 0.1.0) to match the workspace version.
14
+
15
+ ### Added
16
+
17
+ - Dependencies on newly published shared crypto crates:
18
+ `confium-tc-core`, `confium-crypto-vss`, `confium-crypto-zk`,
19
+ `confium-privacy`, `confium-observability`.
20
+
21
+ ### Migration from 0.1.0
22
+
23
+ - Update `Gemfile`: `gem "confium", "~> 0.3"`
24
+ - Ensure Rust 1.85+ is installed (`rustup update stable`)
25
+ - Run `bundle exec rake compile` to rebuild the native extension
26
+
27
+ ## [0.1.0] — 2026-07-27
28
+
29
+ First public release of the Ruby bindings. Replaces the previous FFI-based
30
+ prototype with a Rust native extension built via `rb_sys` + `magnus`
31
+ (parsanol-ruby pattern). The extension is compiled at `gem install` time
32
+ and exposes the high-value Confium subsystems directly to Ruby.
33
+
34
+ ### Added
35
+
36
+ - **Native extension scaffold** (`ext/confium_native/`). cdylib built via
37
+ `rb_sys` and `magnus`; required by `lib/confium.rb` at load time.
38
+ `Confium::Native.version`, `Confium::Native.loaded?`, and
39
+ `Confium.core_version` provide a smoke-test surface.
40
+
41
+ - **`Confium::Transparency::MerkleTree`** — append-only RFC 6962 Merkle
42
+ tree. `#append(artifact_hash)`, `#root`, `#length`, `#empty?`,
43
+ `#inclusion_proof(seq)`. `Confium::Transparency::InclusionProof` with
44
+ `#sequence`, `#steps`, `#verify(root)`.
45
+
46
+ - **`Confium::Composite`** — PQ-migration composite signatures.
47
+ `.generate_ed25519_keypair`, `.sign_ed25519(private_key, message)`.
48
+ `Confium::Composite::Signature.new(components)` + `#verify(message)` +
49
+ `#component_count` + `#algorithms`.
50
+ `Confium::Composite::VerificationResult#all_verified?` + `#per_component`.
51
+
52
+ - **`Confium::Attributes`** — attribute-based threshold-signing policy DSL.
53
+ `.parse(expr)` + `Confium::Attributes::Predicate#satisfied_by?(signers)`.
54
+ `Confium::Attributes::Signer.new` + `#add(key, value)` + `#has?(key)` +
55
+ `#values(key)`. DSL covers `min_count`, `min_distinct`, `any`, `all`,
56
+ `none`, `and`, `or`, `not`.
57
+
58
+ - **`Confium::PKI::Certificate`** — X.509 v3 certificate parse + inspect.
59
+ `.from_der(binary)` / `.from_pem(string)`. `#to_der`, `#to_pem`,
60
+ `#fingerprint_sha256`, `#serial_hex`, `#not_before`, `#not_after`,
61
+ `#valid_at?(iso8601)`, `#public_key_bytes`.
62
+
63
+ - **`Confium::PKI::CSR`** — PKCS#10 certificate signing request.
64
+ `.from_der` / `.from_pem` / `#to_der` / `#to_pem`.
65
+
66
+ - **`Confium::PKI::CMS::SignedData`** — JSON-backed RFC 5652 model.
67
+ `.from_json` / `#to_json` / `#signer_count` / `#content_type` /
68
+ `#content` / `#certificate_count` / `#certificate_at(index)`.
69
+
70
+ - **`Confium::PKI::CMS::Content`** — value object for optional content.
71
+ `#bytes`, `#length`.
72
+
73
+ - **`Confium::PKI::XMLDSig`** — Canonical XML (RFC 3076) and Exclusive
74
+ C14N. `.canonicalize(xml)`, `.canonicalize_exclusive(xml)`.
75
+
76
+ - **`Confium::Identity::Actor`** — actor identity from JSON.
77
+ `.from_json` / `#to_json` / `#actor_id` / `#actor_type` / `#quorum_id` /
78
+ `#registered_at` / `#expires_at` / `#certificate_count`.
79
+ `Confium::Identity.actor_types` returns the six canonical role strings
80
+ (`manufacturer`, `testing_lab`, `issuing_authority_officer`,
81
+ `biml_director`, `quorum_coordinator`, `verifier`).
82
+
83
+ - **`Confium::Config::Manifest`** — deployment manifest parse + validate.
84
+ `.from_toml` / `#deployment_name` / `#operator` / `#manifest_version` /
85
+ `#tier_count` / `#tier_name_at` / `#quorum_count` / `#validate` /
86
+ `#valid?`.
87
+
88
+ - **`Confium::TC::FrostP256`** — real P-256 Shamir + ECDSA.
89
+ `.generate_keypair`, `.split_secret(secret, t, n)`,
90
+ `.recover_secret([{x:, y:}, ...])`, `.sign(private_key, message)`.
91
+ `Confium::TC::FrostP256::Share#x` / `#y_bytes`.
92
+
93
+ - **`Confium::TC::ElGamalP256`** — threshold ElGamal-P256 KEM.
94
+ `.encapsulate(public_key)` → `{ ciphertext: { c1:, c2: }, shared_secret: }`,
95
+ `.partial_decrypt(party_index, share_bytes, ciphertext)`,
96
+ `.aggregate_partials(partials, threshold, ciphertext)`.
97
+
98
+ ### Changed
99
+
100
+ - `confium.gemspec` switched from `ffi` (pure-Ruby FFI to C ABI) to
101
+ `rb_sys` (Rust native extension). Required Ruby version bumped to 3.1.
102
+ - `lib/confium.rb` now requires `confium_native/confium_native` instead
103
+ of declaring autoloads for hand-written FFI wrappers.
104
+ - All binary inputs and outputs use `Encoding::ASCII_8BIT` Strings
105
+ (binary), the idiomatic Ruby shape for cryptographic data.
106
+
107
+ ### Removed
108
+
109
+ - The `ffi`-based modules (`Confium::FFI`, `Confium::CFM`, `Confium::Lib`,
110
+ `Confium::Crypto`, `Confium::Digest`) — replaced by the magnus-based
111
+ classes above. Old spec files deleted.
112
+
113
+ ### Known limitations
114
+
115
+ - v0.1.0 ships as a **source gem** — `gem install` requires Rust + cargo
116
+ on the host. Cross-platform binary gems for Linux/Windows via
117
+ `rake-compiler-dock` will follow in v0.2.0.
118
+ - The threshold-cryptography surface covers Shamir + Lagrange + ECDSA +
119
+ threshold ElGamal. Full multi-party FROST/CMP20/GG18 session
120
+ orchestration (the async coordinator) is not yet exposed — lands in
121
+ v0.2.0.
122
+ - The composite-signature surface verifies Ed25519 components only.
123
+ ML-DSA-65 / SLH-DSA verifiers will land when the underlying Rust
124
+ crates ship.
125
+ - RBS type signatures in `sig/` are not yet provided — planned for v0.2.0
126
+ once the API stabilizes.