confium 0.2.0 → 0.3.0

data/ext/confium_native/src/composite.rs

@@ -0,0 +1,302 @@
+//! Confium::Composite — Ruby surface for `confium_composite`.
+//!
+//! Exposes PQ-migration composite signatures (Ed25519 + ML-DSA-65 etc.).
+//!
+//!   - `Confium::Composite::Signature` — a composite signature with multiple
+//!     algorithm components over the same message. Wraps
+//!     `confium_composite::CompositeSignature`.
+//!   - `Confium::Composite.sign_ed25519(private_key_bytes, message)` —
+//!     helper that builds a real Ed25519 component using
+//!     `ed25519_dalek::SigningKey`.
+//!   - `Confium::Composite::VerificationResult` — result of `#verify(message)`,
+//!     with `#all_verified?` and `#per_component` accessors.
+
+use confium_composite::{CompositeSignature, ComponentSignature, VerificationResult};
+use ed25519_dalek::{Signer, SigningKey};
+use magnus::{
+    exception, function, method, prelude::*, scan_args,
+    typed_data::Obj, DataTypeFunctions, Error, IntoValue,
+    Module, Object, RHash, Ruby, TryConvert, TypedData, Value,
+};
+use crate::util::{bytes_from_value, bytes_to_rstring, confium_error, new_details};
+use rand_core::OsRng;
+
+#[derive(TypedData, DataTypeFunctions)]
+#[magnus(class = "Confium::Composite::Signature", size)]
+pub struct CompositeSig {
+    inner: std::cell::RefCell<CompositeSignature>,
+}
+
+impl CompositeSig {
+    fn new(components: Value) -> Result<Self, Error> {
+        let comps = parse_components(components)?;
+        Ok(Self {
+            inner: std::cell::RefCell::new(CompositeSignature::new(comps)),
+        })
+    }
+
+    fn component_count(&self) -> usize {
+        self.inner.borrow().component_count()
+    }
+
+    fn algorithms(&self) -> Vec<String> {
+        self.inner
+            .borrow()
+            .algorithms()
+            .into_iter()
+            .map(String::from)
+            .collect()
+    }
+
+    /// Verify all components against `message`. Built-in verifiers cover
+    /// Ed25519 + ECDSA-P256. Caller-supplied verifiers (a Ruby Hash
+    /// `algorithm_string -> Proc(public_key, message, signature)`) plug
+    /// in for any other algorithm. Returns a typed VerificationResult.
+    fn verify(&self, args: &[Value]) -> Result<Obj<VerificationResultWrap>, Error> {
+        let scanned = scan_args::scan_args::<(Value,), (Option<Value>,), (), (), (), ()>(args)?;
+        let message = scanned.required.0;
+        let verifiers_value = scanned.optional.0;
+        let msg = bytes_from_value(message)?;
+        let caller_verifiers = match verifiers_value {
+            Some(v) => parse_caller_verifiers(v)?,
+            None => std::collections::HashMap::new(),
+        };        let result = self
+            .inner
+            .borrow()
+            .verify(&msg, |algorithm, public_key, m, signature| {
+                if algorithm == confium_composite::ED25519 {
+                    confium_composite::ed25519_verifier(algorithm, public_key, m, signature)
+                } else if algorithm == confium_composite::ECDSA_P256 || algorithm == "ECDSA" {
+                    confium_composite::p256_verifier(algorithm, public_key, m, signature)
+                } else if let Some(callback) = caller_verifiers.get(algorithm) {
+                    invoke_caller_verifier(callback, public_key, m, signature)
+                } else {
+                    Err(format!("unsupported algorithm: {algorithm}"))
+                }
+            })
+            .map_err(|e| {
+                let ruby = Ruby::get().expect("Ruby must be available");
+                let details = new_details(&ruby);
+                confium_error(e.to_string(), "VerificationError", details)
+            })?;
+        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        Ok(ruby.obj_wrap(VerificationResultWrap { inner: result }))
+    }
+}
+
+/// Caller-supplied verifier callbacks keyed by algorithm string.
+/// Each value is a Ruby Proc taking (public_key_bytes, message_bytes,
+/// signature_bytes) and returning true/false.
+type CallerVerifiers = std::collections::HashMap<String, magnus::Value>;
+
+fn parse_caller_verifiers(v: Value) -> Result<CallerVerifiers, Error> {
+    let hash: RHash = RHash::try_convert(v)?;
+    let mut out = CallerVerifiers::new();
+    hash.foreach(|k: Value, val: Value| {
+        let key: String = String::try_convert(k)?;
+        out.insert(key, val);
+        Ok(magnus::r_hash::ForEach::Continue)
+    })?;
+    Ok(out)
+}
+
+fn invoke_caller_verifier(
+    callback: &magnus::Value,
+    public_key: &[u8],
+    message: &[u8],
+    signature: &[u8],
+) -> Result<(), String> {
+    let ruby = Ruby::get().map_err(|e| e.to_string())?;
+    let pk = ruby.str_new(std::str::from_utf8(public_key).unwrap_or(""));
+    let _ = pk;
+    // Use Vec<u8> arguments — magnus converts them to Ruby Array<Integer>.
+    let result: magnus::Value = callback
+        .funcall("call", (public_key.to_vec(), message.to_vec(), signature.to_vec()))
+        .map_err(|e| format!("caller verifier raised: {e}"))?;
+    let ok: bool = bool::try_convert(result).map_err(|e| format!("caller verifier returned non-bool: {e}"))?;
+    if ok {
+        Ok(())
+    } else {
+        Err("caller verifier returned false".into())
+    }
+}
+
+#[derive(TypedData, DataTypeFunctions)]
+#[magnus(class = "Confium::Composite::VerificationResult", size)]
+pub struct VerificationResultWrap {
+    inner: VerificationResult,
+}
+
+impl VerificationResultWrap {
+    fn all_verified(&self) -> bool {
+        self.inner.all_verified
+    }
+
+    fn per_component(&self) -> Result<Value, Error> {
+        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        let result = ruby.hash_new();
+        for c in &self.inner.per_component {
+            let entry = ruby.hash_new();
+            entry.aset("algorithm", c.algorithm.clone())?;
+            entry.aset("verified", c.verified)?;
+            if let Some(err) = &c.error {
+                entry.aset("error", err.clone())?;
+            }
+            result.aset(c.index, entry)?;
+        }
+        Ok(result.into_value_with(&ruby))
+    }
+}
+
+/// Build a real Ed25519 component signature.
+///
+/// `Confium::Composite.sign_ed25519(private_key_bytes, message)` returns
+/// a Hash with `algorithm`, `public_key`, `signature` keys.
+fn sign_ed25519(ruby: &Ruby, private_key: Value, message: Value) -> Result<RHash, Error> {
+    let pk_bytes = bytes_from_value(private_key)?;
+    let msg = bytes_from_value(message)?;
+    if pk_bytes.len() != 32 {
+        return Err(Error::new(
+            exception::arg_error(),
+            format!("Ed25519 private key must be 32 bytes, got {}", pk_bytes.len()),
+        ));
+    }
+    let mut pk_arr = [0u8; 32];
+    pk_arr.copy_from_slice(&pk_bytes);
+    let signing = SigningKey::from_bytes(&pk_arr);
+    let component = match confium_composite::build_ed25519_component(&signing, &msg) {
+        Ok(c) => c,
+        Err(e) => {
+            crate::audit::fire_event(
+                "composite_sign_ed25519",
+                "failure",
+                Some("Ed25519"),
+                Some(&msg),
+                Some(&e.to_string()),
+            );
+            return Err(Error::new(exception::runtime_error(), e.to_string()));
+        }
+    };
+
+    crate::audit::fire_event(
+        "composite_sign_ed25519",
+        "success",
+        Some("Ed25519"),
+        Some(&msg),
+        None,
+    );
+
+    let result = ruby.hash_new();
+    result.aset("algorithm", component.algorithm)?;
+    result.aset("public_key", bytes_to_rstring(ruby, &component.public_key))?;
+    result.aset("signature", bytes_to_rstring(ruby, &component.signature))?;
+    Ok(result)
+}
+
+/// Generate a fresh Ed25519 keypair.
+///
+/// `Confium::Composite.generate_ed25519_keypair` returns `[private_key, public_key]`
+/// as binary strings (32 bytes each).
+/// Build a real ECDSA-P256 component signature. Useful when the caller
+/// holds a P-256 signing key and wants to participate in a composite
+/// signature alongside e.g. Ed25519 or ML-DSA-65.
+fn sign_p256(ruby: &Ruby, private_key: Value, message: Value) -> Result<RHash, Error> {
+    let pk_bytes = bytes_from_value(private_key)?;
+    let msg = bytes_from_value(message)?;
+    if pk_bytes.len() != 32 {
+        return Err(Error::new(
+            exception::arg_error(),
+            format!("P-256 private key must be 32 bytes, got {}", pk_bytes.len()),
+        ));
+    }
+    let mut arr = [0u8; 32];
+    arr.copy_from_slice(&pk_bytes);
+    use p256::ecdsa::{Signature, SigningKey, signature::Signer};
+    let signing = SigningKey::from_bytes(&arr.into())
+        .map_err(|e| Error::new(exception::arg_error(), format!("invalid P-256 private key: {e}")))?;
+    let sig: Signature = match signing.try_sign(msg.as_slice()) {
+        Ok(s) => s,
+        Err(e) => {
+            crate::audit::fire_event(
+                "composite_sign_p256",
+                "failure",
+                Some("ECDSA-P256"),
+                Some(&msg),
+                Some(&format!("sign error: {e}")),
+            );
+            return Err(Error::new(exception::runtime_error(), format!("sign error: {e}")));
+        }
+    };
+    let verifying = signing.verifying_key();
+    let verifying_bytes: Vec<u8> = verifying.to_sec1_bytes().to_vec();
+    let sig_bytes: Vec<u8> = sig.to_der().to_bytes().to_vec();
+
+    crate::audit::fire_event(
+        "composite_sign_p256",
+        "success",
+        Some("ECDSA-P256"),
+        Some(&msg),
+        None,
+    );
+
+    let result = ruby.hash_new();
+    result.aset("algorithm", "ECDSA-P256")?;
+    result.aset("public_key", bytes_to_rstring(ruby, &verifying_bytes))?;
+    result.aset("signature", bytes_to_rstring(ruby, &sig_bytes))?;
+    Ok(result)
+}
+
+fn generate_ed25519_keypair(ruby: &Ruby) -> Result<RHash, Error> {
+    let mut rng = OsRng;
+    let signing = SigningKey::generate(&mut rng);
+    let verifying = signing.verifying_key();
+    let result = ruby.hash_new();
+    result.aset("private_key", bytes_to_rstring(ruby, &signing.to_bytes()))?;
+    result.aset("public_key", bytes_to_rstring(ruby, &verifying.to_bytes()))?;
+    Ok(result)
+}
+
+fn parse_components(value: Value) -> Result<Vec<ComponentSignature>, Error> {
+    let arr = magnus::RArray::try_convert(value)?;
+    let mut out = Vec::with_capacity(arr.len());
+    for v in arr.each() {
+        let h: RHash = RHash::try_convert(v?)?;
+        let algorithm: String = h.fetch::<_, String>("algorithm")?;
+        let public_key: Value = h.fetch::<_, Value>("public_key")?;
+        let signature: Value = h.fetch::<_, Value>("signature")?;
+        out.push(ComponentSignature {
+            algorithm,
+            public_key: bytes_from_value(public_key)?,
+            signature: bytes_from_value(signature)?,
+        });
+    }
+    Ok(out)
+}
+
+pub fn init(ruby: &Ruby, parent: magnus::RModule) -> Result<(), Error> {
+    let composite = parent.define_module("Composite")?;
+    composite.define_module_function(
+        "sign_ed25519",
+        function!(sign_ed25519, 2),
+    )?;
+    composite.define_module_function(
+        "sign_p256",
+        function!(sign_p256, 2),
+    )?;
+    composite.define_module_function(
+        "generate_ed25519_keypair",
+        function!(generate_ed25519_keypair, 0),
+    )?;
+
+    let sig_class = composite.define_class("Signature", ruby.class_object())?;
+    sig_class.define_singleton_method("new", function!(CompositeSig::new, 1))?;
+    sig_class.define_method("component_count", method!(CompositeSig::component_count, 0))?;
+    sig_class.define_method("algorithms", method!(CompositeSig::algorithms, 0))?;
+    sig_class.define_method("verify", method!(CompositeSig::verify, -1))?;
+
+    let result_class = composite.define_class("VerificationResult", ruby.class_object())?;
+    result_class.define_method("all_verified?", method!(VerificationResultWrap::all_verified, 0))?;
+    result_class.define_method("per_component", method!(VerificationResultWrap::per_component, 0))?;
+
+    Ok(())
+}

data/ext/confium_native/src/deployment.rs

@@ -0,0 +1,176 @@
+//! Confium::Identity + Confium::Config — Ruby surface for the deployment
+//! crate's identity + manifest types.
+//!
+//! Phase 1C-2 scope:
+//!   - `Confium::Identity::Actor` — wraps `confium_deployment::identity::ActorIdentity`.
+//!   - `Confium::Identity::ACTOR_TYPES` — array of valid actor-type strings.
+//!   - `Confium::Config::Manifest` — parse + validate deployment manifest TOML.
+
+use confium_deployment::{
+    identity::{ActorIdentity, ActorType},
+    manifest::{parse_manifest, Manifest as RustManifest},
+    validate::validate_manifest,
+};
+use crate::util::enforce_size;
+use magnus::{exception, function, method, prelude::*, typed_data::Obj, DataTypeFunctions, Error, Module, Object, Ruby, TypedData};
+
+#[derive(TypedData, DataTypeFunctions)]
+#[magnus(class = "Confium::Identity::Actor", size)]
+pub struct Actor {
+    pub inner: std::cell::RefCell<ActorIdentity>,
+}
+
+impl Actor {
+    fn from_json(json: String) -> Result<Obj<Self>, Error> {
+        enforce_size(json.len())?;
+        let actor: ActorIdentity = serde_json::from_str(&json)
+            .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        Ok(ruby.obj_wrap(Self {
+            inner: std::cell::RefCell::new(actor),
+        }))
+    }
+
+    fn to_json(&self) -> Result<String, Error> {
+        serde_json::to_string(&*self.inner.borrow())
+            .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))
+    }
+
+    fn actor_id(&self) -> String {
+        self.inner.borrow().actor_id.clone()
+    }
+
+    fn actor_type(&self) -> String {
+        actor_type_str(self.inner.borrow().actor_type).to_string()
+    }
+
+    fn quorum_id(&self) -> Option<String> {
+        self.inner.borrow().quorum_id.clone()
+    }
+
+    fn registered_at_iso8601(&self) -> String {
+        self.inner.borrow().registered_at.to_rfc3339()
+    }
+
+    fn expires_at_iso8601(&self) -> Option<String> {
+        self.inner.borrow().expires_at.map(|t| t.to_rfc3339())
+    }
+
+    fn certificate_count(&self) -> usize {
+        self.inner.borrow().certificate_chain_der.len()
+    }
+}
+
+fn actor_type_str(t: ActorType) -> &'static str {
+    match t {
+        ActorType::Manufacturer => "manufacturer",
+        ActorType::TestingLab => "testing_lab",
+        ActorType::IssuingAuthorityOfficer => "issuing_authority_officer",
+        ActorType::BimlDirector => "biml_director",
+        ActorType::QuorumCoordinator => "quorum_coordinator",
+        ActorType::Verifier => "verifier",
+    }
+}
+
+fn actor_types() -> Vec<&'static str> {
+    vec![
+        actor_type_str(ActorType::Manufacturer),
+        actor_type_str(ActorType::TestingLab),
+        actor_type_str(ActorType::IssuingAuthorityOfficer),
+        actor_type_str(ActorType::BimlDirector),
+        actor_type_str(ActorType::QuorumCoordinator),
+        actor_type_str(ActorType::Verifier),
+    ]
+}
+
+#[derive(TypedData, DataTypeFunctions)]
+#[magnus(class = "Confium::Config::Manifest", size)]
+pub struct Manifest {
+    pub inner: std::cell::RefCell<RustManifest>,
+}
+
+impl Manifest {
+    fn from_toml(toml_str: String) -> Result<Obj<Self>, Error> {
+        enforce_size(toml_str.len())?;
+        let manifest = parse_manifest(&toml_str)
+            .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        Ok(ruby.obj_wrap(Self {
+            inner: std::cell::RefCell::new(manifest),
+        }))
+    }
+
+    fn deployment_name(&self) -> String {
+        self.inner.borrow().deployment.name.clone()
+    }
+
+    fn operator(&self) -> String {
+        self.inner.borrow().deployment.operator.clone()
+    }
+
+    fn manifest_version(&self) -> u32 {
+        self.inner.borrow().deployment.manifest_version
+    }
+
+    fn tier_count(&self) -> usize {
+        self.inner.borrow().tiers.len()
+    }
+
+    fn tier_name_at(&self, index: usize) -> Result<String, Error> {
+        self.inner
+            .borrow()
+            .tiers
+            .get(index)
+            .map(|t| t.name.clone())
+            .ok_or_else(|| {
+                Error::new(
+                    exception::index_error(),
+                    format!("tier index {index} out of range"),
+                )
+            })
+    }
+
+    fn quorum_count(&self) -> usize {
+        self.inner.borrow().quorums.len()
+    }
+
+    fn validate(&self) -> Result<Vec<String>, Error> {
+        let m = self.inner.borrow();
+        let report = validate_manifest(&m);
+        Ok(report.errors)
+    }
+
+    fn is_valid(&self) -> Result<bool, Error> {
+        let m = self.inner.borrow();
+        let report = validate_manifest(&m);
+        Ok(report.errors.is_empty())
+    }
+}
+
+pub fn init(ruby: &Ruby, parent: magnus::RModule) -> Result<(), Error> {
+    let identity = parent.define_module("Identity")?;
+    identity.define_module_function("actor_types", function!(actor_types, 0))?;
+    let actor_class = identity.define_class("Actor", ruby.class_object())?;
+    actor_class.define_singleton_method("from_json", function!(Actor::from_json, 1))?;
+    actor_class.define_method("to_json", method!(Actor::to_json, 0))?;
+    actor_class.define_method("actor_id", method!(Actor::actor_id, 0))?;
+    actor_class.define_method("actor_type", method!(Actor::actor_type, 0))?;
+    actor_class.define_method("quorum_id", method!(Actor::quorum_id, 0))?;
+    actor_class.define_method("registered_at", method!(Actor::registered_at_iso8601, 0))?;
+    actor_class.define_method("expires_at", method!(Actor::expires_at_iso8601, 0))?;
+    actor_class.define_method("certificate_count", method!(Actor::certificate_count, 0))?;
+
+    let config = parent.define_module("Config")?;
+    let manifest_class = config.define_class("Manifest", ruby.class_object())?;
+    manifest_class.define_singleton_method("from_toml", function!(Manifest::from_toml, 1))?;
+    manifest_class.define_method("deployment_name", method!(Manifest::deployment_name, 0))?;
+    manifest_class.define_method("operator", method!(Manifest::operator, 0))?;
+    manifest_class.define_method("manifest_version", method!(Manifest::manifest_version, 0))?;
+    manifest_class.define_method("tier_count", method!(Manifest::tier_count, 0))?;
+    manifest_class.define_method("tier_name_at", method!(Manifest::tier_name_at, 1))?;
+    manifest_class.define_method("quorum_count", method!(Manifest::quorum_count, 0))?;
+    manifest_class.define_method("validate", method!(Manifest::validate, 0))?;
+    manifest_class.define_method("valid?", method!(Manifest::is_valid, 0))?;
+
+    Ok(())
+}

data/ext/confium_native/src/ers.rs

@@ -0,0 +1,93 @@
+//! Confium::ERS — Evidence Record Syntax (RFC 4998) for long-term archival.
+
+use confium_transparency::ers::{
+    build_initial_evidence_record, renew_evidence_record, renewal_count,
+    EvidenceRecord, HashAlgorithm,
+};
+use magnus::{
+    exception, function, method, prelude::*, typed_data::Obj,
+    DataTypeFunctions, Error, Module, Object, Ruby, TryConvert, TypedData, Value,
+};
+
+use crate::util::bytes_from_value;
+
+#[derive(TypedData, DataTypeFunctions)]
+#[magnus(class = "Confium::ERS::EvidenceRecord", size)]
+pub struct ErsRecord {
+    inner: std::cell::RefCell<EvidenceRecord>,
+}
+
+impl ErsRecord {
+    fn build_initial(args: &[Value]) -> Result<Obj<Self>, Error> {
+        let first = args.first().ok_or_else(|| {
+            Error::new(exception::arg_error(), "data_hash required")
+        })?;
+        let data_hash = bytes_from_value(*first)?;
+        if data_hash.len() != 32 {
+            return Err(Error::new(
+                exception::arg_error(),
+                format!("data_hash must be 32 bytes, got {}", data_hash.len()),
+            ));
+        }
+        let mut hash = [0u8; 32];
+        hash.copy_from_slice(&data_hash);
+        let tsa_id: String = match args.get(1) {
+            Some(v) => TryConvert::try_convert(*v)?,
+            None => String::new(),
+        };
+        let token_bytes = match args.get(2) {
+            Some(v) => bytes_from_value(*v)?,
+            None => Vec::new(),
+        };
+        let record =
+            build_initial_evidence_record(hash, HashAlgorithm::Sha256, tsa_id, token_bytes);
+        let ruby = Ruby::get()
+            .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        Ok(ruby.obj_wrap(Self {
+            inner: std::cell::RefCell::new(record),
+        }))
+    }
+
+    fn renew(&self, args: &[Value]) -> Result<Obj<Self>, Error> {
+        let first = args.first().ok_or_else(|| {
+            Error::new(exception::arg_error(), "new_hash required")
+        })?;
+        let new_hash_bytes = bytes_from_value(*first)?;
+        if new_hash_bytes.len() != 32 {
+            return Err(Error::new(
+                exception::arg_error(),
+                format!("new_hash must be 32 bytes, got {}", new_hash_bytes.len()),
+            ));
+        }
+        let mut hash = [0u8; 32];
+        hash.copy_from_slice(&new_hash_bytes);
+        let tsa_id: String = match args.get(1) {
+            Some(v) => TryConvert::try_convert(*v)?,
+            None => String::new(),
+        };
+        let token_bytes = match args.get(2) {
+            Some(v) => bytes_from_value(*v)?,
+            None => Vec::new(),
+        };
+        let mut cloned = self.inner.borrow().clone();
+        renew_evidence_record(&mut cloned, HashAlgorithm::Sha256, hash, tsa_id, token_bytes);
+        let ruby = Ruby::get()
+            .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        Ok(ruby.obj_wrap(Self {
+            inner: std::cell::RefCell::new(cloned),
+        }))
+    }
+
+    fn renewal_count(&self) -> u32 {
+        renewal_count(&self.inner.borrow())
+    }
+}
+
+pub fn init(ruby: &Ruby, parent: magnus::RModule) -> Result<(), Error> {
+    let ers = parent.define_module("ERS")?;
+    let cls = ers.define_class("EvidenceRecord", ruby.class_object())?;
+    cls.define_singleton_method("build_initial", function!(ErsRecord::build_initial, -1))?;
+    cls.define_method("renew", method!(ErsRecord::renew, -1))?;
+    cls.define_method("renewal_count", method!(ErsRecord::renewal_count, 0))?;
+    Ok(())
+}

data/ext/confium_native/src/lib.rs

@@ -0,0 +1,56 @@
+//! confium_native — Rust native extension for the `confium` Ruby gem.
+//!
+//! Pattern follows parsanol-ruby: this cdylib is loaded by Ruby via
+//! `rb_sys`, and exposes a `Confium::Native` submodule whose functions
+//! are the Rust-backed implementation of the gem's API.
+
+mod audit;
+mod attributes;
+mod composite;
+mod deployment;
+mod ers;
+mod openpgp;
+mod path;
+mod pki;
+mod tc;
+mod transparency;
+mod util;
+
+use magnus::{function, Error, Module, Ruby};
+
+const VERSION: &str = env!("CARGO_PKG_VERSION");
+
+fn native_version() -> &'static str {
+    VERSION
+}
+
+fn native_loaded() -> bool {
+    true
+}
+
+fn core_version() -> &'static str {
+    // Set by build.rs at compile time from Cargo.lock. Always matches the
+    // confium-core crate version the extension was built against.
+    env!("CONFIUM_CORE_VERSION")
+}
+
+#[magnus::init]
+fn init(ruby: &Ruby) -> Result<(), Error> {
+    let confium = ruby.define_module("Confium")?;
+    let native = confium.define_module("Native")?;
+    native.define_module_function("version", function!(native_version, 0))?;
+    native.define_module_function("loaded?", function!(native_loaded, 0))?;
+    confium.define_module_function("core_version", function!(core_version, 0))?;
+
+    transparency::init(ruby, confium)?;
+    composite::init(ruby, confium)?;
+    attributes::init(ruby, confium)?;
+    pki::init(ruby, confium)?;
+    path::init(ruby, confium)?;
+    deployment::init(ruby, confium)?;
+    tc::init(ruby, confium)?;
+    audit::init(ruby, confium)?;
+    ers::init(ruby, confium)?;
+    openpgp::init(ruby, confium)?;
+    Ok(())
+}

data/ext/confium_native/src/openpgp.rs

@@ -0,0 +1,55 @@
+//! Confium::OpenPGP — OpenPGP (RFC 9580) operations via bundled rnp-rs.
+//!
+//! Confium ships RNP functionality baked into the native extension.
+
+use magnus::{exception, function, prelude::*, Error, Module, RModule, Ruby, TryConvert, Value};
+use rnp::ops::ArmorType;
+use rnp::{armor_bytes, dearmor_bytes};
+
+use crate::util::{bytes_from_value, bytes_to_rstring};
+
+/// Native: `Confium::OpenPGP._native_armor(data, type_str)` — 2 args.
+/// The Ruby wrapper `Confium::OpenPGP.armor(data, type = MESSAGE)`
+/// provides the default.
+fn native_armor(ruby: &Ruby, data: Value, type_str: Value) -> Result<magnus::RString, Error> {
+    let bytes = bytes_from_value(data)?;
+    let ty = if type_str.is_nil() {
+        ArmorType::Message
+    } else {
+        let s: String = TryConvert::try_convert(type_str)?;
+        match s.as_str() {
+            "public key" => ArmorType::PublicKey,
+            "secret key" => ArmorType::SecretKey,
+            "signature" => ArmorType::Signature,
+            "cleartext signed message" | "cleartext" => ArmorType::Cleartext,
+            _ => ArmorType::Message,
+        }
+    };
+    let armored = armor_bytes(&bytes, ty)
+        .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+    Ok(bytes_to_rstring(ruby, &armored))
+}
+
+/// Native: `Confium::OpenPGP._native_dearmor(data)` — 1 arg.
+fn native_dearmor(ruby: &Ruby, data: Value) -> Result<magnus::RString, Error> {
+    let bytes = bytes_from_value(data)?;
+    let raw = dearmor_bytes(&bytes)
+        .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+    Ok(bytes_to_rstring(ruby, &raw))
+}
+
+/// Initialize the `Confium::OpenPGP` module.
+pub fn init(ruby: &Ruby, parent: RModule) -> Result<(), Error> {
+    let openpgp = parent.define_module("OpenPGP")?;
+
+    openpgp.define_singleton_method("_native_armor", function!(native_armor, 2))?;
+    openpgp.define_singleton_method("_native_dearmor", function!(native_dearmor, 1))?;
+
+    openpgp.const_set("MESSAGE", "message")?;
+    openpgp.const_set("PUBLIC_KEY", "public key")?;
+    openpgp.const_set("SECRET_KEY", "secret key")?;
+    openpgp.const_set("SIGNATURE", "signature")?;
+    openpgp.const_set("CLEARTEXT", "cleartext signed message")?;
+
+    Ok(())
+}