confium 0.2.0 → 0.3.1

data/Cargo.toml

@@ -0,0 +1,9 @@
+[workspace]
+resolver = "2"
+members = ["ext/confium_native"]
+
+[profile.release]
+opt-level = 3
+lto = "off"
+codegen-units = 1
+debug = true

data/README.adoc

@@ -1,39 +1,139 @@
 = Confium Ruby bindings
+:toc: macro
+:toclevels: 2
 
-== Purpose
+Ruby bindings for the Confium open-source framework for multi-stakeholder threshold cryptography.
 
-Ruby bindings for Confium.
+Confium supports three deployment modes:
+
+* **Mode 1 — Peer-to-peer threshold cryptography**: nodes do TC directly (MPC, distributed custody, BFT)
+* **Mode 2 — TC PKI replacement**: drop-in for existing PKI consumers (PKCS#11 server, OpenSSL 3.0 provider, JCE)
+* **Mode 3 — TC Certificate PKI**: institutional deployments with custom certificate formats (OIML CNML, BIPM, pharma, accreditation)
+
+This gem wraps the high-value Confium subsystems via a Rust native extension (built at `gem install` time with `rb_sys` + `magnus`). No separate C ABI library to install; everything is statically linked into the extension.
 
 == Installation
 
-Install the gem and add to the application's Gemfile by executing:
+Add to your Gemfile:
 
-[source,sh]
+[source,ruby]
 ----
-$ bundle add confium
+gem "confium", "~> 0.1"
 ----
 
-If bundler is not being used to manage dependencies, install the gem by executing:
+Or install directly:
 
 [source,sh]
 ----
 $ gem install confium
 ----
 
-== Usage
+=== Prerequisites
+
+* Ruby ≥ 3.1
+* Rust stable toolchain (`rustup default stable`)
+* C toolchain (clang/gcc/Xcode CLT)
+
+The gem compiles a Rust cdylib at install time and links it into Ruby as a native extension. There is no separate `libconfium` to install.
+
+== Quick start
 
-TODO: Write usage instructions here
+[source,ruby]
+----
+require "confium"
+
+# Transparency log
+tree = Confium::Transparency::MerkleTree.new
+seq = tree.append(artifact_hash_bytes_32)
+root = tree.root  # binary String, 32 bytes
+proof = tree.inclusion_proof(seq)
+proof.verify(root)  # => true
+
+# Composite signature (PQ migration)
+kp = Confium::Composite.generate_ed25519_keypair
+component = Confium::Composite.sign_ed25519(kp["private_key"], "message")
+sig = Confium::Composite::Signature.new([component])
+result = sig.verify("message")
+result.all_verified?  # => true
+
+# Attribute-based threshold policy
+pred = Confium::Attributes.parse(%q{and(min_count("role:director", 3), min_distinct("region", 3))})
+alice = Confium::Attributes::Signer.new
+alice.add("role:director", "yes")
+alice.add("region", "europe")
+# ... bob, carol similarly
+pred.satisfied_by?([alice, bob, carol])  # => true
+
+# X.509 certificate
+cert = Confium::PKI::Certificate.from_pem(File.read("cert.pem"))
+puts cert.fingerprint_sha256
+puts cert.valid_at?(Time.now.utc.iso8601)  # => true
+
+# Real threshold cryptography: P-256 Shamir
+kp = Confium::TC::FrostP256.generate_keypair
+shares = Confium::TC::FrostP256.split_secret(kp["private_key"], 3, 5)
+recovered = Confium::TC::FrostP256.recover_secret(shares.first(3).map { |s| { "x" => s.x, "y" => s.y_bytes } })
+recovered == kp["private_key"]  # => true
+----
+
+== API surface (v0.1.0)
+
+=== `Confium::Transparency`
+- `MerkleTree.new` / `#append(artifact_hash)` / `#root` / `#length` / `#empty?` / `#inclusion_proof(seq)`
+- `InclusionProof#sequence` / `#steps` / `#verify(root)`
+
+=== `Confium::Composite` — PQ migration
+- `.generate_ed25519_keypair` → `{ private_key:, public_key: }`
+- `.sign_ed25519(private_key, message)` → component Hash
+- `Signature.new(components)` / `#verify(message)` / `#component_count` / `#algorithms`
+- `VerificationResult#all_verified?` / `#per_component`
+
+=== `Confium::Attributes` — threshold policy DSL
+- `.parse(dsl_expr)` → `Predicate`
+- `Predicate#satisfied_by?(signers)`
+- `Signer.new` / `#add(key, value)` / `#has?(key)` / `#values(key)`
+- DSL: `min_count("attr", n)`, `min_distinct("attr", n)`, `any("attr")`, `all("attr")`, `none("attr")`, `and(...)`, `or(...)`, `not(p)`
+
+=== `Confium::PKI`
+- `Certificate.from_der(bytes)` / `.from_pem(str)` / `#to_der` / `#to_pem` / `#fingerprint_sha256` / `#serial_hex` / `#not_before` / `#not_after` / `#valid_at?(iso8601)` / `#public_key_bytes`
+- `CSR.from_der` / `.from_pem` / `#to_der` / `#to_pem`
+- `CMS::SignedData.from_json` / `#to_json` / `#signer_count` / `#content_type` / `#content` / `#certificate_count` / `#certificate_at(i)`
+- `CMS::Content#bytes` / `#length`
+- `XMLDSig.canonicalize(xml)` / `.canonicalize_exclusive(xml)` (Canonical XML RFC 3076 + Exclusive C14N)
+
+=== `Confium::Identity` — actor roles
+- `.actor_types` → `["manufacturer", "testing_lab", "issuing_authority_officer", "biml_director", "quorum_coordinator", "verifier"]`
+- `Actor.from_json(json)` / `#to_json` / `#actor_id` / `#actor_type` / `#quorum_id` / `#registered_at` / `#expires_at` / `#certificate_count`
+
+=== `Confium::Config` — deployment manifest
+- `Manifest.from_toml(toml_str)` / `#deployment_name` / `#operator` / `#manifest_version` / `#tier_count` / `#tier_name_at(i)` / `#quorum_count` / `#validate` / `#valid?`
+
+=== `Confium::TC::FrostP256` — real P-256 Shamir + ECDSA
+- `.generate_keypair` → `{ private_key: (32 bytes), public_key: (65 bytes SEC1) }`
+- `.split_secret(secret, t, n)` → array of `Share` with `#x`, `#y_bytes`
+- `.recover_secret([{x:, y:}, ...])` → secret bytes
+- `.sign(private_key, message)` → `{ der:, fixed: }`
+
+=== `Confium::TC::ElGamalP256` — threshold ElGamal-P256 KEM
+- `.encapsulate(public_key_bytes)` → `{ ciphertext: { c1:, c2: }, shared_secret: }`
+- `.partial_decrypt(party_index, share_bytes, ciphertext)` → `{ party_index:, bytes: }`
+- `.aggregate_partials(partials, threshold, ciphertext)` → shared_secret bytes
 
 == Development
 
-After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake spec` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
+After checking out the repo:
 
-To install this gem onto your local machine, run `bundle exec rake install`. To release a new version, update the version number in `version.rb`, and then run `bundle exec rake release`, which will create a git tag for the version, push git commits and the created tag, and push the `.gem` file to [rubygems.org](https://rubygems.org).
+[source,sh]
+----
+$ bundle install
+$ bundle exec rake compile       # build the Rust extension
+$ bundle exec rspec              # 75+ specs
+----
 
-== Contributing
+== Architecture
 
-Bug reports and pull requests are welcome on GitHub at https://github.com/[USERNAME]/confium. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the [code of conduct](https://github.com/[USERNAME]/confium/blob/main/CODE_OF_CONDUCT.md).
+The native extension lives at `ext/confium_native/` as a Cargo workspace. It depends on the `confium-*` crates from crates.io (not on the local Rust workspace). The Ruby-side API is defined entirely in the extension via magnus — `lib/confium.rb` just requires the compiled `.bundle`.
 
-== Code of Conduct
+== License
 
-Everyone interacting in the Confium project's codebases, issue trackers, chat rooms and mailing lists is expected to follow the [code of conduct](https://github.com/[USERNAME]/confium/blob/main/CODE_OF_CONDUCT.md).
+BSD-2-Clause, same as the rest of the Confium workspace.

data/Rakefile

@@ -1,12 +1,17 @@
 # frozen_string_literal: true
 
-require "bundler/gem_tasks"
-require "rspec/core/rake_task"
-
+require 'bundler/gem_tasks'
+require 'rspec/core/rake_task'
 RSpec::Core::RakeTask.new(:spec)
 
-require "rubocop/rake_task"
-
+require 'rubocop/rake_task'
 RuboCop::RakeTask.new
 
-task default: %i[spec rubocop]
+require 'rb_sys/extensiontask'
+gemspec = Gem::Specification.load('confium.gemspec')
+RbSys::ExtensionTask.new('confium_native', gemspec) do |ext|
+  ext.lib_dir = 'lib/confium_native'
+end
+
+task compile: :clean
+task default: %i[compile spec rubocop]

data/confium.gemspec

@@ -1,35 +1,56 @@
 # frozen_string_literal: true
 
-require_relative "lib/confium/version"
+require_relative 'lib/confium/version'
 
 Gem::Specification.new do |spec|
-  spec.name = "confium"
+  spec.name = 'confium'
   spec.version = Confium::VERSION
-  spec.authors = ["Ribose Open"]
-  spec.email = ["open.source@ribose.com"]
-
-  spec.summary = "FFI bindings for Confium."
-  # spec.description = "TODO: Write a longer description or delete this line."
-  spec.homepage = "https://www.confium.org"
-  spec.required_ruby_version = ">= 2.7.0"
-
-  # spec.metadata["allowed_push_host"] = "TODO: Set to your gem server 'https://example.com'"
-
-  spec.metadata["homepage_uri"] = spec.homepage
-  spec.metadata["source_code_uri"] = "https://github.com/confium/confium-ruby"
-  spec.metadata["changelog_uri"] = "https://github.com/confium/confium-ruby"
-
-  # Specify which files should be added to the gem when it is released.
-  # The `git ls-files -z` loads the files in the RubyGem that have been added into git.
-  spec.files = Dir.chdir(__dir__) do
-    `git ls-files -z`.split("\x0").reject do |f|
-      (f == __FILE__) || f.match(%r{\A(?:(?:bin|test|spec|features)/|\.(?:git|travis|circleci)|appveyor)})
-    end
-  end
-  spec.bindir = "exe"
-  spec.executables = spec.files.grep(%r{\Aexe/}) { |f| File.basename(f) }
-  spec.require_paths = ["lib"]
-
-  spec.add_dependency "ffi"
-  spec.add_development_dependency "rspec"
+  spec.platform = Gem::Platform::RUBY
+
+  spec.authors = ['Ribose Open']
+  spec.email = ['open.source@ribose.com']
+
+  spec.summary = 'Ruby bindings for the Confium multi-stakeholder threshold cryptography framework.'
+  spec.description = 'Confium provides threshold cryptography for Ruby: FROST / CMP20 / GG18 ' \
+                     'signing sessions, X.509 certificate issuance (CNML-ready), composite ' \
+                     'PQ-migration signatures, and transparency-log anchoring. Powered by a ' \
+                     'Rust native extension (magnus + rb_sys) — no separate C ABI to install.'
+  spec.homepage = 'https://www.confium.org'
+  spec.license = 'BSD-2-Clause'
+
+  spec.metadata = {
+    'bug_tracker_uri' => 'https://github.com/confium/confium-ruby/issues',
+    'changelog_uri' => 'https://github.com/confium/confium-ruby/blob/main/CHANGELOG.md',
+    'homepage_uri' => spec.homepage,
+    'source_code_uri' => 'https://github.com/confium/confium-ruby',
+    'rubygems_mfa_required' => 'true'
+  }
+
+  # Rust extension — compiled at gem install via rb_sys.
+  spec.extensions = ['ext/confium_native/extconf.rb']
+
+  spec.files = Dir.glob('{lib,ext}/**/*') + %w[
+    CHANGELOG.md
+    LICENSE.txt
+    Rakefile
+    README.adoc
+    confium.gemspec
+    Cargo.toml
+    Cargo.lock
+  ]
+  spec.files.reject! { |f| File.directory?(f) }
+  spec.files.reject! { |f| f =~ /\.(dll|so|dylib|lib|bundle)\Z/ }
+  spec.require_paths = ['lib']
+
+  spec.required_ruby_version = '>= 3.1.0'
+
+  # Required for the Rust extension.
+  spec.add_dependency 'rb_sys', '~> 0.9.39'
+
+  spec.add_development_dependency 'rake', '~> 13.0'
+  spec.add_development_dependency 'rake-compiler', '~> 1.2.0'
+  spec.add_development_dependency 'rake-compiler-dock', '~> 1.3'
+  spec.add_development_dependency 'rspec', '~> 3.0'
+  spec.add_development_dependency 'rubocop', '~> 1.0'
+  spec.add_development_dependency 'steep', '~> 1.5'
 end

data/ext/confium_native/Cargo.toml

@@ -0,0 +1,63 @@
+# confium_native — Rust native extension for the confium Ruby gem.
+#
+# Compiles to a Ruby-loadable cdylib (`confium_native.bundle` / `.so` / `.dll`)
+# via `rb_sys` + `magnus`. The Ruby side loads it through `ext/confium_native/extconf.rb`
+# (invoked by `gem install` or `bundle exec rake compile`).
+
+[package]
+name = "confium_native"
+version = "0.3.0"
+edition = "2024"
+rust-version = "1.85"
+publish = false
+
+[lib]
+crate-type = ["cdylib"]
+
+build = "build.rs"
+
+[dependencies]
+# rb-sys for Ruby C API access.
+rb-sys = { version = "0.9.124", features = ["global-allocator"] }
+
+# magnus for idiomatic Ruby <-> Rust bindings.
+magnus = { version = "0.8", features = ["bytes"] }
+
+# Confium crates — all from crates.io so gem install works without workspace checkout.
+confium-core = "0.2"
+confium-transparency = "0.4"
+confium-composite = "0.3.1"
+confium-attributes = "0.3.1"
+confium-pki = "0.3.1"
+confium-deployment = "0.3"
+confium-tc = "0.3.1"
+confium-tc-frost-p256 = "0.3"
+confium-tc-elgamal-p256 = "0.3"
+confium-tc-cmp20 = "0.3.1"
+confium-tc-gg18 = "0.3.1"
+
+# Newly published shared crypto crates (confium product restructuring).
+confium-tc-core = "0.3"
+confium-crypto-vss = "0.3"
+confium-crypto-zk = "0.3"
+confium-privacy = "0.3"
+confium-observability = "0.3"
+
+# P-256 scalar/point types used by the TC surface.
+p256 = { version = "0.13", features = ["ecdsa"] }
+
+ed25519-dalek = { version = "2", features = ["rand_core"] }
+rand_core = { version = "0.6", default-features = false, features = ["getrandom"] }
+
+sha2 = "0.10"
+subtle = "2"
+chrono = "0.4"
+hex = "0.4"
+serde_json = "1"
+
+# RNP (OpenPGP, RFC 9580) — hard-bundled with vendored feature so
+# librnp is compiled from source via rnp-src. No system librnp needed.
+rnp = { package = "rnp-rs", version = "0.1.10", features = ["vendored"] }
+
+[profile.release]
+lto = "off"

data/ext/confium_native/build.rs

@@ -0,0 +1,72 @@
+// build.rs — read the version of confium-core from Cargo.lock and emit
+// it as a CARGO_RUSTC_ENV so lib.rs can read it at compile time.
+//
+// Note: cargo invokes build scripts with a custom cwd (the staging dir),
+// so we cannot rely on `Path::new("Cargo.lock")` being present. Instead
+// we walk up from CARGO_MANIFEST_DIR looking for a Cargo.toml that
+// declares a [workspace] section. That Cargo.lock is the one we need.
+
+use std::fs;
+use std::path::PathBuf;
+
+fn main() {
+    let manifest_dir = PathBuf::from(env!("CARGO_MANIFEST_DIR"));
+    let workspace_dir = find_workspace_root(&manifest_dir);
+    let lockfile_path = workspace_dir.join("Cargo.lock");
+    let lockfile = fs::read_to_string(&lockfile_path).expect("could not read workspace Cargo.lock");
+
+    let version = lockfile
+        .lines()
+        // find each `[[package]]` block then the `name = "..."` line inside
+        .scan(String::new(), |state, line| {
+            if line.trim().starts_with("[[package]]") {
+                *state = String::new();
+            } else {
+                state.push_str(line);
+                state.push('\n');
+            }
+            Some(state.clone())
+        })
+        .filter_map(|block| {
+            let name = block.lines().find_map(|l| {
+                let trimmed = l.trim();
+                trimmed.strip_prefix("name = \"")?.strip_suffix('"').map(String::from)
+            })?;
+            let version = block.lines().find_map(|l| {
+                let trimmed = l.trim();
+                trimmed.strip_prefix("version = \"")?.strip_suffix('"').map(String::from)
+            })?;
+            Some((name, version))
+        })
+        .find(|(name, _)| name == "confium-core")
+        .map(|(_, v)| v);
+
+    match version {
+        Some(v) => {
+            println!("cargo:rerun-if-changed={}", lockfile_path.display());
+            println!("cargo:rustc-env=CONFIUM_CORE_VERSION={v}");
+        }
+        None => panic!("confium-core not found in Cargo.lock"),
+    }
+}
+
+/// Walk up the directory tree from `start` until we find a Cargo.toml
+/// containing a `[workspace]` section. That directory is the workspace
+/// root; its Cargo.lock is what we need.
+fn find_workspace_root(start: &std::path::Path) -> PathBuf {
+    let mut current = start.to_path_buf();
+    loop {
+        let candidate = current.join("Cargo.toml");
+        if candidate.exists() {
+            if let Ok(contents) = fs::read_to_string(&candidate) {
+                if contents.contains("[workspace]") {
+                    return current;
+                }
+            }
+        }
+        match current.parent() {
+            Some(parent) => current = parent.to_path_buf(),
+            None => panic!("no workspace root found above {}", start.display()),
+        }
+    }
+}

data/ext/confium_native/extconf.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+require 'mkmf'
+require 'rb_sys/mkmf'
+
+create_rust_makefile('confium_native') do |r|
+  r.profile = ENV.fetch('RB_SYS_CARGO_PROFILE', :dev).to_sym
+  r.use_stable_api_compiled_fallback = true
+  r.force_install_rust_toolchain = false
+end

data/ext/confium_native/src/attributes.rs

@@ -0,0 +1,88 @@
+//! Confium::Attributes — Ruby surface for `confium_attributes`.
+//!
+//! Exposes the predicate DSL + evaluator for threshold-signing attribute
+//! policies (e.g., "5-of-9 directors, spanning 3 regions").
+//!
+//!   - `Confium::Attributes.parse(expr)` — parse a DSL string into a
+//!     `Confium::Attributes::Predicate`.
+//!   - `Confium::Attributes::Predicate#satisfied_by?(signers)` — evaluate
+//!     against a list of `Confium::Attributes::Signer`.
+//!   - `Confium::Attributes::Signer` — a signer's attribute map, with
+//!     `#add(key, value)`, `#has?(key)`, `#values(key)`.
+
+use confium_attributes::{evaluate, parse as dsl_parse, Predicate, SignerAttributes};
+use magnus::{
+    exception, function, method, typed_data::Obj, DataTypeFunctions, Error, Module,
+    Object, Ruby, TryConvert, TypedData, Value,
+};
+
+#[derive(TypedData, DataTypeFunctions)]
+#[magnus(class = "Confium::Attributes::Predicate", size)]
+pub struct PredicateWrap {
+    pub inner: Predicate,
+}
+
+impl PredicateWrap {
+    fn satisfied_by(&self, signers_value: Value) -> Result<bool, Error> {
+        let arr = magnus::RArray::try_convert(signers_value)?;
+        let mut owned: Vec<SignerAttributes> = Vec::with_capacity(arr.len());
+        for v in arr.each() {
+            let signer_wrap = Obj::<SignerWrap>::try_convert(v?)?;
+            owned.push(signer_wrap.inner.borrow().clone());
+        }
+        let refs: Vec<&SignerAttributes> = owned.iter().collect();
+        Ok(evaluate(&self.inner, &refs))
+    }
+}
+
+#[derive(TypedData, DataTypeFunctions)]
+#[magnus(class = "Confium::Attributes::Signer", size)]
+pub struct SignerWrap {
+    pub inner: std::cell::RefCell<SignerAttributes>,
+}
+
+impl SignerWrap {
+    fn new() -> Self {
+        Self {
+            inner: std::cell::RefCell::new(SignerAttributes::new()),
+        }
+    }
+
+    fn add(&self, key: String, value: String) {
+        self.inner.borrow_mut().add(key, value);
+    }
+
+    fn has(&self, key: String) -> bool {
+        self.inner.borrow().has(&key)
+    }
+
+    fn values(&self, key: String) -> Vec<String> {
+        self.inner.borrow().values(&key)
+    }
+}
+
+fn parse(expr: String) -> Result<Obj<PredicateWrap>, Error> {
+    let predicate = dsl_parse(&expr)
+        .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+    let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+    Ok(ruby.obj_wrap(PredicateWrap { inner: predicate }))
+}
+
+pub fn init(ruby: &Ruby, parent: magnus::RModule) -> Result<(), Error> {
+    let attributes = parent.define_module("Attributes")?;
+    attributes.define_module_function("parse", function!(parse, 1))?;
+
+    let pred_class = attributes.define_class("Predicate", ruby.class_object())?;
+    pred_class.define_method(
+        "satisfied_by?",
+        method!(PredicateWrap::satisfied_by, 1),
+    )?;
+
+    let signer_class = attributes.define_class("Signer", ruby.class_object())?;
+    signer_class.define_singleton_method("new", function!(SignerWrap::new, 0))?;
+    signer_class.define_method("add", method!(SignerWrap::add, 2))?;
+    signer_class.define_method("has?", method!(SignerWrap::has, 1))?;
+    signer_class.define_method("values", method!(SignerWrap::values, 1))?;
+
+    Ok(())
+}