confium 0.2.0 → 0.3.1

data/ext/confium_native/src/ers.rs

@@ -0,0 +1,93 @@
+//! Confium::ERS — Evidence Record Syntax (RFC 4998) for long-term archival.
+
+use confium_transparency::ers::{
+    build_initial_evidence_record, renew_evidence_record, renewal_count,
+    EvidenceRecord, HashAlgorithm,
+};
+use magnus::{
+    exception, function, method, typed_data::Obj,
+    DataTypeFunctions, Error, Module, Object, Ruby, TryConvert, TypedData, Value,
+};
+
+use crate::util::bytes_from_value;
+
+#[derive(TypedData, DataTypeFunctions)]
+#[magnus(class = "Confium::ERS::EvidenceRecord", size)]
+pub struct ErsRecord {
+    inner: std::cell::RefCell<EvidenceRecord>,
+}
+
+impl ErsRecord {
+    fn build_initial(args: &[Value]) -> Result<Obj<Self>, Error> {
+        let first = args.first().ok_or_else(|| {
+            Error::new(exception::arg_error(), "data_hash required")
+        })?;
+        let data_hash = bytes_from_value(*first)?;
+        if data_hash.len() != 32 {
+            return Err(Error::new(
+                exception::arg_error(),
+                format!("data_hash must be 32 bytes, got {}", data_hash.len()),
+            ));
+        }
+        let mut hash = [0u8; 32];
+        hash.copy_from_slice(&data_hash);
+        let tsa_id: String = match args.get(1) {
+            Some(v) => TryConvert::try_convert(*v)?,
+            None => String::new(),
+        };
+        let token_bytes = match args.get(2) {
+            Some(v) => bytes_from_value(*v)?,
+            None => Vec::new(),
+        };
+        let record =
+            build_initial_evidence_record(hash, HashAlgorithm::Sha256, tsa_id, token_bytes);
+        let ruby = Ruby::get()
+            .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        Ok(ruby.obj_wrap(Self {
+            inner: std::cell::RefCell::new(record),
+        }))
+    }
+
+    fn renew(&self, args: &[Value]) -> Result<Obj<Self>, Error> {
+        let first = args.first().ok_or_else(|| {
+            Error::new(exception::arg_error(), "new_hash required")
+        })?;
+        let new_hash_bytes = bytes_from_value(*first)?;
+        if new_hash_bytes.len() != 32 {
+            return Err(Error::new(
+                exception::arg_error(),
+                format!("new_hash must be 32 bytes, got {}", new_hash_bytes.len()),
+            ));
+        }
+        let mut hash = [0u8; 32];
+        hash.copy_from_slice(&new_hash_bytes);
+        let tsa_id: String = match args.get(1) {
+            Some(v) => TryConvert::try_convert(*v)?,
+            None => String::new(),
+        };
+        let token_bytes = match args.get(2) {
+            Some(v) => bytes_from_value(*v)?,
+            None => Vec::new(),
+        };
+        let mut cloned = self.inner.borrow().clone();
+        renew_evidence_record(&mut cloned, HashAlgorithm::Sha256, hash, tsa_id, token_bytes);
+        let ruby = Ruby::get()
+            .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        Ok(ruby.obj_wrap(Self {
+            inner: std::cell::RefCell::new(cloned),
+        }))
+    }
+
+    fn renewal_count(&self) -> u32 {
+        renewal_count(&self.inner.borrow())
+    }
+}
+
+pub fn init(ruby: &Ruby, parent: magnus::RModule) -> Result<(), Error> {
+    let ers = parent.define_module("ERS")?;
+    let cls = ers.define_class("EvidenceRecord", ruby.class_object())?;
+    cls.define_singleton_method("build_initial", function!(ErsRecord::build_initial, -1))?;
+    cls.define_method("renew", method!(ErsRecord::renew, -1))?;
+    cls.define_method("renewal_count", method!(ErsRecord::renewal_count, 0))?;
+    Ok(())
+}

data/ext/confium_native/src/lib.rs

@@ -0,0 +1,56 @@
+//! confium_native — Rust native extension for the `confium` Ruby gem.
+//!
+//! Pattern follows parsanol-ruby: this cdylib is loaded by Ruby via
+//! `rb_sys`, and exposes a `Confium::Native` submodule whose functions
+//! are the Rust-backed implementation of the gem's API.
+
+mod audit;
+mod attributes;
+mod composite;
+mod deployment;
+mod ers;
+mod openpgp;
+mod path;
+mod pki;
+mod tc;
+mod transparency;
+mod util;
+
+use magnus::{function, Error, Module, Ruby};
+
+const VERSION: &str = env!("CARGO_PKG_VERSION");
+
+fn native_version() -> &'static str {
+    VERSION
+}
+
+fn native_loaded() -> bool {
+    true
+}
+
+fn core_version() -> &'static str {
+    // Set by build.rs at compile time from Cargo.lock. Always matches the
+    // confium-core crate version the extension was built against.
+    env!("CONFIUM_CORE_VERSION")
+}
+
+#[magnus::init]
+fn init(ruby: &Ruby) -> Result<(), Error> {
+    let confium = ruby.define_module("Confium")?;
+    let native = confium.define_module("Native")?;
+    native.define_module_function("version", function!(native_version, 0))?;
+    native.define_module_function("loaded?", function!(native_loaded, 0))?;
+    confium.define_module_function("core_version", function!(core_version, 0))?;
+
+    transparency::init(ruby, confium)?;
+    composite::init(ruby, confium)?;
+    attributes::init(ruby, confium)?;
+    pki::init(ruby, confium)?;
+    path::init(ruby, confium)?;
+    deployment::init(ruby, confium)?;
+    tc::init(ruby, confium)?;
+    audit::init(ruby, confium)?;
+    ers::init(ruby, confium)?;
+    openpgp::init(ruby, confium)?;
+    Ok(())
+}

data/ext/confium_native/src/openpgp.rs

@@ -0,0 +1,55 @@
+//! Confium::OpenPGP — OpenPGP (RFC 9580) operations via bundled rnp-rs.
+//!
+//! Confium ships RNP functionality baked into the native extension.
+
+use magnus::{exception, function, prelude::*, Error, Module, RModule, Ruby, TryConvert, Value};
+use rnp::ops::ArmorType;
+use rnp::{armor_bytes, dearmor_bytes};
+
+use crate::util::{bytes_from_value, bytes_to_rstring};
+
+/// Native: `Confium::OpenPGP._native_armor(data, type_str)` — 2 args.
+/// The Ruby wrapper `Confium::OpenPGP.armor(data, type = MESSAGE)`
+/// provides the default.
+fn native_armor(ruby: &Ruby, data: Value, type_str: Value) -> Result<magnus::RString, Error> {
+    let bytes = bytes_from_value(data)?;
+    let ty = if type_str.is_nil() {
+        ArmorType::Message
+    } else {
+        let s: String = TryConvert::try_convert(type_str)?;
+        match s.as_str() {
+            "public key" => ArmorType::PublicKey,
+            "secret key" => ArmorType::SecretKey,
+            "signature" => ArmorType::Signature,
+            "cleartext signed message" | "cleartext" => ArmorType::Cleartext,
+            _ => ArmorType::Message,
+        }
+    };
+    let armored = armor_bytes(&bytes, ty)
+        .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+    Ok(bytes_to_rstring(ruby, &armored))
+}
+
+/// Native: `Confium::OpenPGP._native_dearmor(data)` — 1 arg.
+fn native_dearmor(ruby: &Ruby, data: Value) -> Result<magnus::RString, Error> {
+    let bytes = bytes_from_value(data)?;
+    let raw = dearmor_bytes(&bytes)
+        .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+    Ok(bytes_to_rstring(ruby, &raw))
+}
+
+/// Initialize the `Confium::OpenPGP` module.
+pub fn init(_ruby: &Ruby, parent: RModule) -> Result<(), Error> {
+    let openpgp = parent.define_module("OpenPGP")?;
+
+    openpgp.define_singleton_method("_native_armor", function!(native_armor, 2))?;
+    openpgp.define_singleton_method("_native_dearmor", function!(native_dearmor, 1))?;
+
+    openpgp.const_set("MESSAGE", "message")?;
+    openpgp.const_set("PUBLIC_KEY", "public key")?;
+    openpgp.const_set("SECRET_KEY", "secret key")?;
+    openpgp.const_set("SIGNATURE", "signature")?;
+    openpgp.const_set("CLEARTEXT", "cleartext signed message")?;
+
+    Ok(())
+}

data/ext/confium_native/src/path.rs

@@ -0,0 +1,118 @@
+//! Confium::PKI::PathValidator — Ruby surface for `confium_pki::path`.
+//!
+//! Validates a certificate chain from leaf to trusted root. Checks
+//! time validity at each link, basic constraints, and (when a
+//! verifier is available) signature validity.
+
+use chrono::Utc;
+use confium_pki::{
+    cert::Certificate as RustCert,
+    path::{validate_path, CertPath},
+    result::VerificationResult as PathVerificationResult,
+};
+use magnus::{exception, function, method, prelude::*, DataTypeFunctions, Error, Module, Ruby, TypedData, Value};
+
+/// Wraps a confium_pki::path::VerificationResult.
+#[derive(TypedData, DataTypeFunctions)]
+#[magnus(class = "Confium::PKI::PathValidationResult", size)]
+pub struct PathResult {
+    pub inner: PathVerificationResult,
+}
+
+impl PathResult {
+    fn valid(&self) -> bool {
+        self.inner.valid
+    }
+
+    fn checks_json(&self) -> String {
+        let entries: Vec<String> = self
+            .inner
+            .checks
+            .iter()
+            .map(|c| format!("{:?}", c))
+            .collect();
+        format!("[{}]", entries.join(","))
+    }
+
+    fn check_count(&self) -> usize {
+        self.inner.checks.len()
+    }
+}
+
+/// Validate a certificate path (leaf -> intermediates -> root).
+///
+/// Ruby signature:
+///   Confium::PKI::PathValidator.validate(
+///     leaf: cert, intermediates: [cert, ...], root: cert, now: iso8601
+///   )
+///
+/// All cert arguments are Confium::PKI::Certificate instances.
+/// Returns a Confium::PKI::PathValidationResult.
+fn validate(args: &[Value]) -> Result<magnus::typed_data::Obj<PathResult>, Error> {
+    use magnus::scan_args;
+    let scanned = scan_args::scan_args::<(Value, Value, Value), (Option<String>,), (), (), (), ()>(args)?;
+    let leaf_value = scanned.required.0;
+    let intermediates_value = scanned.required.1;
+    let root_value = scanned.required.2;
+    let now_iso8601 = scanned.optional.0;
+
+    let leaf = extract_cert(leaf_value, "leaf")?;
+    let root = extract_cert(root_value, "root")?;
+
+    let intermediates = if intermediates_value.is_nil() {
+        Vec::new()
+    } else {
+        let arr = magnus::RArray::try_convert(intermediates_value)
+            .map_err(|e| Error::new(exception::arg_error(), e.to_string()))?;
+        let mut out = Vec::with_capacity(arr.len());
+        for v in arr.each() {
+            out.push(extract_cert(v?, "intermediate")?);
+        }
+        out
+    };
+
+    let now = match now_iso8601 {
+        Some(s) => chrono::DateTime::parse_from_rfc3339(&s)
+            .map_err(|e| Error::new(exception::arg_error(), format!("invalid time: {e}")))?
+            .with_timezone(&Utc),
+        None => Utc::now(),
+    };
+
+    let path = CertPath {
+        leaf: &leaf,
+        intermediates: intermediates.iter().collect(),
+        root: &root,
+    };
+    let result = validate_path(&path, now);
+
+    let ruby = Ruby::get()
+        .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+    Ok(ruby.obj_wrap(PathResult { inner: result }))
+}
+
+/// Extract a confium_pki::Certificate from a Ruby Confium::PKI::Certificate
+/// instance. The Ruby object wraps an Obj<Certificate> whose inner field
+/// holds the RustCert. We re-parse from DER to avoid lifetime issues.
+fn extract_cert(value: Value, label: &str) -> Result<RustCert, Error> {
+    // The Ruby Certificate object exposes #to_der which returns binary bytes.
+    // We re-parse those bytes into a fresh RustCert.
+    let der_value: Value = value
+        .funcall("to_der", ())
+        .map_err(|e| Error::new(exception::runtime_error(), format!("{}: cannot get DER: {e}", label)))?;
+    let der = crate::util::bytes_from_value(der_value)?;
+    RustCert::from_der(&der)
+        .map_err(|e| Error::new(exception::runtime_error(), format!("{}: invalid DER: {e}", label)))
+}
+
+pub fn init(ruby: &Ruby, parent: magnus::RModule) -> Result<(), Error> {
+    let pki = parent.define_module("PKI")?;
+    let validator = pki.define_module("PathValidator")?;
+    validator.define_module_function("validate", function!(validate, -1))?;
+
+    let result_class = pki.define_class("PathValidationResult", ruby.class_object())?;
+    result_class.define_method("valid?", method!(PathResult::valid, 0))?;
+    result_class.define_method("check_count", method!(PathResult::check_count, 0))?;
+    result_class.define_method("checks_json", method!(PathResult::checks_json, 0))?;
+
+    Ok(())
+}