confium 0.3.0 → 0.3.1

data/lib/confium/errors/index_error.rb

@@ -1,13 +1,15 @@
 # frozen_string_literal: true
 
 # Raised when an out-of-range index is supplied.
-class Confium::IndexError < Confium::Error
-  attr_reader :index, :valid_range
+module Confium
+  class IndexError < Confium::Error
+    attr_reader :index, :valid_range
 
-  def initialize(message = nil, details_hash = nil, **kwargs)
-    message, kwargs = Confium::Errors::Coerce.args(message, details_hash, kwargs)
-    @index = kwargs.delete(:index)
-    @valid_range = kwargs.delete(:valid_range)
-    super(message, details: { index: @index, valid_range: @valid_range, **kwargs })
+    def initialize(message = nil, details_hash = nil, **kwargs)
+      message, kwargs = Confium::Errors::Coerce.args(message, details_hash, kwargs)
+      @index = kwargs.delete(:index)
+      @valid_range = kwargs.delete(:valid_range)
+      super(message, details: { index: @index, valid_range: @valid_range, **kwargs })
+    end
   end
 end

data/lib/confium/errors/not_found_error.rb

@@ -1,13 +1,15 @@
 # frozen_string_literal: true
 
 # Raised when a referenced slot/cert/share is not present.
-class Confium::NotFoundError < Confium::Error
-  attr_reader :kind, :identifier
+module Confium
+  class NotFoundError < Confium::Error
+    attr_reader :kind, :identifier
 
-  def initialize(message = nil, details_hash = nil, **kwargs)
-    message, kwargs = Confium::Errors::Coerce.args(message, details_hash, kwargs)
-    @kind = kwargs.delete(:kind)
-    @identifier = kwargs.delete(:identifier)
-    super(message, details: { kind: @kind, identifier: @identifier, **kwargs })
+    def initialize(message = nil, details_hash = nil, **kwargs)
+      message, kwargs = Confium::Errors::Coerce.args(message, details_hash, kwargs)
+      @kind = kwargs.delete(:kind)
+      @identifier = kwargs.delete(:identifier)
+      super(message, details: { kind: @kind, identifier: @identifier, **kwargs })
+    end
   end
 end

data/lib/confium/errors/parse_error.rb

@@ -1,13 +1,15 @@
 # frozen_string_literal: true
 
 # Raised when input cannot be parsed (bad JSON, malformed PEM, etc.).
-class Confium::ParseError < Confium::Error
-  attr_reader :format, :offset
+module Confium
+  class ParseError < Confium::Error
+    attr_reader :format, :offset
 
-  def initialize(message = nil, details_hash = nil, **kwargs)
-    message, kwargs = Confium::Errors::Coerce.args(message, details_hash, kwargs)
-    @format = kwargs.delete(:format)
-    @offset = kwargs.delete(:offset)
-    super(message, details: { format: @format, offset: @offset, **kwargs })
+    def initialize(message = nil, details_hash = nil, **kwargs)
+      message, kwargs = Confium::Errors::Coerce.args(message, details_hash, kwargs)
+      @format = kwargs.delete(:format)
+      @offset = kwargs.delete(:offset)
+      super(message, details: { format: @format, offset: @offset, **kwargs })
+    end
   end
 end

data/lib/confium/errors/policy_violation_error.rb

@@ -1,13 +1,15 @@
 # frozen_string_literal: true
 
 # Raised when a FIPS / jurisdictional policy is violated.
-class Confium::PolicyViolationError < Confium::Error
-  attr_reader :policy, :violation
+module Confium
+  class PolicyViolationError < Confium::Error
+    attr_reader :policy, :violation
 
-  def initialize(message = nil, details_hash = nil, **kwargs)
-    message, kwargs = Confium::Errors::Coerce.args(message, details_hash, kwargs)
-    @policy = kwargs.delete(:policy)
-    @violation = kwargs.delete(:violation)
-    super(message, details: { policy: @policy, violation: @violation, **kwargs })
+    def initialize(message = nil, details_hash = nil, **kwargs)
+      message, kwargs = Confium::Errors::Coerce.args(message, details_hash, kwargs)
+      @policy = kwargs.delete(:policy)
+      @violation = kwargs.delete(:violation)
+      super(message, details: { policy: @policy, violation: @violation, **kwargs })
+    end
   end
 end

data/lib/confium/errors/threshold_error.rb

@@ -2,13 +2,15 @@
 
 # Raised when a Shamir/threshold operation fails (insufficient shares,
 # duplicate coordinates, etc.).
-class Confium::ThresholdError < Confium::Error
-  attr_reader :have_count, :need_count
+module Confium
+  class ThresholdError < Confium::Error
+    attr_reader :have_count, :need_count
 
-  def initialize(message = nil, details_hash = nil, **kwargs)
-    message, kwargs = Confium::Errors::Coerce.args(message, details_hash, kwargs)
-    @have_count = kwargs.delete(:have_count)
-    @need_count = kwargs.delete(:need_count)
-    super(message, details: { have_count: @have_count, need_count: @need_count, **kwargs })
+    def initialize(message = nil, details_hash = nil, **kwargs)
+      message, kwargs = Confium::Errors::Coerce.args(message, details_hash, kwargs)
+      @have_count = kwargs.delete(:have_count)
+      @need_count = kwargs.delete(:need_count)
+      super(message, details: { have_count: @have_count, need_count: @need_count, **kwargs })
+    end
   end
 end

data/lib/confium/errors/unresolved_signer_error.rb

@@ -1,12 +1,14 @@
 # frozen_string_literal: true
 
 # Raised when a CMS signer_info cannot be resolved to a certificate.
-class Confium::UnresolvedSignerError < Confium::Error
-  attr_reader :signer_index
+module Confium
+  class UnresolvedSignerError < Confium::Error
+    attr_reader :signer_index
 
-  def initialize(message = nil, details_hash = nil, **kwargs)
-    message, kwargs = Confium::Errors::Coerce.args(message, details_hash, kwargs)
-    @signer_index = kwargs.delete(:signer_index)
-    super(message, details: { signer_index: @signer_index, **kwargs })
+    def initialize(message = nil, details_hash = nil, **kwargs)
+      message, kwargs = Confium::Errors::Coerce.args(message, details_hash, kwargs)
+      @signer_index = kwargs.delete(:signer_index)
+      super(message, details: { signer_index: @signer_index, **kwargs })
+    end
   end
 end

data/lib/confium/errors/validation_error.rb

@@ -2,14 +2,16 @@
 
 # Raised when input is well-formed but semantically invalid (wrong size,
 # out-of-range value, etc.).
-class Confium::ValidationError < Confium::Error
-  attr_reader :param, :expected, :actual
+module Confium
+  class ValidationError < Confium::Error
+    attr_reader :param, :expected, :actual
 
-  def initialize(message = nil, details_hash = nil, **kwargs)
-    message, kwargs = Confium::Errors::Coerce.args(message, details_hash, kwargs)
-    @param = kwargs.delete(:param)
-    @expected = kwargs.delete(:expected)
-    @actual = kwargs.delete(:actual)
-    super(message, details: { param: @param, expected: @expected, actual: @actual, **kwargs })
+    def initialize(message = nil, details_hash = nil, **kwargs)
+      message, kwargs = Confium::Errors::Coerce.args(message, details_hash, kwargs)
+      @param = kwargs.delete(:param)
+      @expected = kwargs.delete(:expected)
+      @actual = kwargs.delete(:actual)
+      super(message, details: { param: @param, expected: @expected, actual: @actual, **kwargs })
+    end
   end
 end

data/lib/confium/errors/verification_error.rb

@@ -1,13 +1,15 @@
 # frozen_string_literal: true
 
 # Raised when a signature / hash / proof fails to verify.
-class Confium::VerificationError < Confium::Error
-  attr_reader :signer_index, :algorithm
+module Confium
+  class VerificationError < Confium::Error
+    attr_reader :signer_index, :algorithm
 
-  def initialize(message = nil, details_hash = nil, **kwargs)
-    message, kwargs = Confium::Errors::Coerce.args(message, details_hash, kwargs)
-    @signer_index = kwargs.delete(:signer_index)
-    @algorithm = kwargs.delete(:algorithm)
-    super(message, details: { signer_index: @signer_index, algorithm: @algorithm, **kwargs })
+    def initialize(message = nil, details_hash = nil, **kwargs)
+      message, kwargs = Confium::Errors::Coerce.args(message, details_hash, kwargs)
+      @signer_index = kwargs.delete(:signer_index)
+      @algorithm = kwargs.delete(:algorithm)
+      super(message, details: { signer_index: @signer_index, algorithm: @algorithm, **kwargs })
+    end
   end
 end

data/lib/confium/errors.rb

@@ -23,4 +23,4 @@ module Confium
   end
 end
 
-require_relative "errors/coerce"
+require_relative 'errors/coerce'

data/lib/confium/ffi.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require "ffi"
+require 'ffi'
 
 # {Confium::FFI} is the namespace for everything that touches the native
 # Confium shared library through Ruby-FFI.
@@ -16,8 +16,8 @@ require "ffi"
 # migrated into `Confium::FFI::Library` in a follow-up.
 module Confium
   module FFI
-    autoload :Library, "confium/ffi/library"
-    autoload :Error,   "confium/ffi/error"
-    autoload :Options, "confium/ffi/options"
+    autoload :Library, 'confium/ffi/library'
+    autoload :Error,   'confium/ffi/error'
+    autoload :Options, 'confium/ffi/options'
   end
 end

data/lib/confium/lib.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'ffi'
 
 module Confium
@@ -5,30 +7,27 @@ module Confium
     extend ::FFI::Library
 
     FFI_LAYOUT = {
-      cfm_create: [ %i[pointer], :uint32 ],
-      cfm_destroy: [ %i[pointer], :uint32 ],
-      cfm_plugin_load: [ %i[pointer string string pointer pointer], :uint32 ],
-      cfm_hash_create: [ %i[pointer pointer pointer pointer pointer pointer], :uint32 ],
-      cfm_hash_output_size: [ %i[pointer pointer], :uint32 ],
-      cfm_hash_block_size: [ %i[pointer pointer], :uint32 ],
-      cfm_hash_update: [ %i[pointer pointer uint32], :uint32 ],
-      cfm_hash_reset: [ %i[pointer], :uint32 ],
-      cfm_hash_clone: [ %i[pointer pointer], :uint32 ],
-      cfm_hash_finalize: [ %i[pointer pointer uint32], :uint32 ],
-      cfm_hash_destroy: [ %i[pointer], :void ],
+      cfm_create: [%i[pointer], :uint32],
+      cfm_destroy: [%i[pointer], :uint32],
+      cfm_plugin_load: [%i[pointer string string pointer pointer], :uint32],
+      cfm_hash_create: [%i[pointer pointer pointer pointer pointer pointer], :uint32],
+      cfm_hash_output_size: [%i[pointer pointer], :uint32],
+      cfm_hash_block_size: [%i[pointer pointer], :uint32],
+      cfm_hash_update: [%i[pointer pointer uint32], :uint32],
+      cfm_hash_reset: [%i[pointer], :uint32],
+      cfm_hash_clone: [%i[pointer pointer], :uint32],
+      cfm_hash_finalize: [%i[pointer pointer uint32], :uint32],
+      cfm_hash_destroy: [%i[pointer], :void]
     }.freeze
 
-    ffi_lib([ENV["CONFIUM_LIB"], "confium", "libconfium"].compact)
+    ffi_lib([ENV.fetch('CONFIUM_LIB', nil), 'confium', 'libconfium'].compact)
 
     FFI_LAYOUT.each do |func, ary|
-      begin
-        class_eval do
-          attach_function(func, ary.first, ary.last)
-        end
-      rescue ::FFI::NotFoundError
-        # that's okay
+      class_eval do
+        attach_function(func, ary.first, ary.last)
       end
+    rescue ::FFI::NotFoundError
+      # that's okay
     end
-
   end
 end

data/lib/confium/pki/certificate_builder.rb

@@ -22,8 +22,8 @@ module Confium
       attr_accessor :subject, :issuer, :serial, :not_before, :not_after
 
       def initialize
-        @subject = ""
-        @issuer = nil  # nil = self-signed
+        @subject = ''
+        @issuer = nil # nil = self-signed
         @serial = rand(1..(1 << 128))
         @not_before = Time.now
         @not_after = Time.now + (365 * 24 * 3600)
@@ -52,7 +52,7 @@ module Confium
           not_before: @not_before.iso8601,
           not_after: @not_after.iso8601,
           algorithm: algorithm.to_s,
-          public_key_hex: kp["public_key"].unpack1("H*"),
+          public_key_hex: kp['public_key'].unpack1('H*')
         }
       end
     end

data/lib/confium/pki/cms/signed_data_builder.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
-require "json"
-require "digest"
+require 'json'
+require 'digest'
 
 # Confium::PKI::CMS::SignedDataBuilder — construct CMS SignedData
 # envelopes with one or more signers.
@@ -27,8 +27,8 @@ module Confium
         attr_accessor :content
 
         SIGNATURE_ALGORITHM_OID = {
-          ed25519: "1.3.101.112",
-          ecdsa_p256: "1.2.840.10045.4.3.2",
+          ed25519: '1.3.101.112',
+          ecdsa_p256: '1.2.840.10045.4.3.2'
         }.freeze
 
         def initialize
@@ -46,7 +46,7 @@ module Confium
           @signers << {
             cert_der: cert_der,
             private_key: private_key,
-            algorithm: algorithm,
+            algorithm: algorithm
           }
         end
 
@@ -57,8 +57,8 @@ module Confium
         #
         # @return [Confium::PKI::CMS::SignedData]
         def build
-          raise ArgumentError, "at least one signer is required" if @signers.empty?
-          raise ArgumentError, "#content is required (detached builder)" if @content.nil?
+          raise ArgumentError, 'at least one signer is required' if @signers.empty?
+          raise ArgumentError, '#content is required (detached builder)' if @content.nil?
 
           primary = @signers.first
           payload_bytes = @content.respond_to?(:bytes) ? @content.bytes : @content
@@ -68,7 +68,7 @@ module Confium
           SignedData.build_detached(
             signature,
             algorithm_oid,
-            @signers.map { |s| s[:cert_der] },
+            @signers.map { |s| s[:cert_der] }
           )
         end
 
@@ -78,10 +78,10 @@ module Confium
           case algorithm
           when :ed25519
             result = Confium::Composite.sign_ed25519(private_key, payload)
-            result.fetch("signature")
+            result.fetch('signature')
           when :ecdsa_p256
             result = Confium::TC::FrostP256.sign(private_key, payload)
-            result.fetch("signature")
+            result.fetch('signature')
           else
             raise ArgumentError, "unsupported algorithm: #{algorithm.inspect}"
           end

data/lib/confium/pki/cms.rb

@@ -9,7 +9,7 @@
 module Confium
   module PKI
     module CMS
-      autoload :SignedDataBuilder, "confium/pki/cms/signed_data_builder"
+      autoload :SignedDataBuilder, 'confium/pki/cms/signed_data_builder'
     end
   end
 end

data/lib/confium/pki/cnml.rb

@@ -16,18 +16,18 @@ module Confium
       # Required X.509 v3 extensions for a CNML certificate.
       REQUIRED_EXTENSIONS = {
         # Standard X.509 extensions required by CNML:
-        "2.5.29.19" => "basicConstraints (CA=true for IA certs, CA=false for leaf)",
-        "2.5.29.15" => "keyUsage (digitalSignature for signing certs)",
-        "2.5.29.37" => "extKeyUsage (id-kp-OCSPSigning or custom CNML OIDs)",
-        "2.5.29.14" => "subjectKeyIdentifier (required for CMS signer resolution)",
-        "2.5.29.35" => "authorityKeyIdentifier (required for chain building)",
+        '2.5.29.19' => 'basicConstraints (CA=true for IA certs, CA=false for leaf)',
+        '2.5.29.15' => 'keyUsage (digitalSignature for signing certs)',
+        '2.5.29.37' => 'extKeyUsage (id-kp-OCSPSigning or custom CNML OIDs)',
+        '2.5.29.14' => 'subjectKeyIdentifier (required for CMS signer resolution)',
+        '2.5.29.35' => 'authorityKeyIdentifier (required for chain building)'
       }.freeze
 
       # Optional but recommended extensions.
       OPTIONAL_EXTENSIONS = {
-        "2.5.29.31" => "cRLDistributionPoints (for revocation checking)",
-        "2.5.29.32" => "certificatePolicies (CNML policy OID)",
-        "1.3.6.1.5.5.7.1.1" => "authorityInfoAccess (OCSP responder URL)",
+        '2.5.29.31' => 'cRLDistributionPoints (for revocation checking)',
+        '2.5.29.32' => 'certificatePolicies (CNML policy OID)',
+        '1.3.6.1.5.5.7.1.1' => 'authorityInfoAccess (OCSP responder URL)'
       }.freeze
 
       # CNML certificate roles (maps to ActorType in Confium::Identity).

data/lib/confium/pki.rb

@@ -8,6 +8,6 @@
 # extend the native surface.
 module Confium
   module PKI
-    autoload :CMS, "confium/pki/cms"
+    autoload :CMS, 'confium/pki/cms'
   end
 end

data/lib/confium/policy.rb

@@ -24,29 +24,29 @@ module Confium
     JURISDICTIONS = {
       # EU: eIDAS + GDPR alignment. RSA >= 2048, ECDSA P-256+.
       eu: {
-        rsa:       2048,
+        rsa: 2048,
         ecdsa_p256: 256,
         ecdsa_p384: 384,
-        ed25519:   256,
-        name:      "European Union (eIDAS)",
+        ed25519: 256,
+        name: 'European Union (eIDAS)'
       },
       # US: NIST SP 800-131A. RSA >= 2048, ECDSA P-256+, SHA-1 legacy.
       us: {
-        rsa:       2048,
+        rsa: 2048,
         ecdsa_p256: 256,
         ecdsa_p384: 384,
-        ed25519:   256,
+        ed25519: 256,
         sha1_legacy: true,
-        name:      "United States (NIST SP 800-131A)",
+        name: 'United States (NIST SP 800-131A)'
       },
       # OIML CNML: international, follows BIPM recommendations.
       cnml: {
-        rsa:       2048,
+        rsa: 2048,
         ecdsa_p256: 256,
         ecdsa_p384: 384,
-        ed25519:   256,
-        name:      "OIML CNML (BIPM)",
-      },
+        ed25519: 256,
+        name: 'OIML CNML (BIPM)'
+      }
     }.freeze
 
     class << self
@@ -77,7 +77,7 @@ module Confium
       # FIPS 186-5 draft); ECDSA P-256/P-384 are.
       # @param value [Boolean]
       def fips_mode=(value)
-        @fips_mode = !!value
+        @fips_mode = !value.nil?
         @jurisdiction = :us if @fips_mode && @jurisdiction.nil?
       end
 
@@ -98,7 +98,7 @@ module Confium
             raise Confium::PolicyViolationError.new(
               "algorithm #{alg} is not FIPS-approved",
               policy: :fips,
-              violation: :unapproved_algorithm,
+              violation: :unapproved_algorithm
             )
           end
         end
@@ -115,7 +115,7 @@ module Confium
           raise Confium::PolicyViolationError.new(
             "#{alg} key size #{key_bits} below #{min_bits} for #{@jurisdiction}",
             policy: @jurisdiction,
-            violation: :key_too_small,
+            violation: :key_too_small
           )
         end