confium 0.3.0 → 0.3.2

data/lib/confium/secure_bytes.rb

@@ -14,111 +14,113 @@
 #
 # After #clear, #bytes raises Confium::ClearedError.
 
-class Confium::SecureBytes
-  # Raised when #bytes is called after #clear.
-  class ClearedError < Confium::Error
-    def initialize(message = "SecureBytes already cleared")
-      super(message, details: {})
+module Confium
+  class SecureBytes
+    # Raised when #bytes is called after #clear.
+    class ClearedError < Confium::Error
+      def initialize(message = 'SecureBytes already cleared')
+        super(message, details: {})
+      end
     end
-  end
 
-  # Create a SecureBytes wrapping a copy of the given String.
-  # The original String's contents are NOT modified; callers should
-  # zeroize the original separately if needed.
-  # @param raw [String] binary String (any encoding; bytes are copied)
-  # @return [Confium::SecureBytes]
-  def self.wrap(raw)
-    new(raw)
-  end
+    # Create a SecureBytes wrapping a copy of the given String.
+    # The original String's contents are NOT modified; callers should
+    # zeroize the original separately if needed.
+    # @param raw [String] binary String (any encoding; bytes are copied)
+    # @return [Confium::SecureBytes]
+    def self.wrap(raw)
+      new(raw)
+    end
 
-  # @api private
-  def initialize(raw)
-    @buffer = raw.dup.force_encoding(Encoding::ASCII_8BIT)
-    @cleared = false
-    # Register finalizer to zeroize if the object is GC'd without
-    # an explicit #clear call.
-    ObjectSpace.define_finalizer(self, finalizer_proc)
-  end
+    # @api private
+    def initialize(raw)
+      @buffer = raw.dup.force_encoding(Encoding::ASCII_8BIT)
+      @cleared = false
+      # Register finalizer to zeroize if the object is GC'd without
+      # an explicit #clear call.
+      ObjectSpace.define_finalizer(self, finalizer_proc)
+    end
 
-  # Non-destructive read of the wrapped bytes.
-  # @return [String] binary String (ASCII-8BIT encoding)
-  # @raise [ClearedError] if #clear was already called
-  def bytes
-    raise ClearedError if @cleared
+    # Non-destructive read of the wrapped bytes.
+    # @return [String] binary String (ASCII-8BIT encoding)
+    # @raise [ClearedError] if #clear was already called
+    def bytes
+      raise ClearedError if @cleared
 
-    @buffer.dup
-  end
+      @buffer.dup
+    end
 
-  # Destructive read: returns a copy, then zeroizes the original.
-  # @return [String] binary String
-  # @raise [ClearedError] if #clear was already called
-  def bytes!
-    raise ClearedError if @cleared
+    # Destructive read: returns a copy, then zeroizes the original.
+    # @return [String] binary String
+    # @raise [ClearedError] if #clear was already called
+    def bytes!
+      raise ClearedError if @cleared
 
-    copy = @buffer.dup
-    clear
-    copy
-  end
+      copy = @buffer.dup
+      clear
+      copy
+    end
 
-  # Number of bytes. Returns 0 after #clear.
-  # @return [Integer]
-  def length
-    @cleared ? 0 : @buffer.bytesize
-  end
+    # Number of bytes. Returns 0 after #clear.
+    # @return [Integer]
+    def length
+      @cleared ? 0 : @buffer.bytesize
+    end
 
-  alias size length
+    alias size length
 
-  # Whether the buffer has been cleared.
-  # @return [Boolean]
-  def cleared?
-    @cleared
-  end
+    # Whether the buffer has been cleared.
+    # @return [Boolean]
+    def cleared?
+      @cleared
+    end
 
-  # Zeroize the buffer immediately. Idempotent.
-  # @return [self]
-  def clear
-    return self if @cleared
+    # Zeroize the buffer immediately. Idempotent.
+    # @return [self]
+    def clear
+      return self if @cleared
 
-    # Overwrite every byte with 0x00 in place.
-    @buffer.replace("\x00" * @buffer.bytesize)
-    @buffer = nil
-    @cleared = true
-    self
-  end
+      # Overwrite every byte with 0x00 in place.
+      @buffer.replace("\x00" * @buffer.bytesize)
+      @buffer = nil
+      @cleared = true
+      self
+    end
 
-  # String representation for debugging. Does NOT expose the raw bytes.
-  # @return [String]
-  def inspect
-    if @cleared
-      "#<Confium::SecureBytes:0x#{object_id.to_s(16)} CLEARED>"
-    else
-      "#<Confium::SecureBytes:0x#{object_id.to_s(16)} #{length} bytes>"
+    # String representation for debugging. Does NOT expose the raw bytes.
+    # @return [String]
+    def inspect
+      if @cleared
+        "#<Confium::SecureBytes:0x#{object_id.to_s(16)} CLEARED>"
+      else
+        "#<Confium::SecureBytes:0x#{object_id.to_s(16)} #{length} bytes>"
+      end
     end
-  end
 
-  private
+    private
 
-  # Finalizer proc that zeroizes the buffer if GC collects this
-  # object without an explicit #clear. Uses object_id to find the
-  # buffer — but since the buffer is an instance variable that may
-  # already be collected, this is a best-effort path. Explicit #clear
-  # is the recommended path.
-  # @return [Proc]
-  def finalizer_proc
-    method(:finalize)
-  end
+    # Finalizer proc that zeroizes the buffer if GC collects this
+    # object without an explicit #clear. Uses object_id to find the
+    # buffer — but since the buffer is an instance variable that may
+    # already be collected, this is a best-effort path. Explicit #clear
+    # is the recommended path.
+    # @return [Proc]
+    def finalizer_proc
+      method(:finalize)
+    end
 
-  # Called by the GC finalizer.
-  def finalize(_id)
-    # Best-effort: the buffer may already be collected by the time
-    # the finalizer runs. If @buffer still exists, zeroize it.
-    # This is a closure over the instance — MRI guarantees the
-    # finalizer runs after the object is unreachable but before
-    # the buffer's memory is reused.
-    return if @cleared
-
-    @buffer&.replace("\x00" * @buffer.bytesize)
-    @buffer = nil
-    @cleared = true
+    # Called by the GC finalizer.
+    def finalize(_id)
+      # Best-effort: the buffer may already be collected by the time
+      # the finalizer runs. If @buffer still exists, zeroize it.
+      # This is a closure over the instance — MRI guarantees the
+      # finalizer runs after the object is unreachable but before
+      # the buffer's memory is reused.
+      return if @cleared
+
+      @buffer&.replace("\x00" * @buffer.bytesize)
+      @buffer = nil
+      @cleared = true
+    end
   end
 end

data/lib/confium/tc/coordinator.rb

@@ -25,7 +25,7 @@ module Confium
         @sessions = {}
       end
 
-      def create_session(message:, threshold:, unlock_window: 14400)
+      def create_session(message:, threshold:, unlock_window: 14_400)
         session_id = "session-#{@sessions.length + 1}"
         @sessions[session_id] = {
           message: message,
@@ -33,7 +33,7 @@ module Confium
           unlock_window: unlock_window,
           state: :pending,
           commitments: [],
-          shares: [],
+          shares: []
         }
         session_id
       end
@@ -45,9 +45,9 @@ module Confium
       def submit_commitment(session_id, signer_id, commitment_bytes)
         session = @sessions[session_id] or raise "Unknown session: #{session_id}"
         session[:commitments] << { signer_id: signer_id, bytes: commitment_bytes }
-        if session[:commitments].length >= session[:threshold]
-          session[:state] = :commitments_collected
-        end
+        return unless session[:commitments].length >= session[:threshold]
+
+        session[:state] = :commitments_collected
       end
 
       def submit_share(session_id, signer_id, share_bytes)
@@ -57,7 +57,8 @@ module Confium
 
       def aggregate(session_id)
         session = @sessions[session_id] or raise "Unknown session: #{session_id}"
-        raise "Threshold not met" if session[:shares].length < session[:threshold]
+        raise 'Threshold not met' if session[:shares].length < session[:threshold]
+
         session[:state] = :completed
         # In real implementation, calls FFI to aggregate shares
         session[:shares].map { |s| s[:bytes] }.join

data/lib/confium/tc/session.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require "confium/lib"
+require 'confium/lib'
 
 # Confium::TC::Session wraps a threshold cryptography session.
 #
@@ -32,7 +32,8 @@ module Confium
       end
 
       def set_local_share(share_bytes)
-        raise ArgumentError, "share must be a String" unless share_bytes.is_a?(String)
+        raise ArgumentError, 'share must be a String' unless share_bytes.is_a?(String)
+
         @local_share = share_bytes
       end
 
@@ -41,7 +42,8 @@ module Confium
       end
 
       def result
-        raise "Session not complete" unless complete?
+        raise 'Session not complete' unless complete?
+
         @result
       end
     end

data/lib/confium/tc/session_stub.rb

@@ -31,12 +31,12 @@ module Confium
       # call confium_tc::session::Session::round_step.
       def round_step(_incoming_messages)
         @round += 1
-        @complete = @round >= 3  # FROST is 3 rounds
+        @complete = @round >= 3 # FROST is 3 rounds
         { outgoing: [], complete: @complete }
       end
 
       def result
-        nil  # Real implementation returns the signature/secret bytes.
+        nil # Real implementation returns the signature/secret bytes.
       end
     end
   end

data/lib/confium/tc/share_file.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
-require "json"
-require "fileutils"
+require 'json'
+require 'fileutils'
 
 module Confium
   module TC
@@ -46,11 +46,11 @@ module Confium
       def self.from_json(json)
         d = JSON.parse(json)
         new(
-          scheme: d.fetch("scheme"),
-          threshold: d.fetch("threshold"),
-          party_count: d.fetch("party_count"),
-          public_key: [d.fetch("public_key")].pack("H*"),
-          shares: d.fetch("shares").map { |h| [h].pack("H*") },
+          scheme: d.fetch('scheme'),
+          threshold: d.fetch('threshold'),
+          party_count: d.fetch('party_count'),
+          public_key: [d.fetch('public_key')].pack('H*'),
+          shares: d.fetch('shares').map { |h| [h].pack('H*') }
         )
       end
 
@@ -67,8 +67,8 @@ module Confium
           scheme: scheme,
           threshold: threshold,
           party_count: party_count,
-          public_key: public_key.unpack1("H*"),
-          shares: shares.map { |s| s.unpack1("H*") },
+          public_key: public_key.unpack1('H*'),
+          shares: shares.map { |s| s.unpack1('H*') }
         )
       end
 
@@ -76,10 +76,10 @@ module Confium
       def self.from_keygen(scheme_name, keygen_result)
         new(
           scheme: scheme_name,
-          threshold: nil,        # not carried by the keygen Hash; caller knows
-          party_count: keygen_result["shares"].length,
-          public_key: keygen_result["public_key"],
-          shares: keygen_result["shares"],
+          threshold: nil, # not carried by the keygen Hash; caller knows
+          party_count: keygen_result['shares'].length,
+          public_key: keygen_result['public_key'],
+          shares: keygen_result['shares']
         )
       end
     end

data/lib/confium/tc.rb

@@ -11,7 +11,7 @@
 # for the full interface specification.
 module Confium
   module TC
-    autoload :Session, "confium/tc/session"
-    autoload :Coordinator, "confium/tc/coordinator"
+    autoload :Session, 'confium/tc/session'
+    autoload :Coordinator, 'confium/tc/coordinator'
   end
 end

data/lib/confium/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Confium
-  VERSION = "0.3.0"
+  VERSION = '0.3.2'
 end

data/lib/confium.rb

@@ -9,51 +9,63 @@
 # Pure-Ruby companions (the error hierarchy, Enumerable mixins, etc.)
 # are loaded lazily via autoload — see lib/confium/<name>.rb.
 
-require_relative "confium/version"
+require_relative 'confium/version'
 
 begin
-  require_relative "confium_native/confium_native"
+  # Pre-built platform gems ship one extension per C-ABI window
+  # (Ruby 3.2 broke the 3.1 ABI — object shapes — and rb-sys
+  # references the VM pointer libruby stopped exporting in 3.3, so
+  # 3.1 and 3.2 get exact-minor builds while 3.3 covers 3.3+).
+  # Source builds install the extension flat, without a version
+  # directory.
+  major, minor = RUBY_VERSION.split('.').first(2).map(&:to_i)
+  window = major > 3 || minor >= 3 ? '3.3' : "#{major}.#{minor}"
+  begin
+    require_relative "confium_native/#{window}/confium_native"
+  rescue LoadError
+    require_relative 'confium_native/confium_native'
+  end
 rescue LoadError => e
-  warn "confium: native extension not built — run `bundle exec rake compile`"
+  warn 'confium: native extension not built — run `bundle exec rake compile`'
   raise e
 end
 
 # Register autoloads on the native-defined PKI::CMS module so Ruby
 # companions like SignedDataBuilder load on first reference. Eager-
 # required because the module already exists at this point.
-require_relative "confium/pki/cms"
+require_relative 'confium/pki/cms'
 
 # The native extension defines Confium::OpenPGP with _native_armor /
 # _native_dearmor. This file adds the idiomatic Ruby wrappers with
 # default args. Eager-required for the same reason as PKI::CMS.
-require_relative "confium/openpgp"
+require_relative 'confium/openpgp'
 
 module Confium
   # Error hierarchy autoloads. Each subclass lives in its own file so
   # callers can `autoload :FooError, "confium/errors/foo"` and avoid
   # loading the whole hierarchy if they only rescue one type.
-  autoload :Error,                "confium/errors"
-  autoload :ParseError,           "confium/errors/parse_error"
-  autoload :ValidationError,      "confium/errors/validation_error"
-  autoload :VerificationError,    "confium/errors/verification_error"
-  autoload :ThresholdError,       "confium/errors/threshold_error"
-  autoload :CryptoError,          "confium/errors/crypto_error"
-  autoload :NotFoundError,        "confium/errors/not_found_error"
-  autoload :IndexError,           "confium/errors/index_error"
-  autoload :UnresolvedSignerError,"confium/errors/unresolved_signer_error"
-  autoload :PolicyViolationError, "confium/errors/policy_violation_error"
-  autoload :SecureBytes,          "confium/secure_bytes"
-  autoload :Policy,               "confium/policy"
-  autoload :PKI,                  "confium/pki"
+  autoload :Error,                'confium/errors'
+  autoload :ParseError,           'confium/errors/parse_error'
+  autoload :ValidationError,      'confium/errors/validation_error'
+  autoload :VerificationError,    'confium/errors/verification_error'
+  autoload :ThresholdError,       'confium/errors/threshold_error'
+  autoload :CryptoError,          'confium/errors/crypto_error'
+  autoload :NotFoundError,        'confium/errors/not_found_error'
+  autoload :IndexError,           'confium/errors/index_error'
+  autoload :UnresolvedSignerError, 'confium/errors/unresolved_signer_error'
+  autoload :PolicyViolationError, 'confium/errors/policy_violation_error'
+  autoload :SecureBytes,          'confium/secure_bytes'
+  autoload :Policy,               'confium/policy'
+  autoload :PKI,                  'confium/pki'
 end
 
 # Eager-load the Audit Ruby companion. The native extension registers
 # `Confium::Audit` as a Ruby module with the `record`/`sink=`/`sink`
 # methods; the companion file defines the Sink class hierarchy on top
 # of that module.
-require_relative "confium/audit"
+require_relative 'confium/audit'
 
 # Eager-load the TC ShareFile Ruby companion. The native extension
 # defines `Confium::TC` as a Ruby module; this file adds the
 # `ShareFile` class for filesystem-backed share persistence.
-require_relative "confium/tc/share_file"
+require_relative 'confium/tc/share_file'

metadata

@@ -1,13 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: confium
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.3.2
 platform: ruby
 authors:
 - Ribose Open
+autorequire:
 bindir: bin
 cert_chain: []
-date: 1980-01-02 00:00:00.000000000 Z
+date: 2026-08-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rb_sys
@@ -43,14 +44,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.2.0
+        version: 1.3.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.2.0
+        version: 1.3.0
 - !ruby/object:Gem::Dependency
   name: rake-compiler-dock
   requirement: !ruby/object:Gem::Requirement
@@ -182,6 +183,7 @@ metadata:
   homepage_uri: https://www.confium.org
   source_code_uri: https://github.com/confium/confium-ruby
   rubygems_mfa_required: 'true'
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -196,7 +198,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.16
+rubygems_version: 3.5.22
+signing_key:
 specification_version: 4
 summary: Ruby bindings for the Confium multi-stakeholder threshold cryptography framework.
 test_files: []