confium 0.3.2-aarch64-linux → 0.3.3-aarch64-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5b2525a7c6a928c0fbcd0c2f7980b8d01cbe74020e0a9c76d319d322d2b34e5b
-  data.tar.gz: 0d5520062602c2c1dfaf9334dab5c20e4f87e589ba2ad23500f832f00bff72dd
+  metadata.gz: d16a3c494799da7098bf35d9b41575c45d613b363e2bc719cde272bbc35a31bc
+  data.tar.gz: 73c02647bdb969b56b7a82292296ae07fb885f5bd25e16b9969953a78261990a
 SHA512:
-  metadata.gz: 03a903e22d5404a8d540dbbecff4b01b3395e585c5bf60d001e82d75415961905b84f23e9a86aed5b307325ccefa763284a70a7e3f12ae79b628e6fbc23ad1ba
-  data.tar.gz: 6e81063b745a057328fe676056d67b36660ccc91ade8b04d608d23a239afa3a35db0088e6578fb0962b047d764d5e8d18c8d335b1d97774b38e78f827533ff11
+  metadata.gz: a86e1a7b59c81424b2bc6d966344c8338475f866eeaf80b5f038e8c1055b1ffa63440eaf5034e04ff268d380317c5cca3389520920db85c66e66467d88e98472
+  data.tar.gz: a5a3e2183fdd84e6c3c64746bc163731477409873ebf638e21005f7f6e13aa7a09f7bb24c03424681789e82dd32a2b03c31c2e2613c0ffe8da72182c557bbc88

data/CHANGELOG.md

@@ -1,5 +1,43 @@
 # Changelog
 
+## [0.3.3] — 2026-08-23
+
+### Added
+
+- **Typed native errors everywhere**: PEM/DER, JSON, TOML, DSL, and
+  XML parse failures raise `Confium::ParseError`; out-of-range
+  sequence indexes raise `Confium::IndexError`; consistency-proof
+  failures raise `Confium::VerificationError` — each with a
+  structured `details` Hash (format, operation, index, ...).
+  Previously these surfaced as bare `RuntimeError`.
+
+### Added
+
+- `Confium::Composite::Signature.components_to_json` /
+  `.from_json` — JSON transport for composite signatures with the
+  binary fields hex-encoded on the wire (fixes the Sinatra example's
+  happy path, which called a `from_json` that did not exist).
+- Steep type checking in CI: the Steepfile never loaded before
+  (it used a `configure_code_diagnostics` API that does not exist in
+  steep 1.10). `sig/confium.rbs` now covers every pure-Ruby
+  subsystem — including the TC session machinery — and
+  `bundle exec steep check` is green and enforced. Only the FFI
+  layer is excluded (the ffi gem has no RBS signatures).
+
+### Fixed
+
+- `Confium::PKI::CMS::SignedDataBuilder#build` raised KeyError on
+  the ECDSA-P256 path (`FrostP256.sign` returns `der`/`fixed`, not
+  `signature`); it now uses the DER form, which is what CMS carries.
+- `Confium::PKI::CertificateBuilder`, `Confium::PKI::CNML`, and
+  `Confium::Transparency::OTS` were unreachable after
+  `require "confium"` (missing autoload wiring); the PKI namespace
+  file is now eager-required and registers them.
+- All five `hello_*` quickstart examples, the Sinatra example's
+  happy path, and every page under `docs/` were rewritten against
+  the real APIs (see the docs audit), and CI now runs every example
+  on every push.
+
 ## [0.3.2] — 2026-08-22
 
 Native platform gems (linux x86_64/aarch64, macOS x86_64/arm64) ship

data/README.adoc

@@ -10,7 +10,7 @@ Confium supports three deployment modes:
 * **Mode 2 — TC PKI replacement**: drop-in for existing PKI consumers (PKCS#11 server, OpenSSL 3.0 provider, JCE)
 * **Mode 3 — TC Certificate PKI**: institutional deployments with custom certificate formats (OIML CNML, BIPM, pharma, accreditation)
 
-This gem wraps the high-value Confium subsystems via a Rust native extension (built at `gem install` time with `rb_sys` + `magnus`). No separate C ABI library to install; everything is statically linked into the extension.
+This gem wraps the high-value Confium subsystems via a Rust native extension. Pre-compiled platform gems are published for Linux and macOS, so `gem install` needs no Rust toolchain there; other platforms build from source at install time with `rb_sys` + `magnus`. No separate C ABI library to install; everything is statically linked into the extension.
 
 == Installation
 
@@ -18,7 +18,7 @@ Add to your Gemfile:
 
 [source,ruby]
 ----
-gem "confium", "~> 0.1"
+gem "confium", "~> 0.3"
 ----
 
 Or install directly:
@@ -31,10 +31,18 @@ $ gem install confium
 === Prerequisites
 
 * Ruby ≥ 3.1
+* Nothing else on the pre-compiled platforms: `x86_64-linux`,
+  `aarch64-linux`, `x86_64-darwin`, `arm64-darwin` (each gem carries
+  one extension per Ruby C-ABI window)
+
+Source builds (other platforms, or installing from the repo) also
+need:
+
 * Rust stable toolchain (`rustup default stable`)
 * C toolchain (clang/gcc/Xcode CLT)
 
-The gem compiles a Rust cdylib at install time and links it into Ruby as a native extension. There is no separate `libconfium` to install.
+There is no separate `libconfium` to install — the extension
+statically links everything.
 
 == Quick start
 
@@ -76,7 +84,7 @@ recovered = Confium::TC::FrostP256.recover_secret(shares.first(3).map { |s| { "x
 recovered == kp["private_key"]  # => true
 ----
 
-== API surface (v0.1.0)
+== API surface (v0.3)
 
 === `Confium::Transparency`
 - `MerkleTree.new` / `#append(artifact_hash)` / `#root` / `#length` / `#empty?` / `#inclusion_proof(seq)`
@@ -127,7 +135,7 @@ After checking out the repo:
 ----
 $ bundle install
 $ bundle exec rake compile       # build the Rust extension
-$ bundle exec rspec              # 75+ specs
+$ bundle exec rspec              # 226 specs
 ----
 
 == Architecture

data/confium.gemspec

@@ -49,7 +49,6 @@ Gem::Specification.new do |spec|
 
   spec.add_development_dependency 'rake', '~> 13.0'
   spec.add_development_dependency 'rake-compiler', '~> 1.3.0'
-  spec.add_development_dependency 'rake-compiler-dock', '~> 1.3'
   spec.add_development_dependency 'rspec', '~> 3.0'
   spec.add_development_dependency 'rubocop', '~> 1.0'
   spec.add_development_dependency 'steep', '~> 1.5'

data/lib/confium/audit.rb

@@ -68,6 +68,7 @@ module Confium
       attr_reader :records
 
       def initialize
+        # @type ivar @records: Array[untyped]
         @records = []
       end
 

data/lib/confium/composite.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+require 'json'
+
+module Confium
+  module Composite
+    # JSON transport for composite signatures. The native extension
+    # defines Signature with algorithms/component_count/verify over
+    # component Hashes (algorithm, public_key, signature) whose
+    # binary fields cannot ride JSON directly, so the wire format
+    # hex-encodes them:
+    #
+    #   json = Confium::Composite::Signature.components_to_json(components)
+    #   sig  = Confium::Composite::Signature.from_json(json)
+    #   sig.verify(message)
+    class Signature
+      BINARY_FIELDS = %w[public_key signature].freeze
+
+      def self.components_to_json(components)
+        JSON.generate(components.map do |component|
+          component.transform_values do |value|
+            value.encoding == Encoding::ASCII_8BIT ? value.unpack1('H*') : value
+          end
+        end)
+      end
+
+      # Accepts either a bare JSON array of component Hashes or a
+      # {"components": [...]} envelope, with public_key/signature
+      # hex-encoded on the wire. Takes a JSON string or an
+      # already-parsed Array/Hash.
+      def self.from_json(json)
+        data = json.is_a?(String) ? JSON.parse(json) : json
+        components = data.is_a?(Hash) ? data['components'] : data
+        unless components.is_a?(Array) && !components.empty?
+          raise ArgumentError, 'expected a non-empty "components" array'
+        end
+
+        new(components.map { |c| decode_binary_fields(c) })
+      end
+
+      def self.decode_binary_fields(component)
+        BINARY_FIELDS.each_with_object(component.dup) do |field, decoded|
+          value = component.fetch(field)
+          decoded[field] = [value].pack('H*') if value.is_a?(String)
+        end
+      end
+      private_class_method :decode_binary_fields
+    end
+  end
+end

data/lib/confium/crypto.rb

@@ -21,6 +21,7 @@
 #   Confium::Crypto.lookup(:hash)  # => Confium::Digest
 module Confium
   module Crypto
+    # @type ivar @interfaces: Hash[Symbol, untyped]
     @interfaces = {}
 
     class << self

data/lib/confium/pki/cms/signed_data_builder.rb

@@ -33,6 +33,7 @@ module Confium
 
         def initialize
           @content = nil
+          # @type ivar @signers: Array[Hash[Symbol, untyped]]
           @signers = []
         end
 
@@ -81,7 +82,9 @@ module Confium
             result.fetch('signature')
           when :ecdsa_p256
             result = Confium::TC::FrostP256.sign(private_key, payload)
-            result.fetch('signature')
+            # CMS carries ECDSA signatures DER-encoded (DSA-Sig-Value);
+            # FrostP256.sign returns { "der" => ..., "fixed" => ... }.
+            result.fetch('der')
           else
             raise ArgumentError, "unsupported algorithm: #{algorithm.inspect}"
           end

data/lib/confium/pki.rb

@@ -9,5 +9,7 @@
 module Confium
   module PKI
     autoload :CMS, 'confium/pki/cms'
+    autoload :CertificateBuilder, 'confium/pki/certificate_builder'
+    autoload :CNML, 'confium/pki/cnml'
   end
 end

data/lib/confium/transparency.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+# Confium::Transparency namespace file.
+#
+# The Transparency module itself is defined by the native Rust
+# extension via magnus at require time. This file registers
+# pure-Ruby autoloads for the Transparency submodules.
+module Confium
+  module Transparency
+    autoload :OTS, 'confium/transparency/ots'
+  end
+end

data/lib/confium/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Confium
-  VERSION = '0.3.2'
+  VERSION = '0.3.3'
 end

data/lib/confium.rb

@@ -18,8 +18,7 @@ begin
   # 3.1 and 3.2 get exact-minor builds while 3.3 covers 3.3+).
   # Source builds install the extension flat, without a version
   # directory.
-  major, minor = RUBY_VERSION.split('.').first(2).map(&:to_i)
-  window = major > 3 || minor >= 3 ? '3.3' : "#{major}.#{minor}"
+  window = Gem::Version.new(RUBY_VERSION) >= Gem::Version.new('3.3') ? '3.3' : RUBY_VERSION[/\A\d+\.\d+/]
   begin
     require_relative "confium_native/#{window}/confium_native"
   rescue LoadError
@@ -56,9 +55,21 @@ module Confium
   autoload :PolicyViolationError, 'confium/errors/policy_violation_error'
   autoload :SecureBytes,          'confium/secure_bytes'
   autoload :Policy,               'confium/policy'
-  autoload :PKI,                  'confium/pki'
+  # PKI is native-defined, so an autoload would never fire; the
+  # namespace file is eager-required and registers the pure-Ruby
+  # submodules (CMS, CertificateBuilder, CNML) as autoloads.
+  require_relative 'confium/pki'
 end
 
+# Eager-load the Composite Signature JSON companion. The native
+# extension defines Confium::Composite; this file reopens the class
+# to add from_json transport.
+require_relative 'confium/composite'
+
+# Eager-load the Transparency namespace for the OTS autoload (the
+# module itself is native-defined).
+require_relative 'confium/transparency'
+
 # Eager-load the Audit Ruby companion. The native extension registers
 # `Confium::Audit` as a Ruby module with the `record`/`sink=`/`sink`
 # methods; the companion file defines the Sink class hierarchy on top

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: confium
 version: !ruby/object:Gem::Version
-  version: 0.3.2
+  version: 0.3.3
 platform: aarch64-linux
 authors:
 - Ribose Open
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-08-22 00:00:00.000000000 Z
+date: 2026-08-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -38,20 +38,6 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: 1.3.0
-- !ruby/object:Gem::Dependency
-  name: rake-compiler-dock
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.3'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.3'
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
@@ -114,6 +100,7 @@ files:
 - lib/confium.rb
 - lib/confium/audit.rb
 - lib/confium/cfm.rb
+- lib/confium/composite.rb
 - lib/confium/crypto.rb
 - lib/confium/digest.rb
 - lib/confium/errors.rb
@@ -142,6 +129,7 @@ files:
 - lib/confium/tc/session.rb
 - lib/confium/tc/session_stub.rb
 - lib/confium/tc/share_file.rb
+- lib/confium/transparency.rb
 - lib/confium/transparency/ots.rb
 - lib/confium/version.rb
 - lib/confium_native/3.1/confium_native.so