confium 0.3.2-aarch64-linux

data/lib/confium/tc/coordinator.rb

@@ -0,0 +1,68 @@
+# frozen_string_literal: true
+
+# Confium::TC::Coordinator wraps the async session coordinator service.
+#
+# The coordinator enables globally distributed threshold signers to
+# participate when convenient — no simultaneity required.
+#
+# Usage:
+#   coordinator = Confium::TC::Coordinator.new(quorum_id: "biml-root")
+#   session_id = coordinator.create_session(message: data,
+#                                           threshold: 5,
+#                                           unlock_window: 14400)
+#   coordinator.submit_commitment(session_id, signer_id, commitment_bytes)
+#   # ... wait for T commitments ...
+#   coordinator.submit_share(session_id, signer_id, share_bytes)
+#   # ... wait for T shares ...
+#   signature = coordinator.aggregate(session_id)
+module Confium
+  module TC
+    class Coordinator
+      attr_reader :quorum_id, :sessions
+
+      def initialize(quorum_id:)
+        @quorum_id = quorum_id
+        @sessions = {}
+      end
+
+      def create_session(message:, threshold:, unlock_window: 14_400)
+        session_id = "session-#{@sessions.length + 1}"
+        @sessions[session_id] = {
+          message: message,
+          threshold: threshold,
+          unlock_window: unlock_window,
+          state: :pending,
+          commitments: [],
+          shares: []
+        }
+        session_id
+      end
+
+      def session_state(session_id)
+        @sessions.dig(session_id, :state)
+      end
+
+      def submit_commitment(session_id, signer_id, commitment_bytes)
+        session = @sessions[session_id] or raise "Unknown session: #{session_id}"
+        session[:commitments] << { signer_id: signer_id, bytes: commitment_bytes }
+        return unless session[:commitments].length >= session[:threshold]
+
+        session[:state] = :commitments_collected
+      end
+
+      def submit_share(session_id, signer_id, share_bytes)
+        session = @sessions[session_id] or raise "Unknown session: #{session_id}"
+        session[:shares] << { signer_id: signer_id, bytes: share_bytes }
+      end
+
+      def aggregate(session_id)
+        session = @sessions[session_id] or raise "Unknown session: #{session_id}"
+        raise 'Threshold not met' if session[:shares].length < session[:threshold]
+
+        session[:state] = :completed
+        # In real implementation, calls FFI to aggregate shares
+        session[:shares].map { |s| s[:bytes] }.join
+      end
+    end
+  end
+end

data/lib/confium/tc/session.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+require 'confium/lib'
+
+# Confium::TC::Session wraps a threshold cryptography session.
+#
+# A session represents one signing or decryption operation involving
+# T-of-N parties. The session goes through states: pending →
+# commitments_collected → shares_collected → completed.
+#
+# Usage:
+#   session = Confium::TC::Session.new(scheme: "FROST-ed25519",
+#                                      threshold: 3,
+#                                      num_parties: 5,
+#                                      party_index: 0)
+#   session.set_local_share(share_bytes)
+#   session.round(incoming_messages) # returns outgoing messages
+#   result = session.result if session.complete?
+module Confium
+  module TC
+    class Session
+      attr_reader :scheme, :threshold, :num_parties, :party_index, :state
+
+      def initialize(scheme:, threshold:, num_parties:, party_index:)
+        @scheme = scheme
+        @threshold = threshold
+        @num_parties = num_parties
+        @party_index = party_index
+        @state = :pending
+        @local_share = nil
+        @result = nil
+      end
+
+      def set_local_share(share_bytes)
+        raise ArgumentError, 'share must be a String' unless share_bytes.is_a?(String)
+
+        @local_share = share_bytes
+      end
+
+      def complete?
+        @state == :completed
+      end
+
+      def result
+        raise 'Session not complete' unless complete?
+
+        @result
+      end
+    end
+  end
+end

data/lib/confium/tc/session_stub.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+# Confium::TC::SessionStub — placeholder for the multi-party TC session
+# interface. The full Session implementation wraps
+# confium_tc::session::Session which drives 3-round FROST/CMP20/GG18
+# signing ceremonies.
+#
+# This stub provides the interface shape so consumers can write code
+# against it. The actual session orchestration will be wired through
+# magnus in a future PR (TODO.completion/009-multi-party-tc-sessions.md).
+
+module Confium
+  module TC
+    class SessionStub
+      attr_reader :scheme, :threshold, :party_count, :this_party_idx, :round
+
+      def initialize(scheme:, threshold:, party_count:, this_party_idx:)
+        @scheme = scheme
+        @threshold = threshold
+        @party_count = party_count
+        @this_party_idx = this_party_idx
+        @round = 0
+        @complete = false
+      end
+
+      def complete?
+        @complete
+      end
+
+      # Stub: returns an empty RoundResult. Real implementation will
+      # call confium_tc::session::Session::round_step.
+      def round_step(_incoming_messages)
+        @round += 1
+        @complete = @round >= 3 # FROST is 3 rounds
+        { outgoing: [], complete: @complete }
+      end
+
+      def result
+        nil # Real implementation returns the signature/secret bytes.
+      end
+    end
+  end
+end

data/lib/confium/tc/share_file.rb

@@ -0,0 +1,87 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'fileutils'
+
+module Confium
+  module TC
+    # Filesystem-backed share persistence.
+    #
+    # Share blobs produced by `Confium::TC::Cmp20.keygen` /
+    # `Confium::TC::Gg18.keygen` are 71-byte binary strings. This
+    # class wraps them in a JSON envelope so they can be saved to
+    # disk, transferred between hosts, and loaded back without
+    # encoding ambiguity.
+    #
+    # The envelope format:
+    #
+    #     {
+    #       "scheme":      "CMP20-ECDSA-P256",
+    #       "threshold":   3,
+    #       "party_count": 5,
+    #       "public_key":  "<33-byte hex>",
+    #       "shares":      ["<71-byte hex>", ...]
+    #     }
+    #
+    # The format is identical to what the Python binding's
+    # `confium.tc.ShareFile` produces, so shares saved from one
+    # binding can be loaded by the other.
+    class ShareFile
+      attr_reader :scheme, :threshold, :party_count, :public_key, :shares
+
+      def initialize(scheme:, threshold:, party_count:, public_key:, shares:)
+        @scheme = scheme
+        @threshold = threshold
+        @party_count = party_count
+        @public_key = public_key
+        @shares = shares
+      end
+
+      # Load a ShareFile from a JSON file at `path`.
+      def self.load(path)
+        from_json(File.read(path))
+      end
+
+      # Parse a ShareFile from a JSON string.
+      def self.from_json(json)
+        d = JSON.parse(json)
+        new(
+          scheme: d.fetch('scheme'),
+          threshold: d.fetch('threshold'),
+          party_count: d.fetch('party_count'),
+          public_key: [d.fetch('public_key')].pack('H*'),
+          shares: d.fetch('shares').map { |h| [h].pack('H*') }
+        )
+      end
+
+      # Save to `path` as JSON. Creates parent directories if missing.
+      def save(path)
+        FileUtils.mkdir_p(File.dirname(path))
+        File.write(path, to_json)
+        self
+      end
+
+      # Serialize to a JSON string.
+      def to_json(*_args)
+        JSON.generate(
+          scheme: scheme,
+          threshold: threshold,
+          party_count: party_count,
+          public_key: public_key.unpack1('H*'),
+          shares: shares.map { |s| s.unpack1('H*') }
+        )
+      end
+
+      # Build a ShareFile from a CMP20 / GG18 keygen result Hash.
+      def self.from_keygen(scheme_name, keygen_result)
+        new(
+          scheme: scheme_name,
+          threshold: nil, # not carried by the keygen Hash; caller knows
+          party_count: keygen_result['shares'].length,
+          public_key: keygen_result['public_key'],
+          shares: keygen_result['shares']
+        )
+      end
+    end
+  end
+end

data/lib/confium/tc.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+# Confium::TC provides Ruby access to the threshold cryptography
+# interface exposed by the Confium Rust workspace.
+#
+# This module is loaded lazily via autoload from lib/confium.rb.
+# It wraps the C FFI surface for threshold sessions, coordinator,
+# re-sharing, and KEM operations.
+#
+# See: TODO.roadmap/04-threshold-cryptography.md in the main confium repo
+# for the full interface specification.
+module Confium
+  module TC
+    autoload :Session, 'confium/tc/session'
+    autoload :Coordinator, 'confium/tc/coordinator'
+  end
+end

data/lib/confium/transparency/ots.rb

@@ -0,0 +1,63 @@
+# frozen_string_literal: true
+
+# Confium::Transparency::OTS — OpenTimestamps client interface.
+#
+# Wraps confium-transparency::ots::Client for anchoring Merkle tree
+# roots in the Bitcoin blockchain via OTS calendar servers.
+#
+# This is a pure-Ruby stub that defines the interface. The actual
+# OTS stamping requires network access to calendar servers and
+# will be wired through the Rust extension in a future PR
+# (TODO.completion/011-ots-ers-exposure.md).
+
+module Confium
+  module Transparency
+    module OTS
+      # Default OTS calendar servers (from opentimestamps.org).
+      DEFAULT_CALENDARS = %w[
+        https://a.pool.opentimestamps.org
+        https://b.pool.opentimestamps.org
+        https://a.pool.eternitywall.com
+      ].freeze
+
+      # An OTS receipt proving that a hash was anchored in Bitcoin
+      # at a specific block height.
+      class Receipt
+        attr_reader :bytes, :block_height
+
+        def initialize(bytes:, block_height: nil)
+          @bytes = bytes
+          @block_height = block_height
+        end
+
+        def to_bytes
+          @bytes
+        end
+      end
+
+      # Stamp a 32-byte hash via OTS calendar servers.
+      # Returns a Receipt (stub: returns nil — requires network).
+      #
+      # @param hash [String] 32-byte SHA-256 hash to anchor
+      # @return [Receipt, nil]
+      def self.stamp(_hash)
+        # Real implementation: calls the Rust OTS client which
+        # submits the hash to calendar servers and returns a
+        # merged proof. Requires network access.
+        nil
+      end
+
+      # Verify an OTS receipt against a hash.
+      # Returns true if the receipt proves the hash was anchored.
+      #
+      # @param receipt [Receipt, String] the OTS proof
+      # @param hash [String] the 32-byte hash
+      # @return [Boolean]
+      def self.verify(_receipt, _hash)
+        # Real implementation: calls the Rust OTS verifier which
+        # walks the Bitcoin blockchain proof.
+        false
+      end
+    end
+  end
+end

data/lib/confium/version.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module Confium
+  VERSION = '0.3.2'
+end

data/lib/confium.rb

@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+# Confium is the Ruby entry point for the Confium cryptographic framework.
+#
+# The native Rust extension is loaded first; everything else (Cert, CMS,
+# Composite, Transparency, TC::*, etc.) is registered by the extension
+# via magnus when this file is required.
+#
+# Pure-Ruby companions (the error hierarchy, Enumerable mixins, etc.)
+# are loaded lazily via autoload — see lib/confium/<name>.rb.
+
+require_relative 'confium/version'
+
+begin
+  # Pre-built platform gems ship one extension per C-ABI window
+  # (Ruby 3.2 broke the 3.1 ABI — object shapes — and rb-sys
+  # references the VM pointer libruby stopped exporting in 3.3, so
+  # 3.1 and 3.2 get exact-minor builds while 3.3 covers 3.3+).
+  # Source builds install the extension flat, without a version
+  # directory.
+  major, minor = RUBY_VERSION.split('.').first(2).map(&:to_i)
+  window = major > 3 || minor >= 3 ? '3.3' : "#{major}.#{minor}"
+  begin
+    require_relative "confium_native/#{window}/confium_native"
+  rescue LoadError
+    require_relative 'confium_native/confium_native'
+  end
+rescue LoadError => e
+  warn 'confium: native extension not built — run `bundle exec rake compile`'
+  raise e
+end
+
+# Register autoloads on the native-defined PKI::CMS module so Ruby
+# companions like SignedDataBuilder load on first reference. Eager-
+# required because the module already exists at this point.
+require_relative 'confium/pki/cms'
+
+# The native extension defines Confium::OpenPGP with _native_armor /
+# _native_dearmor. This file adds the idiomatic Ruby wrappers with
+# default args. Eager-required for the same reason as PKI::CMS.
+require_relative 'confium/openpgp'
+
+module Confium
+  # Error hierarchy autoloads. Each subclass lives in its own file so
+  # callers can `autoload :FooError, "confium/errors/foo"` and avoid
+  # loading the whole hierarchy if they only rescue one type.
+  autoload :Error,                'confium/errors'
+  autoload :ParseError,           'confium/errors/parse_error'
+  autoload :ValidationError,      'confium/errors/validation_error'
+  autoload :VerificationError,    'confium/errors/verification_error'
+  autoload :ThresholdError,       'confium/errors/threshold_error'
+  autoload :CryptoError,          'confium/errors/crypto_error'
+  autoload :NotFoundError,        'confium/errors/not_found_error'
+  autoload :IndexError,           'confium/errors/index_error'
+  autoload :UnresolvedSignerError, 'confium/errors/unresolved_signer_error'
+  autoload :PolicyViolationError, 'confium/errors/policy_violation_error'
+  autoload :SecureBytes,          'confium/secure_bytes'
+  autoload :Policy,               'confium/policy'
+  autoload :PKI,                  'confium/pki'
+end
+
+# Eager-load the Audit Ruby companion. The native extension registers
+# `Confium::Audit` as a Ruby module with the `record`/`sink=`/`sink`
+# methods; the companion file defines the Sink class hierarchy on top
+# of that module.
+require_relative 'confium/audit'
+
+# Eager-load the TC ShareFile Ruby companion. The native extension
+# defines `Confium::TC` as a Ruby module; this file adds the
+# `ShareFile` class for filesystem-backed share persistence.
+require_relative 'confium/tc/share_file'

metadata

@@ -0,0 +1,178 @@
+--- !ruby/object:Gem::Specification
+name: confium
+version: !ruby/object:Gem::Version
+  version: 0.3.2
+platform: aarch64-linux
+authors:
+- Ribose Open
+autorequire:
+bindir: bin
+cert_chain: []
+date: 2026-08-22 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '13.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '13.0'
+- !ruby/object:Gem::Dependency
+  name: rake-compiler
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.3.0
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.3.0
+- !ruby/object:Gem::Dependency
+  name: rake-compiler-dock
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.3'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.3'
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+- !ruby/object:Gem::Dependency
+  name: rubocop
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+- !ruby/object:Gem::Dependency
+  name: steep
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.5'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.5'
+description: 'Confium provides threshold cryptography for Ruby: FROST / CMP20 / GG18
+  signing sessions, X.509 certificate issuance (CNML-ready), composite PQ-migration
+  signatures, and transparency-log anchoring. Powered by a Rust native extension (magnus
+  + rb_sys) — no separate C ABI to install.'
+email:
+- open.source@ribose.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- Cargo.lock
+- Cargo.toml
+- LICENSE.txt
+- README.adoc
+- Rakefile
+- confium.gemspec
+- lib/confium.rb
+- lib/confium/audit.rb
+- lib/confium/cfm.rb
+- lib/confium/crypto.rb
+- lib/confium/digest.rb
+- lib/confium/errors.rb
+- lib/confium/errors/coerce.rb
+- lib/confium/errors/crypto_error.rb
+- lib/confium/errors/index_error.rb
+- lib/confium/errors/not_found_error.rb
+- lib/confium/errors/parse_error.rb
+- lib/confium/errors/policy_violation_error.rb
+- lib/confium/errors/threshold_error.rb
+- lib/confium/errors/unresolved_signer_error.rb
+- lib/confium/errors/validation_error.rb
+- lib/confium/errors/verification_error.rb
+- lib/confium/ffi.rb
+- lib/confium/lib.rb
+- lib/confium/openpgp.rb
+- lib/confium/pki.rb
+- lib/confium/pki/certificate_builder.rb
+- lib/confium/pki/cms.rb
+- lib/confium/pki/cms/signed_data_builder.rb
+- lib/confium/pki/cnml.rb
+- lib/confium/policy.rb
+- lib/confium/secure_bytes.rb
+- lib/confium/tc.rb
+- lib/confium/tc/coordinator.rb
+- lib/confium/tc/session.rb
+- lib/confium/tc/session_stub.rb
+- lib/confium/tc/share_file.rb
+- lib/confium/transparency/ots.rb
+- lib/confium/version.rb
+- lib/confium_native/3.1/confium_native.so
+- lib/confium_native/3.2/confium_native.so
+- lib/confium_native/3.3/confium_native.so
+homepage: https://www.confium.org
+licenses:
+- BSD-2-Clause
+metadata:
+  bug_tracker_uri: https://github.com/confium/confium-ruby/issues
+  changelog_uri: https://github.com/confium/confium-ruby/blob/main/CHANGELOG.md
+  homepage_uri: https://www.confium.org
+  source_code_uri: https://github.com/confium/confium-ruby
+  rubygems_mfa_required: 'true'
+post_install_message:
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 3.1.0
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.5.22
+signing_key:
+specification_version: 4
+summary: Ruby bindings for the Confium multi-stakeholder threshold cryptography framework.
+test_files: []