confium 0.3.2 → 0.3.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c8445c7b4b7f4fdea4740a5f22874c5a97eda59e75ebe5cf327dbc84b67ff6f2
-  data.tar.gz: 68381a40a3a7f21b5f4330611bbe86e7abbf9223602288f105f611553e86cd21
+  metadata.gz: fdc8059371955b1e4ee89982856fb39a1fb758c9d1b3264bb2f3bd21fe77c028
+  data.tar.gz: a392f2b3d8b87e4d296f5f68dec94e61ae3e2263eea032f12240b2f625b7ba56
 SHA512:
-  metadata.gz: 00cf2dd64ba0bce3897db2d5f026818ccc5f90cc1ad1f27a65869827f530811df1a60c50e6fefeb9c83183859bccce81194b0e031e2fbff5b8213d53bb3cb4cb
-  data.tar.gz: a2f6509125418022a2aa3d98d86b724cc841f7f3067884c482d345f2f3b28a0adb63b51dbba34d48dd5d64aa1c827a42d8bf86be273160feb631d5e8a68b72b9
+  metadata.gz: ccdae726768ecf965b3f21f000b42bbc7c67a01b31d7715a2f23f0e243873453da7539ae57fbfb0ffda185d3ea572b74d0f3c033518e1e154fdc0b739db0b1b1
+  data.tar.gz: db63f19d08cf86076df52ec0f583493019e03a1512268aa1d83b56edce182d42c18120369e46ca054e66dfdf79619b04fdfe91175607845260cc668894fa680d

data/CHANGELOG.md

@@ -1,5 +1,66 @@
 # Changelog
 
+## [0.3.4] — 2026-08-23
+
+### Fixed
+
+- **Typed-error sweep completed.** Crypto operation failures
+  (FrostP256 sign, ElGamal encapsulate/decrypt/aggregate, composite
+  sign) raise `Confium::CryptoError` with the primitive in `details`;
+  `PathValidator` DER extraction failures raise `Confium::ParseError`;
+  `Manifest#tier_name_at` and `SignedData#certificate_at` out-of-range
+  raise the typed `Confium::IndexError` (unifying with the
+  transparency proofs — they previously raised Ruby's core
+  `IndexError`).
+- **Zero compiler warnings.** All 80 direct
+  `magnus::exception::*` constructor sites are centralized into
+  `util::runtime`/`util::arg_error` (the deprecated API survives in
+  exactly one module whose job is wrapping it); the remaining magnus
+  deprecations (`RString::buf_new`, `RArray::each`) and dead imports
+  are fixed.
+- **DoS guard now covers every byte input**: the duplicate local
+  `bytes_from_value` copies in tc/transparency — one of which
+  skipped the 1 MiB size cap — are consolidated onto the util
+  version that enforces it.
+
+## [0.3.3] — 2026-08-23
+
+### Added
+
+- **Typed native errors everywhere**: PEM/DER, JSON, TOML, DSL, and
+  XML parse failures raise `Confium::ParseError`; out-of-range
+  sequence indexes raise `Confium::IndexError`; consistency-proof
+  failures raise `Confium::VerificationError` — each with a
+  structured `details` Hash (format, operation, index, ...).
+  Previously these surfaced as bare `RuntimeError`.
+
+### Added
+
+- `Confium::Composite::Signature.components_to_json` /
+  `.from_json` — JSON transport for composite signatures with the
+  binary fields hex-encoded on the wire (fixes the Sinatra example's
+  happy path, which called a `from_json` that did not exist).
+- Steep type checking in CI: the Steepfile never loaded before
+  (it used a `configure_code_diagnostics` API that does not exist in
+  steep 1.10). `sig/confium.rbs` now covers every pure-Ruby
+  subsystem — including the TC session machinery — and
+  `bundle exec steep check` is green and enforced. Only the FFI
+  layer is excluded (the ffi gem has no RBS signatures).
+
+### Fixed
+
+- `Confium::PKI::CMS::SignedDataBuilder#build` raised KeyError on
+  the ECDSA-P256 path (`FrostP256.sign` returns `der`/`fixed`, not
+  `signature`); it now uses the DER form, which is what CMS carries.
+- `Confium::PKI::CertificateBuilder`, `Confium::PKI::CNML`, and
+  `Confium::Transparency::OTS` were unreachable after
+  `require "confium"` (missing autoload wiring); the PKI namespace
+  file is now eager-required and registers them.
+- All five `hello_*` quickstart examples, the Sinatra example's
+  happy path, and every page under `docs/` were rewritten against
+  the real APIs (see the docs audit), and CI now runs every example
+  on every push.
+
 ## [0.3.2] — 2026-08-22
 
 Native platform gems (linux x86_64/aarch64, macOS x86_64/arm64) ship

data/README.adoc

@@ -10,7 +10,7 @@ Confium supports three deployment modes:
 * **Mode 2 — TC PKI replacement**: drop-in for existing PKI consumers (PKCS#11 server, OpenSSL 3.0 provider, JCE)
 * **Mode 3 — TC Certificate PKI**: institutional deployments with custom certificate formats (OIML CNML, BIPM, pharma, accreditation)
 
-This gem wraps the high-value Confium subsystems via a Rust native extension (built at `gem install` time with `rb_sys` + `magnus`). No separate C ABI library to install; everything is statically linked into the extension.
+This gem wraps the high-value Confium subsystems via a Rust native extension. Pre-compiled platform gems are published for Linux and macOS, so `gem install` needs no Rust toolchain there; other platforms build from source at install time with `rb_sys` + `magnus`. No separate C ABI library to install; everything is statically linked into the extension.
 
 == Installation
 
@@ -18,7 +18,7 @@ Add to your Gemfile:
 
 [source,ruby]
 ----
-gem "confium", "~> 0.1"
+gem "confium", "~> 0.3"
 ----
 
 Or install directly:
@@ -31,10 +31,18 @@ $ gem install confium
 === Prerequisites
 
 * Ruby ≥ 3.1
+* Nothing else on the pre-compiled platforms: `x86_64-linux`,
+  `aarch64-linux`, `x86_64-darwin`, `arm64-darwin` (each gem carries
+  one extension per Ruby C-ABI window)
+
+Source builds (other platforms, or installing from the repo) also
+need:
+
 * Rust stable toolchain (`rustup default stable`)
 * C toolchain (clang/gcc/Xcode CLT)
 
-The gem compiles a Rust cdylib at install time and links it into Ruby as a native extension. There is no separate `libconfium` to install.
+There is no separate `libconfium` to install — the extension
+statically links everything.
 
 == Quick start
 
@@ -76,7 +84,7 @@ recovered = Confium::TC::FrostP256.recover_secret(shares.first(3).map { |s| { "x
 recovered == kp["private_key"]  # => true
 ----
 
-== API surface (v0.1.0)
+== API surface (v0.3)
 
 === `Confium::Transparency`
 - `MerkleTree.new` / `#append(artifact_hash)` / `#root` / `#length` / `#empty?` / `#inclusion_proof(seq)`
@@ -127,7 +135,7 @@ After checking out the repo:
 ----
 $ bundle install
 $ bundle exec rake compile       # build the Rust extension
-$ bundle exec rspec              # 75+ specs
+$ bundle exec rspec              # 226 specs
 ----
 
 == Architecture

data/confium.gemspec

@@ -49,7 +49,6 @@ Gem::Specification.new do |spec|
 
   spec.add_development_dependency 'rake', '~> 13.0'
   spec.add_development_dependency 'rake-compiler', '~> 1.3.0'
-  spec.add_development_dependency 'rake-compiler-dock', '~> 1.3'
   spec.add_development_dependency 'rspec', '~> 3.0'
   spec.add_development_dependency 'rubocop', '~> 1.0'
   spec.add_development_dependency 'steep', '~> 1.5'

data/ext/confium_native/src/attributes.rs

@@ -12,7 +12,7 @@
 
 use confium_attributes::{evaluate, parse as dsl_parse, Predicate, SignerAttributes};
 use magnus::{
-    exception, function, method, typed_data::Obj, DataTypeFunctions, Error, Module,
+    function, method, typed_data::Obj, DataTypeFunctions, Error, Module,
     Object, Ruby, TryConvert, TypedData, Value,
 };
 
@@ -26,8 +26,8 @@ impl PredicateWrap {
     fn satisfied_by(&self, signers_value: Value) -> Result<bool, Error> {
         let arr = magnus::RArray::try_convert(signers_value)?;
         let mut owned: Vec<SignerAttributes> = Vec::with_capacity(arr.len());
-        for v in arr.each() {
-            let signer_wrap = Obj::<SignerWrap>::try_convert(v?)?;
+        for v in arr.into_iter() {
+            let signer_wrap = Obj::<SignerWrap>::try_convert(v)?;
             owned.push(signer_wrap.inner.borrow().clone());
         }
         let refs: Vec<&SignerAttributes> = owned.iter().collect();
@@ -63,8 +63,8 @@ impl SignerWrap {
 
 fn parse(expr: String) -> Result<Obj<PredicateWrap>, Error> {
     let predicate = dsl_parse(&expr)
-        .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
-    let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        .map_err(|e| crate::util::parse_error(e.to_string(), "Attributes.parse", Some("dsl"), None))?;
+    let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
     Ok(ruby.obj_wrap(PredicateWrap { inner: predicate }))
 }
 

data/ext/confium_native/src/audit.rs

@@ -11,7 +11,7 @@
 //! sink raises, the calling operation still succeeds. Audit
 //! failures must never break a signing ceremony.
 
-use magnus::{exception, function, prelude::*, Error, Module, Ruby, Value};
+use magnus::{function, prelude::*, Error, Module, Ruby, Value};
 use sha2::{Digest, Sha256};
 
 const SINK_IVAR: &str = "@sink";
@@ -94,12 +94,12 @@ fn record(
     algorithm: Option<String>,
     error: Option<String>,
 ) -> Result<(), Error> {
-    let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+    let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
     let audit_mod: magnus::RModule = ruby
         .class_object()
         .const_get("Confium")
         .and_then(|m: magnus::RModule| m.const_get("Audit"))
-        .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        .map_err(|e| crate::util::runtime(e.to_string()))?;
 
     let sink: Value = audit_mod.ivar_get(SINK_IVAR)?;
     if sink.is_nil() {
@@ -123,31 +123,31 @@ fn record(
 
     let _: Value = sink
         .funcall("call", (h,))
-        .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        .map_err(|e| crate::util::runtime(e.to_string()))?;
     Ok(())
 }
 
 /// Set the global audit sink. `callback` is a Proc that receives a Hash
 /// or nil to disable auditing.
 fn set_sink(callback: Value) -> Result<(), Error> {
-    let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+    let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
     let audit_mod: magnus::RModule = ruby
         .class_object()
         .const_get("Confium")
         .and_then(|m: magnus::RModule| m.const_get("Audit"))
-        .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        .map_err(|e| crate::util::runtime(e.to_string()))?;
     audit_mod.ivar_set(SINK_IVAR, callback)?;
     Ok(())
 }
 
 /// Get the current audit sink (or nil if not set).
 fn get_sink() -> Result<Value, Error> {
-    let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+    let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
     let audit_mod: magnus::RModule = ruby
         .class_object()
         .const_get("Confium")
         .and_then(|m: magnus::RModule| m.const_get("Audit"))
-        .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        .map_err(|e| crate::util::runtime(e.to_string()))?;
     audit_mod.ivar_get(SINK_IVAR)
 }
 

data/ext/confium_native/src/composite.rs

@@ -14,7 +14,7 @@
 use confium_composite::{CompositeSignature, ComponentSignature, VerificationResult};
 use ed25519_dalek::SigningKey;
 use magnus::{
-    exception, function, method, prelude::*, scan_args,
+    function, method, prelude::*, scan_args,
     typed_data::Obj, DataTypeFunctions, Error, IntoValue,
     Module, Object, RHash, Ruby, TryConvert, TypedData, Value,
 };
@@ -79,7 +79,7 @@ impl CompositeSig {
                 let details = new_details(&ruby);
                 confium_error(e.to_string(), "VerificationError", details)
             })?;
-        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
         Ok(ruby.obj_wrap(VerificationResultWrap { inner: result }))
     }
 }
@@ -133,7 +133,7 @@ impl VerificationResultWrap {
     }
 
     fn per_component(&self) -> Result<Value, Error> {
-        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
         let result = ruby.hash_new();
         for c in &self.inner.per_component {
             let entry = ruby.hash_new();
@@ -156,9 +156,7 @@ fn sign_ed25519(ruby: &Ruby, private_key: Value, message: Value) -> Result<RHash
     let pk_bytes = bytes_from_value(private_key)?;
     let msg = bytes_from_value(message)?;
     if pk_bytes.len() != 32 {
-        return Err(Error::new(
-            exception::arg_error(),
-            format!("Ed25519 private key must be 32 bytes, got {}", pk_bytes.len()),
+        return Err(crate::util::arg_error(format!("Ed25519 private key must be 32 bytes, got {}", pk_bytes.len()),
         ));
     }
     let mut pk_arr = [0u8; 32];
@@ -174,7 +172,7 @@ fn sign_ed25519(ruby: &Ruby, private_key: Value, message: Value) -> Result<RHash
                 Some(&msg),
                 Some(&e.to_string()),
             );
-            return Err(Error::new(exception::runtime_error(), e.to_string()));
+            return Err(crate::util::crypto_error(e.to_string(), "Composite.sign_ed25519", "ed25519"));
         }
     };
 
@@ -204,16 +202,14 @@ fn sign_p256(ruby: &Ruby, private_key: Value, message: Value) -> Result<RHash, E
     let pk_bytes = bytes_from_value(private_key)?;
     let msg = bytes_from_value(message)?;
     if pk_bytes.len() != 32 {
-        return Err(Error::new(
-            exception::arg_error(),
-            format!("P-256 private key must be 32 bytes, got {}", pk_bytes.len()),
+        return Err(crate::util::arg_error(format!("P-256 private key must be 32 bytes, got {}", pk_bytes.len()),
         ));
     }
     let mut arr = [0u8; 32];
     arr.copy_from_slice(&pk_bytes);
     use p256::ecdsa::{Signature, SigningKey, signature::Signer};
     let signing = SigningKey::from_bytes(&arr.into())
-        .map_err(|e| Error::new(exception::arg_error(), format!("invalid P-256 private key: {e}")))?;
+        .map_err(|e| crate::util::arg_error(format!("invalid P-256 private key: {e}")))?;
     let sig: Signature = match signing.try_sign(msg.as_slice()) {
         Ok(s) => s,
         Err(e) => {
@@ -224,7 +220,7 @@ fn sign_p256(ruby: &Ruby, private_key: Value, message: Value) -> Result<RHash, E
                 Some(&msg),
                 Some(&format!("sign error: {e}")),
             );
-            return Err(Error::new(exception::runtime_error(), format!("sign error: {e}")));
+            return Err(crate::util::crypto_error(format!("sign error: {e}"), "Composite.sign_p256", "ecdsa-p256"));
         }
     };
     let verifying = signing.verifying_key();
@@ -259,8 +255,8 @@ fn generate_ed25519_keypair(ruby: &Ruby) -> Result<RHash, Error> {
 fn parse_components(value: Value) -> Result<Vec<ComponentSignature>, Error> {
     let arr = magnus::RArray::try_convert(value)?;
     let mut out = Vec::with_capacity(arr.len());
-    for v in arr.each() {
-        let h: RHash = RHash::try_convert(v?)?;
+    for v in arr.into_iter() {
+        let h: RHash = RHash::try_convert(v)?;
         let algorithm: String = h.fetch::<_, String>("algorithm")?;
         let public_key: Value = h.fetch::<_, Value>("public_key")?;
         let signature: Value = h.fetch::<_, Value>("signature")?;

data/ext/confium_native/src/deployment.rs

@@ -11,8 +11,8 @@ use confium_deployment::{
     manifest::{parse_manifest, Manifest as RustManifest},
     validate::validate_manifest,
 };
-use crate::util::enforce_size;
-use magnus::{exception, function, method, typed_data::Obj, DataTypeFunctions, Error, Module, Object, Ruby, TypedData};
+use crate::util::{enforce_size, parse_error};
+use magnus::{function, method, typed_data::Obj, DataTypeFunctions, Error, Module, Object, Ruby, TypedData};
 
 #[derive(TypedData, DataTypeFunctions)]
 #[magnus(class = "Confium::Identity::Actor", size)]
@@ -24,8 +24,8 @@ impl Actor {
     fn from_json(json: String) -> Result<Obj<Self>, Error> {
         enforce_size(json.len())?;
         let actor: ActorIdentity = serde_json::from_str(&json)
-            .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
-        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+            .map_err(|e| parse_error(e.to_string(), "Actor.from_json", Some("json"), None))?;
+        let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
         Ok(ruby.obj_wrap(Self {
             inner: std::cell::RefCell::new(actor),
         }))
@@ -33,7 +33,7 @@ impl Actor {
 
     fn to_json(&self) -> Result<String, Error> {
         serde_json::to_string(&*self.inner.borrow())
-            .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))
+            .map_err(|e| crate::util::runtime(e.to_string()))
     }
 
     fn actor_id(&self) -> String {
@@ -93,8 +93,8 @@ impl Manifest {
     fn from_toml(toml_str: String) -> Result<Obj<Self>, Error> {
         enforce_size(toml_str.len())?;
         let manifest = parse_manifest(&toml_str)
-            .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
-        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+            .map_err(|e| parse_error(e.to_string(), "Manifest.from_toml", Some("toml"), None))?;
+        let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
         Ok(ruby.obj_wrap(Self {
             inner: std::cell::RefCell::new(manifest),
         }))
@@ -123,9 +123,10 @@ impl Manifest {
             .get(index)
             .map(|t| t.name.clone())
             .ok_or_else(|| {
-                Error::new(
-                    exception::index_error(),
+                crate::util::index_error(
                     format!("tier index {index} out of range"),
+                    "Manifest.tier_name_at",
+                    Some(index as u64),
                 )
             })
     }

data/ext/confium_native/src/ers.rs

@@ -5,7 +5,7 @@ use confium_transparency::ers::{
     EvidenceRecord, HashAlgorithm,
 };
 use magnus::{
-    exception, function, method, typed_data::Obj,
+    function, method, typed_data::Obj,
     DataTypeFunctions, Error, Module, Object, Ruby, TryConvert, TypedData, Value,
 };
 
@@ -20,13 +20,11 @@ pub struct ErsRecord {
 impl ErsRecord {
     fn build_initial(args: &[Value]) -> Result<Obj<Self>, Error> {
         let first = args.first().ok_or_else(|| {
-            Error::new(exception::arg_error(), "data_hash required")
+            crate::util::arg_error("data_hash required")
         })?;
         let data_hash = bytes_from_value(*first)?;
         if data_hash.len() != 32 {
-            return Err(Error::new(
-                exception::arg_error(),
-                format!("data_hash must be 32 bytes, got {}", data_hash.len()),
+            return Err(crate::util::arg_error(format!("data_hash must be 32 bytes, got {}", data_hash.len()),
             ));
         }
         let mut hash = [0u8; 32];
@@ -42,7 +40,7 @@ impl ErsRecord {
         let record =
             build_initial_evidence_record(hash, HashAlgorithm::Sha256, tsa_id, token_bytes);
         let ruby = Ruby::get()
-            .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+            .map_err(|e| crate::util::runtime(e.to_string()))?;
         Ok(ruby.obj_wrap(Self {
             inner: std::cell::RefCell::new(record),
         }))
@@ -50,13 +48,11 @@ impl ErsRecord {
 
     fn renew(&self, args: &[Value]) -> Result<Obj<Self>, Error> {
         let first = args.first().ok_or_else(|| {
-            Error::new(exception::arg_error(), "new_hash required")
+            crate::util::arg_error("new_hash required")
         })?;
         let new_hash_bytes = bytes_from_value(*first)?;
         if new_hash_bytes.len() != 32 {
-            return Err(Error::new(
-                exception::arg_error(),
-                format!("new_hash must be 32 bytes, got {}", new_hash_bytes.len()),
+            return Err(crate::util::arg_error(format!("new_hash must be 32 bytes, got {}", new_hash_bytes.len()),
             ));
         }
         let mut hash = [0u8; 32];
@@ -72,7 +68,7 @@ impl ErsRecord {
         let mut cloned = self.inner.borrow().clone();
         renew_evidence_record(&mut cloned, HashAlgorithm::Sha256, hash, tsa_id, token_bytes);
         let ruby = Ruby::get()
-            .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+            .map_err(|e| crate::util::runtime(e.to_string()))?;
         Ok(ruby.obj_wrap(Self {
             inner: std::cell::RefCell::new(cloned),
         }))

data/ext/confium_native/src/openpgp.rs

@@ -2,7 +2,7 @@
 //!
 //! Confium ships RNP functionality baked into the native extension.
 
-use magnus::{exception, function, prelude::*, Error, Module, RModule, Ruby, TryConvert, Value};
+use magnus::{function, prelude::*, Error, Module, RModule, Ruby, TryConvert, Value};
 use rnp::ops::ArmorType;
 use rnp::{armor_bytes, dearmor_bytes};
 
@@ -26,7 +26,7 @@ fn native_armor(ruby: &Ruby, data: Value, type_str: Value) -> Result<magnus::RSt
         }
     };
     let armored = armor_bytes(&bytes, ty)
-        .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        .map_err(|e| crate::util::parse_error(e.to_string(), "OpenPGP.armor", Some("openpgp"), None))?;
     Ok(bytes_to_rstring(ruby, &armored))
 }
 
@@ -34,7 +34,7 @@ fn native_armor(ruby: &Ruby, data: Value, type_str: Value) -> Result<magnus::RSt
 fn native_dearmor(ruby: &Ruby, data: Value) -> Result<magnus::RString, Error> {
     let bytes = bytes_from_value(data)?;
     let raw = dearmor_bytes(&bytes)
-        .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        .map_err(|e| crate::util::parse_error(e.to_string(), "OpenPGP.dearmor", Some("openpgp"), None))?;
     Ok(bytes_to_rstring(ruby, &raw))
 }
 

data/ext/confium_native/src/path.rs

@@ -10,7 +10,7 @@ use confium_pki::{
     path::{validate_path, CertPath},
     result::VerificationResult as PathVerificationResult,
 };
-use magnus::{exception, function, method, prelude::*, DataTypeFunctions, Error, Module, Ruby, TypedData, Value};
+use magnus::{function, method, prelude::*, DataTypeFunctions, Error, Module, Ruby, TypedData, Value};
 
 /// Wraps a confium_pki::path::VerificationResult.
 #[derive(TypedData, DataTypeFunctions)]
@@ -63,17 +63,17 @@ fn validate(args: &[Value]) -> Result<magnus::typed_data::Obj<PathResult>, Error
         Vec::new()
     } else {
         let arr = magnus::RArray::try_convert(intermediates_value)
-            .map_err(|e| Error::new(exception::arg_error(), e.to_string()))?;
+            .map_err(|e| crate::util::arg_error(e.to_string()))?;
         let mut out = Vec::with_capacity(arr.len());
-        for v in arr.each() {
-            out.push(extract_cert(v?, "intermediate")?);
+        for v in arr.into_iter() {
+            out.push(extract_cert(v, "intermediate")?);
         }
         out
     };
 
     let now = match now_iso8601 {
         Some(s) => chrono::DateTime::parse_from_rfc3339(&s)
-            .map_err(|e| Error::new(exception::arg_error(), format!("invalid time: {e}")))?
+            .map_err(|e| crate::util::arg_error(format!("invalid time: {e}")))?
             .with_timezone(&Utc),
         None => Utc::now(),
     };
@@ -86,7 +86,7 @@ fn validate(args: &[Value]) -> Result<magnus::typed_data::Obj<PathResult>, Error
     let result = validate_path(&path, now);
 
     let ruby = Ruby::get()
-        .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        .map_err(|e| crate::util::runtime(e.to_string()))?;
     Ok(ruby.obj_wrap(PathResult { inner: result }))
 }
 
@@ -98,10 +98,10 @@ fn extract_cert(value: Value, label: &str) -> Result<RustCert, Error> {
     // We re-parse those bytes into a fresh RustCert.
     let der_value: Value = value
         .funcall("to_der", ())
-        .map_err(|e| Error::new(exception::runtime_error(), format!("{}: cannot get DER: {e}", label)))?;
+        .map_err(|e| crate::util::parse_error(format!("{label}: cannot get DER: {e}"), "PathValidator.validate", Some("der"), None))?;
     let der = crate::util::bytes_from_value(der_value)?;
     RustCert::from_der(&der)
-        .map_err(|e| Error::new(exception::runtime_error(), format!("{}: invalid DER: {e}", label)))
+        .map_err(|e| crate::util::parse_error(format!("{label}: invalid DER: {e}"), "PathValidator.validate", Some("der"), None))
 }
 
 pub fn init(ruby: &Ruby, parent: magnus::RModule) -> Result<(), Error> {