confium 0.3.2 → 0.3.4

data/ext/confium_native/src/util.rs

@@ -3,6 +3,11 @@
 //! DRY consolidation: a single `bytes_from_value` + size cap + string
 //! conversion + typed-error helper shared by every subsystem module
 //! (composite, pki, tc, transparency, deployment, attributes).
+//!
+//! This module wraps magnus's deprecated `exception::*` constructors
+//! so the rest of the crate never touches them; their replacements
+//! need a `Ruby` handle, which the failure fallbacks here lack.
+#![allow(deprecated)]
 
 use magnus::prelude::*;
 use magnus::{exception, Error, RHash, RString, Ruby, TryConvert, Value};
@@ -14,6 +19,28 @@ use magnus::{exception, Error, RHash, RString, Ruby, TryConvert, Value};
 /// prevent trivial memory-exhaustion attacks.
 pub const MAX_INPUT_SIZE: usize = 1 << 20;
 
+/// Build a plain `RuntimeError`. Centralizes every raise site so the
+/// deprecated `magnus::exception::runtime_error()` fallback lives in
+/// exactly one place (its replacement needs a `Ruby` handle, which is
+/// unavailable when `Ruby::get()` itself fails).
+pub fn runtime(msg: impl Into<String>) -> Error {
+    let msg: String = msg.into();
+    match Ruby::get() {
+        Ok(ruby) => Error::new(ruby.exception_runtime_error(), msg),
+        Err(_) => Error::new(exception::runtime_error(), msg),
+    }
+}
+
+/// Build an `ArgumentError` — for bad argument shapes/ranges, the
+/// class callers should see before any Confium semantics apply.
+pub fn arg_error(msg: impl Into<String>) -> Error {
+    let msg: String = msg.into();
+    match Ruby::get() {
+        Ok(ruby) => Error::new(ruby.exception_arg_error(), msg),
+        Err(_) => Error::new(exception::arg_error(), msg),
+    }
+}
+
 /// Convert a Ruby value to bytes. Accepts a binary `String` (any
 /// encoding) or an `Array<Integer>`. Enforces a 1 MiB size cap.
 pub fn bytes_from_value(v: Value) -> Result<Vec<u8>, Error> {
@@ -30,10 +57,7 @@ pub fn bytes_from_value(v: Value) -> Result<Vec<u8>, Error> {
     arr.into_iter()
         .map(|i| {
             if !(0..=255).contains(&i) {
-                Err(Error::new(
-                    exception::arg_error(),
-                    format!("byte out of range 0..255: {i}"),
-                ))
+                Err(arg_error(format!("byte out of range 0..255: {i}")))
             } else {
                 Ok(i as u8)
             }
@@ -46,18 +70,15 @@ pub fn bytes_from_value(v: Value) -> Result<Vec<u8>, Error> {
 /// memory-exhaustion attacks.
 pub fn enforce_size(len: usize) -> Result<(), Error> {
     if len > MAX_INPUT_SIZE {
-        return Err(Error::new(
-            exception::arg_error(),
-            format!("input size {0} exceeds max {MAX_INPUT_SIZE}", len),
-        ));
+        return Err(arg_error(format!("input size {0} exceeds max {MAX_INPUT_SIZE}", len)));
     }
     Ok(())
 }
 
 /// Build a Ruby binary `String` from a byte slice. Avoids the UTF-8
-/// round-trip in `RString::buf_new` + `cat` for already-binary input.
-pub fn bytes_to_rstring(_ruby: &Ruby, bytes: &[u8]) -> RString {
-    let s = RString::buf_new(0);
+/// round-trip for already-binary input.
+pub fn bytes_to_rstring(ruby: &Ruby, bytes: &[u8]) -> RString {
+    let s = ruby.str_buf_new(0);
     s.cat(bytes);
     s
 }
@@ -148,6 +169,19 @@ pub fn parse_error(msg: impl Into<String>, operation: &str, format: Option<&str>
     confium_error(msg, "ParseError", d)
 }
 
+#[allow(dead_code)]
+pub fn index_error(msg: impl Into<String>, operation: &str, index: Option<u64>) -> Error {
+    let ruby = match Ruby::get() {
+        Ok(r) => r,
+        Err(_) => return Error::new(exception::runtime_error(), msg.into()),
+    };
+    let d = new_details(&ruby);
+    let _ = d.aset("operation", operation);
+    let _ = d.aset("component", "Confium");
+    if let Some(i) = index { let _ = d.aset("index", i); }
+    confium_error(msg, "IndexError", d)
+}
+
 #[allow(dead_code)]
 pub fn validation_error(msg: impl Into<String>, operation: &str, param: &str, expected: &str, actual: &str) -> Error {
     let ruby = match Ruby::get() {

data/lib/confium/audit.rb

@@ -68,6 +68,7 @@ module Confium
       attr_reader :records
 
       def initialize
+        # @type ivar @records: Array[untyped]
         @records = []
       end
 

data/lib/confium/composite.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+require 'json'
+
+module Confium
+  module Composite
+    # JSON transport for composite signatures. The native extension
+    # defines Signature with algorithms/component_count/verify over
+    # component Hashes (algorithm, public_key, signature) whose
+    # binary fields cannot ride JSON directly, so the wire format
+    # hex-encodes them:
+    #
+    #   json = Confium::Composite::Signature.components_to_json(components)
+    #   sig  = Confium::Composite::Signature.from_json(json)
+    #   sig.verify(message)
+    class Signature
+      BINARY_FIELDS = %w[public_key signature].freeze
+
+      def self.components_to_json(components)
+        JSON.generate(components.map do |component|
+          component.transform_values do |value|
+            value.encoding == Encoding::ASCII_8BIT ? value.unpack1('H*') : value
+          end
+        end)
+      end
+
+      # Accepts either a bare JSON array of component Hashes or a
+      # {"components": [...]} envelope, with public_key/signature
+      # hex-encoded on the wire. Takes a JSON string or an
+      # already-parsed Array/Hash.
+      def self.from_json(json)
+        data = json.is_a?(String) ? JSON.parse(json) : json
+        components = data.is_a?(Hash) ? data['components'] : data
+        unless components.is_a?(Array) && !components.empty?
+          raise ArgumentError, 'expected a non-empty "components" array'
+        end
+
+        new(components.map { |c| decode_binary_fields(c) })
+      end
+
+      def self.decode_binary_fields(component)
+        BINARY_FIELDS.each_with_object(component.dup) do |field, decoded|
+          value = component.fetch(field)
+          decoded[field] = [value].pack('H*') if value.is_a?(String)
+        end
+      end
+      private_class_method :decode_binary_fields
+    end
+  end
+end

data/lib/confium/crypto.rb

@@ -21,6 +21,7 @@
 #   Confium::Crypto.lookup(:hash)  # => Confium::Digest
 module Confium
   module Crypto
+    # @type ivar @interfaces: Hash[Symbol, untyped]
     @interfaces = {}
 
     class << self

data/lib/confium/pki/cms/signed_data_builder.rb

@@ -33,6 +33,7 @@ module Confium
 
         def initialize
           @content = nil
+          # @type ivar @signers: Array[Hash[Symbol, untyped]]
           @signers = []
         end
 
@@ -81,7 +82,9 @@ module Confium
             result.fetch('signature')
           when :ecdsa_p256
             result = Confium::TC::FrostP256.sign(private_key, payload)
-            result.fetch('signature')
+            # CMS carries ECDSA signatures DER-encoded (DSA-Sig-Value);
+            # FrostP256.sign returns { "der" => ..., "fixed" => ... }.
+            result.fetch('der')
           else
             raise ArgumentError, "unsupported algorithm: #{algorithm.inspect}"
           end

data/lib/confium/pki.rb

@@ -9,5 +9,7 @@
 module Confium
   module PKI
     autoload :CMS, 'confium/pki/cms'
+    autoload :CertificateBuilder, 'confium/pki/certificate_builder'
+    autoload :CNML, 'confium/pki/cnml'
   end
 end

data/lib/confium/transparency.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+# Confium::Transparency namespace file.
+#
+# The Transparency module itself is defined by the native Rust
+# extension via magnus at require time. This file registers
+# pure-Ruby autoloads for the Transparency submodules.
+module Confium
+  module Transparency
+    autoload :OTS, 'confium/transparency/ots'
+  end
+end

data/lib/confium/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Confium
-  VERSION = '0.3.2'
+  VERSION = '0.3.4'
 end

data/lib/confium.rb

@@ -18,8 +18,7 @@ begin
   # 3.1 and 3.2 get exact-minor builds while 3.3 covers 3.3+).
   # Source builds install the extension flat, without a version
   # directory.
-  major, minor = RUBY_VERSION.split('.').first(2).map(&:to_i)
-  window = major > 3 || minor >= 3 ? '3.3' : "#{major}.#{minor}"
+  window = Gem::Version.new(RUBY_VERSION) >= Gem::Version.new('3.3') ? '3.3' : RUBY_VERSION[/\A\d+\.\d+/]
   begin
     require_relative "confium_native/#{window}/confium_native"
   rescue LoadError
@@ -56,9 +55,21 @@ module Confium
   autoload :PolicyViolationError, 'confium/errors/policy_violation_error'
   autoload :SecureBytes,          'confium/secure_bytes'
   autoload :Policy,               'confium/policy'
-  autoload :PKI,                  'confium/pki'
+  # PKI is native-defined, so an autoload would never fire; the
+  # namespace file is eager-required and registers the pure-Ruby
+  # submodules (CMS, CertificateBuilder, CNML) as autoloads.
+  require_relative 'confium/pki'
 end
 
+# Eager-load the Composite Signature JSON companion. The native
+# extension defines Confium::Composite; this file reopens the class
+# to add from_json transport.
+require_relative 'confium/composite'
+
+# Eager-load the Transparency namespace for the OTS autoload (the
+# module itself is native-defined).
+require_relative 'confium/transparency'
+
 # Eager-load the Audit Ruby companion. The native extension registers
 # `Confium::Audit` as a Ruby module with the `record`/`sink=`/`sink`
 # methods; the companion file defines the Sink class hierarchy on top

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: confium
 version: !ruby/object:Gem::Version
-  version: 0.3.2
+  version: 0.3.4
 platform: ruby
 authors:
 - Ribose Open
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-08-22 00:00:00.000000000 Z
+date: 2026-08-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rb_sys
@@ -52,20 +52,6 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: 1.3.0
-- !ruby/object:Gem::Dependency
-  name: rake-compiler-dock
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.3'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.3'
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
@@ -144,6 +130,7 @@ files:
 - lib/confium.rb
 - lib/confium/audit.rb
 - lib/confium/cfm.rb
+- lib/confium/composite.rb
 - lib/confium/crypto.rb
 - lib/confium/digest.rb
 - lib/confium/errors.rb
@@ -172,6 +159,7 @@ files:
 - lib/confium/tc/session.rb
 - lib/confium/tc/session_stub.rb
 - lib/confium/tc/share_file.rb
+- lib/confium/transparency.rb
 - lib/confium/transparency/ots.rb
 - lib/confium/version.rb
 homepage: https://www.confium.org