confium 0.3.3 → 0.4.0

data/README.adoc

@@ -10,7 +10,7 @@ Confium supports three deployment modes:
 * **Mode 2 — TC PKI replacement**: drop-in for existing PKI consumers (PKCS#11 server, OpenSSL 3.0 provider, JCE)
 * **Mode 3 — TC Certificate PKI**: institutional deployments with custom certificate formats (OIML CNML, BIPM, pharma, accreditation)
 
-This gem wraps the high-value Confium subsystems via a Rust native extension. Pre-compiled platform gems are published for Linux and macOS, so `gem install` needs no Rust toolchain there; other platforms build from source at install time with `rb_sys` + `magnus`. No separate C ABI library to install; everything is statically linked into the extension.
+This gem wraps the high-value Confium subsystems via a pure-Rust native extension (`rb_sys` + `magnus`, no C dependencies). Pre-compiled platform gems are published for Linux (glibc + musl), macOS, and Windows, so `gem install` needs no Rust toolchain there; other platforms build from source at install time.
 
 == Installation
 
@@ -32,17 +32,13 @@ $ gem install confium
 
 * Ruby ≥ 3.1
 * Nothing else on the pre-compiled platforms: `x86_64-linux`,
-  `aarch64-linux`, `x86_64-darwin`, `arm64-darwin` (each gem carries
-  one extension per Ruby C-ABI window)
+  `aarch64-linux`, `x86_64-linux-musl`, `aarch64-linux-musl`,
+  `x86_64-darwin`, `arm64-darwin`, `x64-mingw-ucrt` (each gem
+  carries one extension per Ruby C-ABI window)
 
 Source builds (other platforms, or installing from the repo) also
-need:
-
-* Rust stable toolchain (`rustup default stable`)
-* C toolchain (clang/gcc/Xcode CLT)
-
-There is no separate `libconfium` to install — the extension
-statically links everything.
+need the Rust stable toolchain (`rustup default stable`) — and
+nothing else: the extension has no C dependencies to satisfy.
 
 == Quick start
 

data/ext/confium_native/Cargo.toml

@@ -55,9 +55,5 @@ chrono = "0.4"
 hex = "0.4"
 serde_json = "1"
 
-# RNP (OpenPGP, RFC 9580) — hard-bundled with vendored feature so
-# librnp is compiled from source via rnp-src. No system librnp needed.
-rnp = { package = "rnp-rs", version = "0.1.10", features = ["vendored"] }
-
 [profile.release]
 lto = "off"

data/ext/confium_native/src/attributes.rs

@@ -12,7 +12,7 @@
 
 use confium_attributes::{evaluate, parse as dsl_parse, Predicate, SignerAttributes};
 use magnus::{
-    exception, function, method, typed_data::Obj, DataTypeFunctions, Error, Module,
+    function, method, typed_data::Obj, DataTypeFunctions, Error, Module,
     Object, Ruby, TryConvert, TypedData, Value,
 };
 
@@ -26,8 +26,8 @@ impl PredicateWrap {
     fn satisfied_by(&self, signers_value: Value) -> Result<bool, Error> {
         let arr = magnus::RArray::try_convert(signers_value)?;
         let mut owned: Vec<SignerAttributes> = Vec::with_capacity(arr.len());
-        for v in arr.each() {
-            let signer_wrap = Obj::<SignerWrap>::try_convert(v?)?;
+        for v in arr.into_iter() {
+            let signer_wrap = Obj::<SignerWrap>::try_convert(v)?;
             owned.push(signer_wrap.inner.borrow().clone());
         }
         let refs: Vec<&SignerAttributes> = owned.iter().collect();
@@ -64,7 +64,7 @@ impl SignerWrap {
 fn parse(expr: String) -> Result<Obj<PredicateWrap>, Error> {
     let predicate = dsl_parse(&expr)
         .map_err(|e| crate::util::parse_error(e.to_string(), "Attributes.parse", Some("dsl"), None))?;
-    let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+    let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
     Ok(ruby.obj_wrap(PredicateWrap { inner: predicate }))
 }
 

data/ext/confium_native/src/audit.rs

@@ -11,7 +11,7 @@
 //! sink raises, the calling operation still succeeds. Audit
 //! failures must never break a signing ceremony.
 
-use magnus::{exception, function, prelude::*, Error, Module, Ruby, Value};
+use magnus::{function, prelude::*, Error, Module, Ruby, Value};
 use sha2::{Digest, Sha256};
 
 const SINK_IVAR: &str = "@sink";
@@ -94,12 +94,12 @@ fn record(
     algorithm: Option<String>,
     error: Option<String>,
 ) -> Result<(), Error> {
-    let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+    let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
     let audit_mod: magnus::RModule = ruby
         .class_object()
         .const_get("Confium")
         .and_then(|m: magnus::RModule| m.const_get("Audit"))
-        .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        .map_err(|e| crate::util::runtime(e.to_string()))?;
 
     let sink: Value = audit_mod.ivar_get(SINK_IVAR)?;
     if sink.is_nil() {
@@ -123,31 +123,31 @@ fn record(
 
     let _: Value = sink
         .funcall("call", (h,))
-        .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        .map_err(|e| crate::util::runtime(e.to_string()))?;
     Ok(())
 }
 
 /// Set the global audit sink. `callback` is a Proc that receives a Hash
 /// or nil to disable auditing.
 fn set_sink(callback: Value) -> Result<(), Error> {
-    let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+    let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
     let audit_mod: magnus::RModule = ruby
         .class_object()
         .const_get("Confium")
         .and_then(|m: magnus::RModule| m.const_get("Audit"))
-        .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        .map_err(|e| crate::util::runtime(e.to_string()))?;
     audit_mod.ivar_set(SINK_IVAR, callback)?;
     Ok(())
 }
 
 /// Get the current audit sink (or nil if not set).
 fn get_sink() -> Result<Value, Error> {
-    let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+    let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
     let audit_mod: magnus::RModule = ruby
         .class_object()
         .const_get("Confium")
         .and_then(|m: magnus::RModule| m.const_get("Audit"))
-        .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        .map_err(|e| crate::util::runtime(e.to_string()))?;
     audit_mod.ivar_get(SINK_IVAR)
 }
 

data/ext/confium_native/src/composite.rs

@@ -14,7 +14,7 @@
 use confium_composite::{CompositeSignature, ComponentSignature, VerificationResult};
 use ed25519_dalek::SigningKey;
 use magnus::{
-    exception, function, method, prelude::*, scan_args,
+    function, method, prelude::*, scan_args,
     typed_data::Obj, DataTypeFunctions, Error, IntoValue,
     Module, Object, RHash, Ruby, TryConvert, TypedData, Value,
 };
@@ -79,7 +79,7 @@ impl CompositeSig {
                 let details = new_details(&ruby);
                 confium_error(e.to_string(), "VerificationError", details)
             })?;
-        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
         Ok(ruby.obj_wrap(VerificationResultWrap { inner: result }))
     }
 }
@@ -133,7 +133,7 @@ impl VerificationResultWrap {
     }
 
     fn per_component(&self) -> Result<Value, Error> {
-        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
         let result = ruby.hash_new();
         for c in &self.inner.per_component {
             let entry = ruby.hash_new();
@@ -156,9 +156,7 @@ fn sign_ed25519(ruby: &Ruby, private_key: Value, message: Value) -> Result<RHash
     let pk_bytes = bytes_from_value(private_key)?;
     let msg = bytes_from_value(message)?;
     if pk_bytes.len() != 32 {
-        return Err(Error::new(
-            exception::arg_error(),
-            format!("Ed25519 private key must be 32 bytes, got {}", pk_bytes.len()),
+        return Err(crate::util::arg_error(format!("Ed25519 private key must be 32 bytes, got {}", pk_bytes.len()),
         ));
     }
     let mut pk_arr = [0u8; 32];
@@ -174,7 +172,7 @@ fn sign_ed25519(ruby: &Ruby, private_key: Value, message: Value) -> Result<RHash
                 Some(&msg),
                 Some(&e.to_string()),
             );
-            return Err(Error::new(exception::runtime_error(), e.to_string()));
+            return Err(crate::util::crypto_error(e.to_string(), "Composite.sign_ed25519", "ed25519"));
         }
     };
 
@@ -204,16 +202,14 @@ fn sign_p256(ruby: &Ruby, private_key: Value, message: Value) -> Result<RHash, E
     let pk_bytes = bytes_from_value(private_key)?;
     let msg = bytes_from_value(message)?;
     if pk_bytes.len() != 32 {
-        return Err(Error::new(
-            exception::arg_error(),
-            format!("P-256 private key must be 32 bytes, got {}", pk_bytes.len()),
+        return Err(crate::util::arg_error(format!("P-256 private key must be 32 bytes, got {}", pk_bytes.len()),
         ));
     }
     let mut arr = [0u8; 32];
     arr.copy_from_slice(&pk_bytes);
     use p256::ecdsa::{Signature, SigningKey, signature::Signer};
     let signing = SigningKey::from_bytes(&arr.into())
-        .map_err(|e| Error::new(exception::arg_error(), format!("invalid P-256 private key: {e}")))?;
+        .map_err(|e| crate::util::arg_error(format!("invalid P-256 private key: {e}")))?;
     let sig: Signature = match signing.try_sign(msg.as_slice()) {
         Ok(s) => s,
         Err(e) => {
@@ -224,7 +220,7 @@ fn sign_p256(ruby: &Ruby, private_key: Value, message: Value) -> Result<RHash, E
                 Some(&msg),
                 Some(&format!("sign error: {e}")),
             );
-            return Err(Error::new(exception::runtime_error(), format!("sign error: {e}")));
+            return Err(crate::util::crypto_error(format!("sign error: {e}"), "Composite.sign_p256", "ecdsa-p256"));
         }
     };
     let verifying = signing.verifying_key();
@@ -259,8 +255,8 @@ fn generate_ed25519_keypair(ruby: &Ruby) -> Result<RHash, Error> {
 fn parse_components(value: Value) -> Result<Vec<ComponentSignature>, Error> {
     let arr = magnus::RArray::try_convert(value)?;
     let mut out = Vec::with_capacity(arr.len());
-    for v in arr.each() {
-        let h: RHash = RHash::try_convert(v?)?;
+    for v in arr.into_iter() {
+        let h: RHash = RHash::try_convert(v)?;
         let algorithm: String = h.fetch::<_, String>("algorithm")?;
         let public_key: Value = h.fetch::<_, Value>("public_key")?;
         let signature: Value = h.fetch::<_, Value>("signature")?;

data/ext/confium_native/src/deployment.rs

@@ -12,7 +12,7 @@ use confium_deployment::{
     validate::validate_manifest,
 };
 use crate::util::{enforce_size, parse_error};
-use magnus::{exception, function, method, typed_data::Obj, DataTypeFunctions, Error, Module, Object, Ruby, TypedData};
+use magnus::{function, method, typed_data::Obj, DataTypeFunctions, Error, Module, Object, Ruby, TypedData};
 
 #[derive(TypedData, DataTypeFunctions)]
 #[magnus(class = "Confium::Identity::Actor", size)]
@@ -25,7 +25,7 @@ impl Actor {
         enforce_size(json.len())?;
         let actor: ActorIdentity = serde_json::from_str(&json)
             .map_err(|e| parse_error(e.to_string(), "Actor.from_json", Some("json"), None))?;
-        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
         Ok(ruby.obj_wrap(Self {
             inner: std::cell::RefCell::new(actor),
         }))
@@ -33,7 +33,7 @@ impl Actor {
 
     fn to_json(&self) -> Result<String, Error> {
         serde_json::to_string(&*self.inner.borrow())
-            .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))
+            .map_err(|e| crate::util::runtime(e.to_string()))
     }
 
     fn actor_id(&self) -> String {
@@ -94,7 +94,7 @@ impl Manifest {
         enforce_size(toml_str.len())?;
         let manifest = parse_manifest(&toml_str)
             .map_err(|e| parse_error(e.to_string(), "Manifest.from_toml", Some("toml"), None))?;
-        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
         Ok(ruby.obj_wrap(Self {
             inner: std::cell::RefCell::new(manifest),
         }))
@@ -123,9 +123,10 @@ impl Manifest {
             .get(index)
             .map(|t| t.name.clone())
             .ok_or_else(|| {
-                Error::new(
-                    exception::index_error(),
+                crate::util::index_error(
                     format!("tier index {index} out of range"),
+                    "Manifest.tier_name_at",
+                    Some(index as u64),
                 )
             })
     }

data/ext/confium_native/src/ers.rs

@@ -5,7 +5,7 @@ use confium_transparency::ers::{
     EvidenceRecord, HashAlgorithm,
 };
 use magnus::{
-    exception, function, method, typed_data::Obj,
+    function, method, typed_data::Obj,
     DataTypeFunctions, Error, Module, Object, Ruby, TryConvert, TypedData, Value,
 };
 
@@ -20,13 +20,11 @@ pub struct ErsRecord {
 impl ErsRecord {
     fn build_initial(args: &[Value]) -> Result<Obj<Self>, Error> {
         let first = args.first().ok_or_else(|| {
-            Error::new(exception::arg_error(), "data_hash required")
+            crate::util::arg_error("data_hash required")
         })?;
         let data_hash = bytes_from_value(*first)?;
         if data_hash.len() != 32 {
-            return Err(Error::new(
-                exception::arg_error(),
-                format!("data_hash must be 32 bytes, got {}", data_hash.len()),
+            return Err(crate::util::arg_error(format!("data_hash must be 32 bytes, got {}", data_hash.len()),
             ));
         }
         let mut hash = [0u8; 32];
@@ -42,7 +40,7 @@ impl ErsRecord {
         let record =
             build_initial_evidence_record(hash, HashAlgorithm::Sha256, tsa_id, token_bytes);
         let ruby = Ruby::get()
-            .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+            .map_err(|e| crate::util::runtime(e.to_string()))?;
         Ok(ruby.obj_wrap(Self {
             inner: std::cell::RefCell::new(record),
         }))
@@ -50,13 +48,11 @@ impl ErsRecord {
 
     fn renew(&self, args: &[Value]) -> Result<Obj<Self>, Error> {
         let first = args.first().ok_or_else(|| {
-            Error::new(exception::arg_error(), "new_hash required")
+            crate::util::arg_error("new_hash required")
         })?;
         let new_hash_bytes = bytes_from_value(*first)?;
         if new_hash_bytes.len() != 32 {
-            return Err(Error::new(
-                exception::arg_error(),
-                format!("new_hash must be 32 bytes, got {}", new_hash_bytes.len()),
+            return Err(crate::util::arg_error(format!("new_hash must be 32 bytes, got {}", new_hash_bytes.len()),
             ));
         }
         let mut hash = [0u8; 32];
@@ -72,7 +68,7 @@ impl ErsRecord {
         let mut cloned = self.inner.borrow().clone();
         renew_evidence_record(&mut cloned, HashAlgorithm::Sha256, hash, tsa_id, token_bytes);
         let ruby = Ruby::get()
-            .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+            .map_err(|e| crate::util::runtime(e.to_string()))?;
         Ok(ruby.obj_wrap(Self {
             inner: std::cell::RefCell::new(cloned),
         }))

data/ext/confium_native/src/lib.rs

@@ -9,7 +9,6 @@ mod attributes;
 mod composite;
 mod deployment;
 mod ers;
-mod openpgp;
 mod path;
 mod pki;
 mod tc;
@@ -51,6 +50,5 @@ fn init(ruby: &Ruby) -> Result<(), Error> {
     tc::init(ruby, confium)?;
     audit::init(ruby, confium)?;
     ers::init(ruby, confium)?;
-    openpgp::init(ruby, confium)?;
     Ok(())
 }

data/ext/confium_native/src/path.rs

@@ -10,7 +10,7 @@ use confium_pki::{
     path::{validate_path, CertPath},
     result::VerificationResult as PathVerificationResult,
 };
-use magnus::{exception, function, method, prelude::*, DataTypeFunctions, Error, Module, Ruby, TypedData, Value};
+use magnus::{function, method, prelude::*, DataTypeFunctions, Error, Module, Ruby, TypedData, Value};
 
 /// Wraps a confium_pki::path::VerificationResult.
 #[derive(TypedData, DataTypeFunctions)]
@@ -63,17 +63,17 @@ fn validate(args: &[Value]) -> Result<magnus::typed_data::Obj<PathResult>, Error
         Vec::new()
     } else {
         let arr = magnus::RArray::try_convert(intermediates_value)
-            .map_err(|e| Error::new(exception::arg_error(), e.to_string()))?;
+            .map_err(|e| crate::util::arg_error(e.to_string()))?;
         let mut out = Vec::with_capacity(arr.len());
-        for v in arr.each() {
-            out.push(extract_cert(v?, "intermediate")?);
+        for v in arr.into_iter() {
+            out.push(extract_cert(v, "intermediate")?);
         }
         out
     };
 
     let now = match now_iso8601 {
         Some(s) => chrono::DateTime::parse_from_rfc3339(&s)
-            .map_err(|e| Error::new(exception::arg_error(), format!("invalid time: {e}")))?
+            .map_err(|e| crate::util::arg_error(format!("invalid time: {e}")))?
             .with_timezone(&Utc),
         None => Utc::now(),
     };
@@ -86,7 +86,7 @@ fn validate(args: &[Value]) -> Result<magnus::typed_data::Obj<PathResult>, Error
     let result = validate_path(&path, now);
 
     let ruby = Ruby::get()
-        .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        .map_err(|e| crate::util::runtime(e.to_string()))?;
     Ok(ruby.obj_wrap(PathResult { inner: result }))
 }
 
@@ -98,10 +98,10 @@ fn extract_cert(value: Value, label: &str) -> Result<RustCert, Error> {
     // We re-parse those bytes into a fresh RustCert.
     let der_value: Value = value
         .funcall("to_der", ())
-        .map_err(|e| Error::new(exception::runtime_error(), format!("{}: cannot get DER: {e}", label)))?;
+        .map_err(|e| crate::util::parse_error(format!("{label}: cannot get DER: {e}"), "PathValidator.validate", Some("der"), None))?;
     let der = crate::util::bytes_from_value(der_value)?;
     RustCert::from_der(&der)
-        .map_err(|e| Error::new(exception::runtime_error(), format!("{}: invalid DER: {e}", label)))
+        .map_err(|e| crate::util::parse_error(format!("{label}: invalid DER: {e}"), "PathValidator.validate", Some("der"), None))
 }
 
 pub fn init(ruby: &Ruby, parent: magnus::RModule) -> Result<(), Error> {

data/ext/confium_native/src/pki.rs

@@ -20,7 +20,7 @@ use confium_pki::{
     xmldsig::{canonicalize, canonicalize_exclusive},
 };
 use magnus::{
-    exception, function, method, prelude::*, typed_data::Obj, DataTypeFunctions, Error, Module,
+    function, method, prelude::*, typed_data::Obj, DataTypeFunctions, Error, Module,
     Object, RHash, RString, Ruby, TryConvert, TypedData, Value,
 };
 
@@ -35,7 +35,7 @@ impl Certificate {
         let der = bytes_from_value(bytes)?;
         let cert = RustCert::from_der(&der)
             .map_err(|e| parse_error(e.to_string(), "Certificate.from_der", Some("der"), None))?;
-        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
         Ok(ruby.obj_wrap(Self { inner: cert }))
     }
 
@@ -43,12 +43,12 @@ impl Certificate {
         enforce_size(pem.len())?;
         let cert = RustCert::from_pem(&pem)
             .map_err(|e| parse_error(e.to_string(), "Certificate.from_pem", Some("pem"), None))?;
-        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
         Ok(ruby.obj_wrap(Self { inner: cert }))
     }
 
     fn to_der(&self) -> Result<RString, Error> {
-        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
         Ok(bytes_to_rstring(&ruby, &self.inner.to_der()))
     }
 
@@ -81,13 +81,13 @@ impl Certificate {
 
     fn valid_at(&self, iso8601: String) -> Result<bool, Error> {
         let now = DateTime::parse_from_rfc3339(&iso8601)
-            .map_err(|e| Error::new(exception::arg_error(), format!("invalid ISO8601 time: {e}")))?
+            .map_err(|e| crate::util::arg_error(format!("invalid ISO8601 time: {e}")))?
             .with_timezone(&Utc);
         Ok(self.inner.is_within_validity(now))
     }
 
     fn public_key_bytes(&self) -> Result<RString, Error> {
-        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
         Ok(bytes_to_rstring(&ruby, self.inner.public_key_bytes()))
     }
 }
@@ -103,7 +103,7 @@ impl Csr {
         let der = bytes_from_value(bytes)?;
         let csr = RustCsr::from_der(&der)
             .map_err(|e| parse_error(e.to_string(), "Csr.from_der", Some("der"), None))?;
-        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
         Ok(ruby.obj_wrap(Self { inner: csr }))
     }
 
@@ -111,12 +111,12 @@ impl Csr {
         enforce_size(pem.len())?;
         let csr = RustCsr::from_pem(&pem)
             .map_err(|e| parse_error(e.to_string(), "Csr.from_pem", Some("pem"), None))?;
-        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
         Ok(ruby.obj_wrap(Self { inner: csr }))
     }
 
     fn to_der(&self) -> Result<RString, Error> {
-        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
         Ok(bytes_to_rstring(&ruby, &self.inner.to_der()))
     }
 
@@ -136,7 +136,7 @@ impl SignedData {
         enforce_size(json.len())?;
         let sd: RustSignedData = serde_json::from_str(&json)
             .map_err(|e| parse_error(e.to_string(), "SignedData.from_json", Some("json"), None))?;
-        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
         Ok(ruby.obj_wrap(Self {
             inner: std::cell::RefCell::new(sd),
         }))
@@ -162,15 +162,11 @@ impl SignedData {
         certificates: Value,
     ) -> Result<Obj<Self>, Error> {
         if signature.is_nil() {
-            return Err(Error::new(
-                exception::arg_error(),
-                "signature is required",
+            return Err(crate::util::arg_error("signature is required",
             ));
         }
         if certificates.is_nil() {
-            return Err(Error::new(
-                exception::arg_error(),
-                "certificates is required",
+            return Err(crate::util::arg_error("certificates is required",
             ));
         }
 
@@ -179,16 +175,15 @@ impl SignedData {
 
         let certs_array: magnus::RArray = magnus::RArray::try_convert(certificates)?;
         let mut cert_ders = Vec::with_capacity(certs_array.len());
-        for item in certs_array.each() {
-            let v = item?;
+        for v in certs_array.into_iter() {
             let der = bytes_from_value(v)?;
             enforce_size(der.len())?;
             cert_ders.push(der);
         }
 
-        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
         let sd = build_detached_signature(Vec::new(), algorithm, sig_bytes, cert_ders)
-            .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+            .map_err(|e| crate::util::runtime(e.to_string()))?;
         Ok(ruby.obj_wrap(Self {
             inner: std::cell::RefCell::new(sd),
         }))
@@ -196,7 +191,7 @@ impl SignedData {
 
     fn to_json(&self) -> Result<String, Error> {
         serde_json::to_string(&*self.inner.borrow())
-            .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))
+            .map_err(|e| crate::util::runtime(e.to_string()))
     }
 
     /// Encode this SignedData as DER bytes (RFC 5652 ContentInfo).
@@ -204,9 +199,9 @@ impl SignedData {
     /// The output is parseable by `openssl cms` / `openssl pkcs7` and
     /// any standards-compliant CMS consumer.
     fn to_der(&self) -> Result<RString, Error> {
-        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
         let der = encode_signed_data_der(&self.inner.borrow())
-            .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+            .map_err(|e| crate::util::runtime(e.to_string()))?;
         Ok(bytes_to_rstring(&ruby, &der))
     }
 
@@ -225,7 +220,7 @@ impl SignedData {
     fn content(&self) -> Result<Option<Obj<CertWrapper>>, Error> {
         // Wrap the optional content bytes in a small value object so Ruby
         // can ask `.present?` / `.bytes` without juggling nil-vs-string.
-        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
         match &self.inner.borrow().encap_content_info.content {
             Some(bytes) => {
                 let wrapper = CertWrapper {
@@ -242,16 +237,17 @@ impl SignedData {
     }
 
     fn certificate_at(&self, index: usize) -> Result<RString, Error> {
-        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
         self.inner
             .borrow()
             .certificates
             .get(index)
             .map(|c| bytes_to_rstring(&ruby, c))
             .ok_or_else(|| {
-                Error::new(
-                    exception::index_error(),
+                crate::util::index_error(
                     format!("certificate index {index} out of range"),
+                    "SignedData.certificate_at",
+                    Some(index as u64),
                 )
             })
     }
@@ -294,8 +290,8 @@ impl SignedData {
             } else {
                 Err(format!("unsupported signature algorithm OID: {oid}"))
             }
-        }).map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
-        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        }).map_err(|e| crate::util::runtime(e.to_string()))?;
+        let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
         Ok(ruby.obj_wrap(CmsVerificationResult { inner: result }))
     }
 }
@@ -349,7 +345,7 @@ pub struct CertWrapper {
 
 impl CertWrapper {
     fn bytes(&self) -> Result<RString, Error> {
-        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
         Ok(bytes_to_rstring(&ruby, &self.bytes))
     }