confium 0.3.4 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fdc8059371955b1e4ee89982856fb39a1fb758c9d1b3264bb2f3bd21fe77c028
-  data.tar.gz: a392f2b3d8b87e4d296f5f68dec94e61ae3e2263eea032f12240b2f625b7ba56
+  metadata.gz: 322f29b8f4f4e0ad02bec82cbb5a99ea45852fc618f09344c35fb1d42319afbb
+  data.tar.gz: e1050278065503030b8f82dd10047eda3363ac3b875456cfe7b2c2ce17573975
 SHA512:
-  metadata.gz: ccdae726768ecf965b3f21f000b42bbc7c67a01b31d7715a2f23f0e243873453da7539ae57fbfb0ffda185d3ea572b74d0f3c033518e1e154fdc0b739db0b1b1
-  data.tar.gz: db63f19d08cf86076df52ec0f583493019e03a1512268aa1d83b56edce182d42c18120369e46ca054e66dfdf79619b04fdfe91175607845260cc668894fa680d
+  metadata.gz: 7cdc24b0b728d4f8afc59d6f5e63e9f4a4c328aab34dca675b51391f340699b33b9d216baf2c433bac7fe6ee29f24aca134323b8cda0c5904b498621debd82ed
+  data.tar.gz: 71a1d6c636f88a80f31bcd7682cfc6762d99882a3eeed12ba5315ce81225068e280069a3ab2a3b2378d30abc928842c9561cf451ddfeda2038dda94768525ab7

data/CHANGELOG.md

@@ -1,5 +1,30 @@
 # Changelog
 
+## [0.4.0] — 2026-08-23
+
+### Changed
+
+- **The native extension is pure Rust — the vendored RNP stack
+  (librnp + Botan + json-c, a full C/C++ build) is gone.** It was
+  compiled into every install but used only for ASCII armor, which
+  is now implemented in pure Ruby (RFC 9580 §6, byte-for-byte
+  compatible with the previous output; differential vectors in
+  spec/fixtures/openpgp_armor_vectors.json). Source builds now need
+  only a Rust toolchain — no C compiler, no cmake, and no network
+  fetch of C sources — and compile in ~2 minutes instead of ~15.
+
+### Added
+
+- **Windows (`x64-mingw-ucrt`) and musl Linux
+  (`x86_64-linux-musl`, `aarch64-linux-musl`) platform gems**,
+  unblocked by the dependency removal: pure Rust builds natively
+  under mingw and in Alpine containers (aarch64 under QEMU). All
+  are install-checked on every supported Ruby before publishing,
+  and Windows joins the test matrix.
+- `Confium::OpenPGP.dearmor` now verifies the CRC-24 checksum and
+  raises `Confium::ParseError` on malformed blocks (previously a
+  bare rnp failure).
+
 ## [0.3.4] — 2026-08-23
 
 ### Fixed

data/Cargo.lock

@@ -2,12 +2,6 @@
 # It is not intended for manual editing.
 version = 4
 
-[[package]]
-name = "adler2"
-version = "2.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
-
 [[package]]
 name = "aead"
 version = "0.5.2"
@@ -79,12 +73,6 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf"
 
-[[package]]
-name = "base64"
-version = "0.22.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
-
 [[package]]
 name = "base64ct"
 version = "1.8.3"
@@ -101,8 +89,6 @@ dependencies = [
  "cexpr",
  "clang-sys",
  "itertools",
- "log",
- "prettyplease",
  "proc-macro2",
  "quote",
  "regex",
@@ -138,29 +124,12 @@ dependencies = [
  "generic-array",
 ]
 
-[[package]]
-name = "botan-src"
-version = "0.31200.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dce062ff9328d757ea205177cab939e6ce2aeb7a64bb559263fbe9251c5b1f5b"
-dependencies = [
- "lzma-rs",
- "sha2",
- "tar",
-]
-
 [[package]]
 name = "bumpalo"
 version = "3.20.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
 
-[[package]]
-name = "byteorder"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
-
 [[package]]
 name = "bytes"
 version = "1.12.1"
@@ -227,15 +196,6 @@ dependencies = [
  "libloading",
 ]
 
-[[package]]
-name = "cmake"
-version = "0.1.58"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0f78a02292a74a88ac736019ab962ece0bc380e3f977bf72e376c5d78ff0678"
-dependencies = [
- "cc",
-]
-
 [[package]]
 name = "confium-api"
 version = "0.3.0"
@@ -294,7 +254,7 @@ dependencies = [
  "serde",
  "serde_json",
  "sha2",
- "snafu 0.8.9",
+ "snafu",
  "thiserror",
  "tracing",
  "zeroize",
@@ -310,7 +270,7 @@ dependencies = [
  "inventory",
  "libloading",
  "rand",
- "snafu 0.8.9",
+ "snafu",
  "zeroize",
 ]
 
@@ -363,7 +323,7 @@ dependencies = [
  "data-encoding",
  "serde",
  "serde_json",
- "snafu 0.8.9",
+ "snafu",
  "thiserror",
  "toml",
  "url",
@@ -388,7 +348,7 @@ checksum = "98a17fd08f3f04772fa0227e0855d38d7de0637996fb44e058da098e069fab28"
 dependencies = [
  "confium-api",
  "inventory",
- "snafu 0.8.9",
+ "snafu",
  "url",
 ]
 
@@ -419,7 +379,7 @@ dependencies = [
  "serde",
  "serde_json",
  "sha2",
- "snafu 0.8.9",
+ "snafu",
  "spki",
  "thiserror",
  "x509-cert",
@@ -453,7 +413,7 @@ checksum = "66f760cf6182b532f7746b95842e2b4599ab78a5bbe35af2992df309417e5975"
 dependencies = [
  "confium-api",
  "inventory",
- "snafu 0.8.9",
+ "snafu",
 ]
 
 [[package]]
@@ -482,7 +442,7 @@ dependencies = [
  "serde",
  "serde_json",
  "sha2",
- "snafu 0.8.9",
+ "snafu",
  "subtle",
  "thiserror",
  "tracing",
@@ -507,7 +467,7 @@ dependencies = [
  "p256",
  "rand",
  "sha2",
- "snafu 0.8.9",
+ "snafu",
  "zeroize",
 ]
 
@@ -530,7 +490,7 @@ dependencies = [
  "serde",
  "serde_json",
  "sha2",
- "snafu 0.8.9",
+ "snafu",
  "subtle",
  "thiserror",
  "tracing",
@@ -579,7 +539,7 @@ dependencies = [
  "inventory",
  "p256",
  "sha2",
- "snafu 0.8.9",
+ "snafu",
  "zeroize",
 ]
 
@@ -613,7 +573,7 @@ dependencies = [
  "serde",
  "serde_json",
  "sha2",
- "snafu 0.8.9",
+ "snafu",
  "thiserror",
 ]
 
@@ -644,7 +604,6 @@ dependencies = [
  "p256",
  "rand_core",
  "rb-sys",
- "rnp-rs",
  "serde_json",
  "sha2",
  "subtle",
@@ -671,30 +630,6 @@ dependencies = [
  "libc",
 ]
 
-[[package]]
-name = "crc"
-version = "3.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5eb8a2a1cd12ab0d987a5d5e825195d372001a4094a0376319d5a0ad71c1ba0d"
-dependencies = [
- "crc-catalog",
-]
-
-[[package]]
-name = "crc-catalog"
-version = "2.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "217698eaf96b4a3f0bc4f3662aaa55bdf913cd54d7204591faa790070c6d0853"
-
-[[package]]
-name = "crc32fast"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9481c1c90cbf2ac953f07c8d4a58aa3945c425b7185c9154d67a65e4230da511"
-dependencies = [
- "cfg-if",
-]
-
 [[package]]
 name = "crypto-bigint"
 version = "0.5.5"
@@ -880,16 +815,6 @@ version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
 
-[[package]]
-name = "errno"
-version = "0.3.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
-dependencies = [
- "libc",
- "windows-sys 0.61.2",
-]
-
 [[package]]
 name = "ff"
 version = "0.13.1"
@@ -906,16 +831,6 @@ version = "0.2.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
 
-[[package]]
-name = "filetime"
-version = "0.2.29"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c287a33c7f0a620c38e641e7f60827713987b3c0f26e8ddc9462cc69cf75759"
-dependencies = [
- "cfg-if",
- "libc",
-]
-
 [[package]]
 name = "find-msvc-tools"
 version = "0.1.9"
@@ -928,16 +843,6 @@ version = "0.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b7ac824320a75a52197e8f2d787f6a38b6718bb6897a35142d749af3c0e8f4fe"
 
-[[package]]
-name = "flate2"
-version = "1.1.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c"
-dependencies = [
- "crc32fast",
- "miniz_oxide",
-]
-
 [[package]]
 name = "foldhash"
 version = "0.1.5"
@@ -1070,22 +975,6 @@ dependencies = [
  "digest",
 ]
 
-[[package]]
-name = "http"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "918d3568bebf352712bc2ef3d46a8bcf1a75b373be6539de198e9105cbbf9ce0"
-dependencies = [
- "bytes",
- "itoa",
-]
-
-[[package]]
-name = "httparse"
-version = "1.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
-
 [[package]]
 name = "iana-time-zone"
 version = "0.1.65"
@@ -1289,12 +1178,6 @@ dependencies = [
  "windows-link",
 ]
 
-[[package]]
-name = "linux-raw-sys"
-version = "0.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
-
 [[package]]
 name = "litemap"
 version = "0.8.2"
@@ -1316,16 +1199,6 @@ dependencies = [
  "hashbrown 0.15.5",
 ]
 
-[[package]]
-name = "lzma-rs"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "297e814c836ae64db86b36cf2a557ba54368d03f6afcd7d947c266692f71115e"
-dependencies = [
- "byteorder",
- "crc",
-]
-
 [[package]]
 name = "magnus"
 version = "0.8.2"
@@ -1362,16 +1235,6 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
 
-[[package]]
-name = "miniz_oxide"
-version = "0.8.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
-dependencies = [
- "adler2",
- "simd-adler32",
-]
-
 [[package]]
 name = "nom"
 version = "7.1.3"
@@ -1494,12 +1357,6 @@ dependencies = [
  "spki",
 ]
 
-[[package]]
-name = "pkg-config"
-version = "0.3.33"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
-
 [[package]]
 name = "polyval"
 version = "0.6.2"
@@ -1530,16 +1387,6 @@ dependencies = [
  "zerocopy",
 ]
 
-[[package]]
-name = "prettyplease"
-version = "0.2.37"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
-dependencies = [
- "proc-macro2",
- "syn 2.0.119",
-]
-
 [[package]]
 name = "primeorder"
 version = "0.13.6"
@@ -1673,45 +1520,6 @@ dependencies = [
  "subtle",
 ]
 
-[[package]]
-name = "ring"
-version = "0.17.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
-dependencies = [
- "cc",
- "cfg-if",
- "getrandom",
- "libc",
- "untrusted",
- "windows-sys 0.52.0",
-]
-
-[[package]]
-name = "rnp-rs"
-version = "0.1.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a2d89cee37da7283f21f7856fca63727d5e50d2d150d8f8b124d4fcd8c6a60b"
-dependencies = [
- "bindgen",
- "pkg-config",
- "rnp-src",
- "snafu 0.9.2",
-]
-
-[[package]]
-name = "rnp-src"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "852eede0415d60b1b5b586a330b94ce014bd83df69f7388205f8cfee62840f49"
-dependencies = [
- "botan-src",
- "cmake",
- "flate2",
- "tar",
- "ureq",
-]
-
 [[package]]
 name = "rustc-hash"
 version = "2.1.3"
@@ -1727,54 +1535,6 @@ dependencies = [
  "semver",
 ]
 
-[[package]]
-name = "rustix"
-version = "1.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
-dependencies = [
- "bitflags",
- "errno",
- "libc",
- "linux-raw-sys",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "rustls"
-version = "0.23.43"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06"
-dependencies = [
- "log",
- "once_cell",
- "ring",
- "rustls-pki-types",
- "rustls-webpki",
- "subtle",
- "zeroize",
-]
-
-[[package]]
-name = "rustls-pki-types"
-version = "1.15.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f4925028c7eb5d1fcdaf196971378ed9d2c1c4efc7dc5d011256f76c99c0a96"
-dependencies = [
- "zeroize",
-]
-
-[[package]]
-name = "rustls-webpki"
-version = "0.103.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
-dependencies = [
- "ring",
- "rustls-pki-types",
- "untrusted",
-]
-
 [[package]]
 name = "rustversion"
 version = "1.0.23"
@@ -1920,12 +1680,6 @@ dependencies = [
  "rand_core",
 ]
 
-[[package]]
-name = "simd-adler32"
-version = "0.3.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a219298ac11a56ea9a6d2120044824d6f01aeb034955e7af7bc16858527deea"
-
 [[package]]
 name = "slab"
 version = "0.4.12"
@@ -1944,16 +1698,7 @@ version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6e84b3f4eacbf3a1ce05eac6763b4d629d60cbc94d632e4092c54ade71f1e1a2"
 dependencies = [
- "snafu-derive 0.8.9",
-]
-
-[[package]]
-name = "snafu"
-version = "0.9.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e45cb604038abb7b926b679887b3226d8d0f23874b66623625a0454be425a4b7"
-dependencies = [
- "snafu-derive 0.9.2",
+ "snafu-derive",
 ]
 
 [[package]]
@@ -1968,18 +1713,6 @@ dependencies = [
  "syn 2.0.119",
 ]
 
-[[package]]
-name = "snafu-derive"
-version = "0.9.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "287f59010008f0d7cf5e3b03196d666c1acc46c8d3e9cf34c28a1a7157601e72"
-dependencies = [
- "heck",
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
 [[package]]
 name = "spki"
 version = "0.7.3"
@@ -2041,17 +1774,6 @@ version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "55937e1799185b12863d447f42597ed69d9928686b8d88a1df17376a097d8369"
 
-[[package]]
-name = "tar"
-version = "0.4.46"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f6221d9a6003c78398e3b239969f352578258df48c8eb051caadae0015bc840"
-dependencies = [
- "filetime",
- "libc",
- "xattr",
-]
-
 [[package]]
 name = "thiserror"
 version = "1.0.69"
@@ -2197,41 +1919,6 @@ dependencies = [
  "subtle",
 ]
 
-[[package]]
-name = "untrusted"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
-
-[[package]]
-name = "ureq"
-version = "3.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dea7109cdcd5864d4eeb1b58a1648dc9bf520360d7af16ec26d0a9354bafcfc0"
-dependencies = [
- "base64",
- "flate2",
- "log",
- "percent-encoding",
- "rustls",
- "rustls-pki-types",
- "ureq-proto",
- "utf8-zero",
- "webpki-roots",
-]
-
-[[package]]
-name = "ureq-proto"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e994ba84b0bd1b1b0cf92878b7ef898a5c1760108fe7b6010327e274917a808c"
-dependencies = [
- "base64",
- "http",
- "httparse",
- "log",
-]
-
 [[package]]
 name = "url"
 version = "2.5.8"
@@ -2244,12 +1931,6 @@ dependencies = [
  "serde",
 ]
 
-[[package]]
-name = "utf8-zero"
-version = "0.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8c0a043c9540bae7c578c88f91dda8bd82e59ae27c21baca69c8b191aaf5a6e"
-
 [[package]]
 name = "utf8_iter"
 version = "1.0.4"
@@ -2313,15 +1994,6 @@ dependencies = [
  "unicode-ident",
 ]
 
-[[package]]
-name = "webpki-roots"
-version = "1.0.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7dcd9d09a39985f5344844e66b0c530a33843579125f23e21e9f0f220850f22a"
-dependencies = [
- "rustls-pki-types",
-]
-
 [[package]]
 name = "windows-core"
 version = "0.62.2"
@@ -2381,88 +2053,6 @@ dependencies = [
  "windows-link",
 ]
 
-[[package]]
-name = "windows-sys"
-version = "0.52.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
-dependencies = [
- "windows-targets",
-]
-
-[[package]]
-name = "windows-sys"
-version = "0.61.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
-dependencies = [
- "windows-link",
-]
-
-[[package]]
-name = "windows-targets"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
-dependencies = [
- "windows_aarch64_gnullvm",
- "windows_aarch64_msvc",
- "windows_i686_gnu",
- "windows_i686_gnullvm",
- "windows_i686_msvc",
- "windows_x86_64_gnu",
- "windows_x86_64_gnullvm",
- "windows_x86_64_msvc",
-]
-
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
-
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
-
-[[package]]
-name = "windows_i686_gnu"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
-
-[[package]]
-name = "windows_i686_gnullvm"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
-
-[[package]]
-name = "windows_i686_msvc"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
-
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
-
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
-
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
-
 [[package]]
 name = "winnow"
 version = "0.7.15"
@@ -2501,16 +2091,6 @@ dependencies = [
  "tls_codec",
 ]
 
-[[package]]
-name = "xattr"
-version = "1.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32e45ad4206f6d2479085147f02bc2ef834ac85886624a23575ae137c8aa8156"
-dependencies = [
- "libc",
- "rustix",
-]
-
 [[package]]
 name = "yoke"
 version = "0.8.3"

data/README.adoc

@@ -10,7 +10,7 @@ Confium supports three deployment modes:
 * **Mode 2 — TC PKI replacement**: drop-in for existing PKI consumers (PKCS#11 server, OpenSSL 3.0 provider, JCE)
 * **Mode 3 — TC Certificate PKI**: institutional deployments with custom certificate formats (OIML CNML, BIPM, pharma, accreditation)
 
-This gem wraps the high-value Confium subsystems via a Rust native extension. Pre-compiled platform gems are published for Linux and macOS, so `gem install` needs no Rust toolchain there; other platforms build from source at install time with `rb_sys` + `magnus`. No separate C ABI library to install; everything is statically linked into the extension.
+This gem wraps the high-value Confium subsystems via a pure-Rust native extension (`rb_sys` + `magnus`, no C dependencies). Pre-compiled platform gems are published for Linux (glibc + musl), macOS, and Windows, so `gem install` needs no Rust toolchain there; other platforms build from source at install time.
 
 == Installation
 
@@ -32,17 +32,13 @@ $ gem install confium
 
 * Ruby ≥ 3.1
 * Nothing else on the pre-compiled platforms: `x86_64-linux`,
-  `aarch64-linux`, `x86_64-darwin`, `arm64-darwin` (each gem carries
-  one extension per Ruby C-ABI window)
+  `aarch64-linux`, `x86_64-linux-musl`, `aarch64-linux-musl`,
+  `x86_64-darwin`, `arm64-darwin`, `x64-mingw-ucrt` (each gem
+  carries one extension per Ruby C-ABI window)
 
 Source builds (other platforms, or installing from the repo) also
-need:
-
-* Rust stable toolchain (`rustup default stable`)
-* C toolchain (clang/gcc/Xcode CLT)
-
-There is no separate `libconfium` to install — the extension
-statically links everything.
+need the Rust stable toolchain (`rustup default stable`) — and
+nothing else: the extension has no C dependencies to satisfy.
 
 == Quick start
 

data/ext/confium_native/Cargo.toml

@@ -55,9 +55,5 @@ chrono = "0.4"
 hex = "0.4"
 serde_json = "1"
 
-# RNP (OpenPGP, RFC 9580) — hard-bundled with vendored feature so
-# librnp is compiled from source via rnp-src. No system librnp needed.
-rnp = { package = "rnp-rs", version = "0.1.10", features = ["vendored"] }
-
 [profile.release]
 lto = "off"

data/ext/confium_native/src/lib.rs

@@ -9,7 +9,6 @@ mod attributes;
 mod composite;
 mod deployment;
 mod ers;
-mod openpgp;
 mod path;
 mod pki;
 mod tc;
@@ -51,6 +50,5 @@ fn init(ruby: &Ruby) -> Result<(), Error> {
     tc::init(ruby, confium)?;
     audit::init(ruby, confium)?;
     ers::init(ruby, confium)?;
-    openpgp::init(ruby, confium)?;
     Ok(())
 }

data/lib/confium/openpgp.rb

@@ -1,33 +1,155 @@
 # frozen_string_literal: true
 
-# Confium::OpenPGP — OpenPGP (RFC 9580) via bundled rnp-rs.
-#
-# The native extension provides _native_armor / _native_dearmor.
-# This file adds the idiomatic Ruby wrappers with default args.
-#
-# Architecture: RNP is HARD-BUNDLED in the native extension. No
-# external gem dependency. Users get OpenPGP armor encode/decode
-# out of the box.
-
 module Confium
+  # OpenPGP ASCII armor (RFC 9580 §6) — Radix-64 framing with a
+  # CRC-24 checksum, implemented in pure Ruby.
+  #
+  # This replaced the earlier native wrapper around librnp, which
+  # pulled a full vendored Botan/json-c C/C++ build into every
+  # install just to do armor framing. The wire format is unchanged;
+  # spec/fixtures/openpgp_armor_vectors.json holds differential
+  # vectors captured from the native implementation.
   module OpenPGP
+    MESSAGE = 'message'
+    PUBLIC_KEY = 'public key'
+    SECRET_KEY = 'secret key'
+    SIGNATURE = 'signature'
+    CLEARTEXT = 'cleartext signed message'
+
+    LABELS = {
+      nil => 'MESSAGE',
+      MESSAGE => 'MESSAGE',
+      'public key' => 'PUBLIC KEY BLOCK',
+      SECRET_KEY => 'PRIVATE KEY BLOCK',
+      'private key' => 'PRIVATE KEY BLOCK',
+      SIGNATURE => 'SIGNATURE',
+      # Raw bytes cannot form a cleartext-signed message (that
+      # requires a signature packet); armor them as a plain message.
+      CLEARTEXT => 'MESSAGE',
+      'cleartext' => 'MESSAGE'
+    }.freeze
+
+    CRC_POLY = 0x1864CFB
+    CRC_INIT = 0xB704CE
+    B64_CHARS = [('A'..'Z').to_a, ('a'..'z').to_a, ('0'..'9').to_a, %w[+ /]].flatten.freeze
+    CRC_TABLE = (0..255).map do |i|
+      c = i << 16
+      8.times do
+        c = c.nobits?(0x800_000) ? c << 1 : ((c << 1) ^ CRC_POLY)
+        c &= 0xFFFFFF
+      end
+      c
+    end.freeze
+
+    private_constant :LABELS, :CRC_POLY, :CRC_INIT, :B64_CHARS, :CRC_TABLE
+
     class << self
-      # ASCII-armor encode raw bytes.
+      # ASCII-armor encode raw bytes. Output uses CRLF line endings
+      # and 76-character data lines, byte-for-byte matching the
+      # earlier native (rnp) implementation.
       #
       # @param data [String] Binary data to encode.
-      # @param type [String] Armor type — one of MESSAGE, PUBLIC_KEY,
-      #   SECRET_KEY, SIGNATURE, CLEARTEXT. Defaults to MESSAGE.
+      # @param type [String] One of MESSAGE, PUBLIC_KEY, SECRET_KEY,
+      #   SIGNATURE, CLEARTEXT (armored as a plain message). Defaults
+      #   to MESSAGE.
       # @return [String] Armored ASCII string.
+      # @raise [ArgumentError] if +type+ is not a known armor type.
       def armor(data, type = MESSAGE)
-        _native_armor(data, type)
+        label = LABELS[type]
+        raise ArgumentError, "unknown armor type: #{type.inspect}" unless label
+
+        bytes = data.to_s.b
+        b64 = [bytes].pack('m0')
+        lines = b64.scan(/.{1,76}/)
+        <<~ARMOR.gsub("\n", "\r\n")
+          -----BEGIN PGP #{label}-----
+
+          #{lines.join("\n")}
+          =#{crc24_armor(bytes)}
+          -----END PGP #{label}-----
+        ARMOR
       end
 
-      # Decode ASCII-armored data to raw bytes.
+      # Decode ASCII-armored data to raw bytes. Accepts LF or CRLF
+      # line endings, arbitrary line widths, and Armor Headers
+      # (Comment:, Version:, ...) between the BEGIN line and the
+      # blank line. The CRC-24 checksum line is verified when
+      # present.
       #
       # @param data [String] Armored ASCII string.
-      # @return [String] Raw binary data.
+      # @return [String] Raw binary data (ASCII-8BIT).
+      # @raise [Confium::ParseError] on missing delimiters, non-base64
+      #   content, or a CRC mismatch.
       def dearmor(data)
-        _native_dearmor(data)
+        b64, crc_line = extract_body(data.to_s)
+        # @type var bytes: String
+        bytes = b64.unpack1('m0')
+        return ''.b if crc_line == crc24_armor(''.b) && b64.empty?
+
+        raise ParseError, 'armor CRC-24 checksum mismatch' if crc_line && crc24_armor(bytes) != crc_line.to_s
+
+        bytes
+      end
+
+      private
+
+      # Locate the armored block, skip the BEGIN line and any Armor
+      # Headers, and split the remaining lines into the joined
+      # Radix-64 data and the checksum line (if present).
+      def extract_body(text)
+        lines = block_lines(text)
+        b64, crc_line = collect_data(lines)
+        raise ParseError, 'armored block has no data' if b64.empty? && crc_line.nil?
+
+        [b64, crc_line]
+      end
+
+      # The lines of the armored block between BEGIN and END, with
+      # the BEGIN line and any Armor Headers removed.
+      def block_lines(text)
+        slice = block_slice(text.gsub("\r\n", "\n"))
+        lines = slice.split("\n")
+        lines.shift # BEGIN
+        lines.shift while lines.first&.match?(/^\s|^[A-Za-z0-9-]+: /)
+        lines.shift if lines.first == ''
+        lines
+      end
+
+      # The text between the BEGIN and END delimiter lines.
+      def block_slice(normalized)
+        begin_line = normalized.index(/^-----BEGIN PGP [A-Z ]+-----$/)
+        raise ParseError, 'not an ASCII-armored block (no BEGIN line)' unless begin_line
+
+        end_match = normalized.match(/^-----END PGP [A-Z ]+-----$/)
+        raise ParseError, 'not an ASCII-armored block (no END line)' unless end_match
+
+        normalized[begin_line...end_match.begin(0)].to_s
+      end
+
+      def collect_data(lines)
+        b64 = +''
+        crc_line = nil
+        lines.each do |line|
+          next if line.empty?
+
+          if line.start_with?('=')
+            crc_line = line[1..]
+          elsif line.match?(%r{\A[A-Za-z0-9+/]+={0,2}\z})
+            b64 << line
+          else
+            raise ParseError, "invalid armor data line: #{line[0, 20].inspect}"
+          end
+        end
+        [b64, crc_line]
+      end
+
+      # CRC-24 (RFC 9580 §6.1), encoded as the four Radix-64
+      # characters of the 24-bit value as three big-endian bytes.
+      def crc24_armor(bytes)
+        crc = CRC_INIT
+        bytes.each_byte { |b| crc = ((crc << 8) & 0xFFFFFF) ^ CRC_TABLE[((crc >> 16) ^ b) & 0xFF] }
+        three_bytes = [crc >> 16, (crc >> 8) & 0xFF, crc & 0xFF].pack('C3')
+        [three_bytes].pack('m0')
       end
     end
   end

data/lib/confium/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Confium
-  VERSION = '0.3.4'
+  VERSION = '0.4.0'
 end

data/lib/confium.rb

@@ -22,6 +22,13 @@ begin
   begin
     require_relative "confium_native/#{window}/confium_native"
   rescue LoadError
+    # Fall back to the flat source-build path only when the windowed
+    # binary is absent; a present-but-unloadable binary must raise its
+    # real dlopen error instead of masquerading as "not built".
+    dlext = RbConfig::CONFIG['DLEXT'] || 'so'
+    windowed = File.expand_path("confium_native/#{window}/confium_native.#{dlext}", __dir__ || '.')
+    raise if File.exist?(windowed)
+
     require_relative 'confium_native/confium_native'
   end
 rescue LoadError => e

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: confium
 version: !ruby/object:Gem::Version
-  version: 0.3.4
+  version: 0.4.0
 platform: ruby
 authors:
 - Ribose Open
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-08-23 00:00:00.000000000 Z
+date: 2026-08-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rb_sys
@@ -121,7 +121,6 @@ files:
 - ext/confium_native/src/deployment.rs
 - ext/confium_native/src/ers.rs
 - ext/confium_native/src/lib.rs
-- ext/confium_native/src/openpgp.rs
 - ext/confium_native/src/path.rs
 - ext/confium_native/src/pki.rs
 - ext/confium_native/src/tc.rs

data/ext/confium_native/src/openpgp.rs

@@ -1,55 +0,0 @@
-//! Confium::OpenPGP — OpenPGP (RFC 9580) operations via bundled rnp-rs.
-//!
-//! Confium ships RNP functionality baked into the native extension.
-
-use magnus::{function, prelude::*, Error, Module, RModule, Ruby, TryConvert, Value};
-use rnp::ops::ArmorType;
-use rnp::{armor_bytes, dearmor_bytes};
-
-use crate::util::{bytes_from_value, bytes_to_rstring};
-
-/// Native: `Confium::OpenPGP._native_armor(data, type_str)` — 2 args.
-/// The Ruby wrapper `Confium::OpenPGP.armor(data, type = MESSAGE)`
-/// provides the default.
-fn native_armor(ruby: &Ruby, data: Value, type_str: Value) -> Result<magnus::RString, Error> {
-    let bytes = bytes_from_value(data)?;
-    let ty = if type_str.is_nil() {
-        ArmorType::Message
-    } else {
-        let s: String = TryConvert::try_convert(type_str)?;
-        match s.as_str() {
-            "public key" => ArmorType::PublicKey,
-            "secret key" => ArmorType::SecretKey,
-            "signature" => ArmorType::Signature,
-            "cleartext signed message" | "cleartext" => ArmorType::Cleartext,
-            _ => ArmorType::Message,
-        }
-    };
-    let armored = armor_bytes(&bytes, ty)
-        .map_err(|e| crate::util::parse_error(e.to_string(), "OpenPGP.armor", Some("openpgp"), None))?;
-    Ok(bytes_to_rstring(ruby, &armored))
-}
-
-/// Native: `Confium::OpenPGP._native_dearmor(data)` — 1 arg.
-fn native_dearmor(ruby: &Ruby, data: Value) -> Result<magnus::RString, Error> {
-    let bytes = bytes_from_value(data)?;
-    let raw = dearmor_bytes(&bytes)
-        .map_err(|e| crate::util::parse_error(e.to_string(), "OpenPGP.dearmor", Some("openpgp"), None))?;
-    Ok(bytes_to_rstring(ruby, &raw))
-}
-
-/// Initialize the `Confium::OpenPGP` module.
-pub fn init(_ruby: &Ruby, parent: RModule) -> Result<(), Error> {
-    let openpgp = parent.define_module("OpenPGP")?;
-
-    openpgp.define_singleton_method("_native_armor", function!(native_armor, 2))?;
-    openpgp.define_singleton_method("_native_dearmor", function!(native_dearmor, 1))?;
-
-    openpgp.const_set("MESSAGE", "message")?;
-    openpgp.const_set("PUBLIC_KEY", "public key")?;
-    openpgp.const_set("SECRET_KEY", "secret key")?;
-    openpgp.const_set("SIGNATURE", "signature")?;
-    openpgp.const_set("CLEARTEXT", "cleartext signed message")?;
-
-    Ok(())
-}