confium 0.4.1-aarch64-linux → 0.6.0-aarch64-linux
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +84 -0
- data/Cargo.lock +432 -12
- data/lib/confium/audit/otlp_sink.rb +120 -0
- data/lib/confium/audit.rb +2 -0
- data/lib/confium/composite.rb +39 -1
- data/lib/confium/native_windows.rb +31 -0
- data/lib/confium/tc/coordinator.rb +28 -27
- data/lib/confium/tc/network_coordinator.rb +208 -0
- data/lib/confium/tc/signing_session.rb +93 -0
- data/lib/confium/tc.rb +7 -2
- data/lib/confium/version.rb +1 -1
- data/lib/confium.rb +10 -16
- data/lib/confium_native/3.1/confium_native.so +0 -0
- data/lib/confium_native/3.2/confium_native.so +0 -0
- data/lib/confium_native/3.3/confium_native.so +0 -0
- data/lib/confium_native/3.4/confium_native.so +0 -0
- data/lib/confium_native/4.0/confium_native.so +0 -0
- metadata +8 -9
- data/lib/confium/cfm.rb +0 -23
- data/lib/confium/crypto.rb +0 -51
- data/lib/confium/digest.rb +0 -62
- data/lib/confium/ffi.rb +0 -23
- data/lib/confium/lib.rb +0 -33
- data/lib/confium/tc/session.rb +0 -51
- data/lib/confium/tc/session_stub.rb +0 -43
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 7f7860f68c924e3095658dfccdb3e86052c8fc458a48f0ad55ac12d516125665
|
|
4
|
+
data.tar.gz: ad8d9ef808e733a2b46ee0f218899a57b6dff4cd31f7dbf47edf68130a7ffb6d
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: aa762d887b197894e3c7c0b3b923589aeab71ca72c8842a2715ab3eb20d500594cf9d15c2faf6bd41a9e929f0ae948390a2b5ec1c81ff7ccd8383236af744ca2
|
|
7
|
+
data.tar.gz: 8f85c2feb61f7d4e4979f6222cd2a2e6633acda44a5d0151d2aa7ec50cf785e827647d3cd61a2db23f62f5763acdafce68aaf63f4693a0c089feae2b061e77a8
|
data/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,89 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## [0.6.0] — 2026-08-25
|
|
4
|
+
|
|
5
|
+
### Removed
|
|
6
|
+
|
|
7
|
+
- The orphaned C-ABI layer: `Confium::Lib`, `Confium::CFM`,
|
|
8
|
+
`Confium::FFI`, `Confium::Digest`, `Confium::Crypto`,
|
|
9
|
+
`Confium::TC::Session` (the C-ABI wrapper) and
|
|
10
|
+
`Confium::TC::SessionStub`. None of these were loaded by the gem,
|
|
11
|
+
none worked — they called `Confium::call_ffi`, a method that never
|
|
12
|
+
existed (the RBS carried a phantom declaration only to keep the
|
|
13
|
+
type checker green over them). The magnus extension is the only
|
|
14
|
+
binding layer; see docs/adr/0005.
|
|
15
|
+
|
|
16
|
+
### Changed
|
|
17
|
+
|
|
18
|
+
- The native-extension ABI-window resolution moved out of
|
|
19
|
+
`lib/confium.rb` into `Confium::NativeWindows.candidates` — a pure
|
|
20
|
+
function now spec'd for every minor plus the cross-major edges
|
|
21
|
+
(this decision produced three release incidents; it was previously
|
|
22
|
+
testable only by installing eight platform gems).
|
|
23
|
+
- `Confium::TC` session semantics moved into a deep
|
|
24
|
+
`Confium::TC::SigningSession` (state machine, per-signer dedup,
|
|
25
|
+
CMP20/GG18 combine); `Coordinator` (in-process) and
|
|
26
|
+
`NetworkCoordinator` (TCP) are now adapters over it. Behavior
|
|
27
|
+
changes from the old inline session Hashes: duplicate
|
|
28
|
+
commitments/shares from the same signer raise
|
|
29
|
+
`Confium::ValidationError` instead of counting twice toward the
|
|
30
|
+
threshold (a one-signer quorum spoof), and unknown session ids
|
|
31
|
+
raise `Confium::NotFoundError` instead of a bare `RuntimeError`.
|
|
32
|
+
|
|
33
|
+
### Added
|
|
34
|
+
|
|
35
|
+
- `Confium::Audit::OtlpSink` retries failed deliveries with
|
|
36
|
+
exponential backoff (`retries:`, `retry_base:` — 2 retries at
|
|
37
|
+
100 ms base by default) before dropping a record. Telemetry
|
|
38
|
+
outages still never break signing; a flaky collector now
|
|
39
|
+
survives single failures.
|
|
40
|
+
- **Opt-in OpenPGP signature verification** — `Confium::OpenPGP.verify_detached`
|
|
41
|
+
and `Confium::OpenPGP.verify` (inline/clearsigned), backed by a vendored
|
|
42
|
+
librnp behind the `pgp` cargo feature. Public-key material is passed with
|
|
43
|
+
the call (String or Array). Platform gems keep building default features:
|
|
44
|
+
`Confium::OpenPGP::PGP_AVAILABLE` reports `false` there and the verify
|
|
45
|
+
methods raise with rebuild instructions (`RB_SYS_CARGO_FEATURES=pgp
|
|
46
|
+
bundle exec rake compile`). Armor stays pure Ruby and always available.
|
|
47
|
+
CI gains a `pgp-verify` job that compiles the feature and exercises the
|
|
48
|
+
real verification path against checked-in gpg-generated fixtures.
|
|
49
|
+
|
|
50
|
+
## [0.5.0] — 2026-08-24
|
|
51
|
+
|
|
52
|
+
### Added
|
|
53
|
+
|
|
54
|
+
- **Ruby 4.0 support** — Windows ships an exact `4.0` ABI window;
|
|
55
|
+
every platform install-checks on Ruby 4.0; the test matrix gains
|
|
56
|
+
4.0 legs. (There is no Ruby 3.5 — 4.0 is the successor line.)
|
|
57
|
+
- **Multi-host threshold signing**: `Confium::TC::NetworkCoordinator`
|
|
58
|
+
(TCP service, NDJSON + hex wire protocol) + `Confium::TC::SignerClient`
|
|
59
|
+
— signers on separate machines submit commitments and shares;
|
|
60
|
+
aggregation runs the real CMP20/GG18 combine and returns an
|
|
61
|
+
OpenSSL-verifiable signature. Plain TCP for loopback/private
|
|
62
|
+
networks; the upstream noise transport replaces it later.
|
|
63
|
+
- **OpenTelemetry export**: `Confium::Audit::OtlpSink` ships every
|
|
64
|
+
audit record to an OTLP collector over OTLP/HTTP JSON (logs
|
|
65
|
+
signal, stdlib-only, failures drop-and-report).
|
|
66
|
+
- `Confium::Composite::Signature#to_json` — instances remember their
|
|
67
|
+
source (components or a canonical JSON document) and re-serialize
|
|
68
|
+
losslessly, completing the JSON transport symmetry.
|
|
69
|
+
|
|
70
|
+
### Fixed
|
|
71
|
+
|
|
72
|
+
- `Confium::TC::Coordinator` now aggregates REAL threshold-ECDSA
|
|
73
|
+
signatures: once the threshold is met, it runs the CMP20 or GG18
|
|
74
|
+
combine (selected per session via `scheme:`) and returns a 64-byte
|
|
75
|
+
signature verifiable under the quorum public key. Previously
|
|
76
|
+
`aggregate` concatenated the share bytes — a placeholder that
|
|
77
|
+
returned garbage. Unknown sessions below-threshold now raise
|
|
78
|
+
`Confium::ThresholdError`.
|
|
79
|
+
- `Confium::TC::Coordinator` and `ShareFile` were unreachable after
|
|
80
|
+
`require "confium"`: the TC namespace file that registers them
|
|
81
|
+
never loaded because the native extension pre-defines
|
|
82
|
+
`Confium::TC` (the same orphaned-module trap PKI had). The
|
|
83
|
+
namespace file is now eager-required; `TC::Session` stays lazy —
|
|
84
|
+
it wraps the engine via FFI and needs the external libconfium
|
|
85
|
+
dylib.
|
|
86
|
+
|
|
3
87
|
## [0.4.1] — 2026-08-24
|
|
4
88
|
|
|
5
89
|
### Fixed
|