confium 0.5.0 → 0.6.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +57 -0
- data/Cargo.lock +655 -108
- data/ext/confium_native/Cargo.toml +17 -1
- data/ext/confium_native/extconf.rb +5 -0
- data/ext/confium_native/src/lib.rs +4 -0
- data/ext/confium_native/src/openpgp_verify.rs +189 -0
- data/ext/confium_native/src/pki.rs +7 -5
- data/lib/confium/audit/otlp_sink.rb +23 -6
- data/lib/confium/native_windows.rb +31 -0
- data/lib/confium/tc/coordinator.rb +24 -36
- data/lib/confium/tc/signing_session.rb +93 -0
- data/lib/confium/tc.rb +4 -6
- data/lib/confium/version.rb +1 -1
- data/lib/confium.rb +5 -16
- metadata +5 -9
- data/lib/confium/cfm.rb +0 -23
- data/lib/confium/crypto.rb +0 -51
- data/lib/confium/digest.rb +0 -62
- data/lib/confium/ffi.rb +0 -23
- data/lib/confium/lib.rb +0 -33
- data/lib/confium/tc/session.rb +0 -51
- data/lib/confium/tc/session_stub.rb +0 -43
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 8d42dc62222d0c92dfa68876099cbac875766094cd9220c4ec10d5b6f605cd09
|
|
4
|
+
data.tar.gz: 940eae5a8b8e090a5a1638885dc3bc3b4c9663deaa084dfed0852064432ee141
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 04b73aaa3d4adf174c0c36af482de3b64d0e8ecaca91793a7996c04a50f78e8778189958697e4dc9a813f82d65c39ed36465871972584f03b509e3129c9242ef
|
|
7
|
+
data.tar.gz: 0f2ee3e4d4d51958e278733bd3c7ee8160b9fea55d2073ca23ec88c321923c768469be5517d690b94d9308f8a85301389310c7591fbed934ee66d4a893c22f2c
|
data/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,62 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## [0.6.1] — 2026-08-25
|
|
4
|
+
|
|
5
|
+
### Changed
|
|
6
|
+
|
|
7
|
+
- `Confium::PKI::Certificate.from_der` / `Csr.from_der` now report
|
|
8
|
+
the exact byte offset where truncated DER decoding failed
|
|
9
|
+
(`Confium::ParseError#offset` was always nil for certificate DER —
|
|
10
|
+
the number now crosses from the `der` decoder through
|
|
11
|
+
confium-pki). Requires and bumps confium-pki to 0.5.
|
|
12
|
+
|
|
13
|
+
## [0.6.0] — 2026-08-25
|
|
14
|
+
|
|
15
|
+
### Removed
|
|
16
|
+
|
|
17
|
+
- The orphaned C-ABI layer: `Confium::Lib`, `Confium::CFM`,
|
|
18
|
+
`Confium::FFI`, `Confium::Digest`, `Confium::Crypto`,
|
|
19
|
+
`Confium::TC::Session` (the C-ABI wrapper) and
|
|
20
|
+
`Confium::TC::SessionStub`. None of these were loaded by the gem,
|
|
21
|
+
none worked — they called `Confium::call_ffi`, a method that never
|
|
22
|
+
existed (the RBS carried a phantom declaration only to keep the
|
|
23
|
+
type checker green over them). The magnus extension is the only
|
|
24
|
+
binding layer; see docs/adr/0005.
|
|
25
|
+
|
|
26
|
+
### Changed
|
|
27
|
+
|
|
28
|
+
- The native-extension ABI-window resolution moved out of
|
|
29
|
+
`lib/confium.rb` into `Confium::NativeWindows.candidates` — a pure
|
|
30
|
+
function now spec'd for every minor plus the cross-major edges
|
|
31
|
+
(this decision produced three release incidents; it was previously
|
|
32
|
+
testable only by installing eight platform gems).
|
|
33
|
+
- `Confium::TC` session semantics moved into a deep
|
|
34
|
+
`Confium::TC::SigningSession` (state machine, per-signer dedup,
|
|
35
|
+
CMP20/GG18 combine); `Coordinator` (in-process) and
|
|
36
|
+
`NetworkCoordinator` (TCP) are now adapters over it. Behavior
|
|
37
|
+
changes from the old inline session Hashes: duplicate
|
|
38
|
+
commitments/shares from the same signer raise
|
|
39
|
+
`Confium::ValidationError` instead of counting twice toward the
|
|
40
|
+
threshold (a one-signer quorum spoof), and unknown session ids
|
|
41
|
+
raise `Confium::NotFoundError` instead of a bare `RuntimeError`.
|
|
42
|
+
|
|
43
|
+
### Added
|
|
44
|
+
|
|
45
|
+
- `Confium::Audit::OtlpSink` retries failed deliveries with
|
|
46
|
+
exponential backoff (`retries:`, `retry_base:` — 2 retries at
|
|
47
|
+
100 ms base by default) before dropping a record. Telemetry
|
|
48
|
+
outages still never break signing; a flaky collector now
|
|
49
|
+
survives single failures.
|
|
50
|
+
- **Opt-in OpenPGP signature verification** — `Confium::OpenPGP.verify_detached`
|
|
51
|
+
and `Confium::OpenPGP.verify` (inline/clearsigned), backed by a vendored
|
|
52
|
+
librnp behind the `pgp` cargo feature. Public-key material is passed with
|
|
53
|
+
the call (String or Array). Platform gems keep building default features:
|
|
54
|
+
`Confium::OpenPGP::PGP_AVAILABLE` reports `false` there and the verify
|
|
55
|
+
methods raise with rebuild instructions (`RB_SYS_CARGO_FEATURES=pgp
|
|
56
|
+
bundle exec rake compile`). Armor stays pure Ruby and always available.
|
|
57
|
+
CI gains a `pgp-verify` job that compiles the feature and exercises the
|
|
58
|
+
real verification path against checked-in gpg-generated fixtures.
|
|
59
|
+
|
|
3
60
|
## [0.5.0] — 2026-08-24
|
|
4
61
|
|
|
5
62
|
### Added
|