confium 0.6.0 → 0.6.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '054208fb4ca092a7a6bcf862044fe1e7b8a771b385d259f9e1bce666e961a5de'
-  data.tar.gz: '06659a4ae641e21b6dad9e2de65ce135a9ae0b045d02a825ee313c7786b53e9a'
+  metadata.gz: 922db9bc620ddee90ba36a32d0c01d7a50dc13d685af98651288d7c913333af6
+  data.tar.gz: a46a79237e9b643fd31ee0e1f9fcfdf0df3a1d3f846f7f66bf22273394029944
 SHA512:
-  metadata.gz: 9da609aa1326f9449aa69cc318f87d57ea725ad234f963b228261161a1b4ea5421e49d2313262676da31c2faf3ea5fb2fc5a71fbd812a6708a89b5435f2546d5
-  data.tar.gz: 77c4e2fbb644fb96557b2e87d02c38d482b0bbaa03c16469259e98c6d47b07495047803c391e3f09b9d66c687c39dee95ffd043725863bf072167cd90422c41e
+  metadata.gz: 84d6d5f4c7822d46d7f96fbc0d25800de7fd6d9548542c4deb8f219ec291750d932d079211b9a2e6671aa998cb340b77a26bf1678aa6a7b94e33ecebf4f32fc0
+  data.tar.gz: 1f95d17bf74f58728e280ca052519a2538afd1ec530538fc1aa7ebb6bdce2e60dcf7bd4b9c170db572634a23622b5b228d810548e4c89bde2c624a02fc6beb6c

data/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## [0.6.2] — 2026-08-26
+
+### Added
+
+- `Confium::Store::Keystore` — Ruby surface for the store layer and
+  the sign-with-handle contract: `.new(backend, options)`,
+  `#sign(key_id, algorithm, message)` returning binary signature
+  bytes, plus `Confium::Store.backends`. Local backends raise a
+  typed `Confium::Error` for `#sign`; remote-holding backends (cloud
+  KMS) come via source builds that opt into their cargo features
+  (confium-store 0.5.8). `Confium::Error` now also accepts the
+  positional details-Hash form every typed subclass already accepts,
+  so native-constructed base errors carry `details` too.
+
+## [0.6.1] — 2026-08-25
+
+### Changed
+
+- `Confium::PKI::Certificate.from_der` / `Csr.from_der` now report
+  the exact byte offset where truncated DER decoding failed
+  (`Confium::ParseError#offset` was always nil for certificate DER —
+  the number now crosses from the `der` decoder through
+  confium-pki). Requires and bumps confium-pki to 0.5.
+
 ## [0.6.0] — 2026-08-25
 
 ### Removed

data/Cargo.lock

@@ -14,7 +14,7 @@ version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0"
 dependencies = [
- "crypto-common",
+ "crypto-common 0.1.7",
  "generic-array",
 ]
 
@@ -26,7 +26,7 @@ checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0"
 dependencies = [
  "cfg-if",
  "cipher",
- "cpufeatures",
+ "cpufeatures 0.2.17",
 ]
 
 [[package]]
@@ -138,6 +138,15 @@ dependencies = [
  "generic-array",
 ]
 
+[[package]]
+name = "block-buffer"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa"
+dependencies = [
+ "hybrid-array",
+]
+
 [[package]]
 name = "botan-src"
 version = "0.31200.0"
@@ -145,7 +154,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dce062ff9328d757ea205177cab939e6ce2aeb7a64bb559263fbe9251c5b1f5b"
 dependencies = [
  "lzma-rs",
- "sha2",
+ "sha2 0.10.9",
  "tar",
 ]
 
@@ -212,7 +221,7 @@ version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
 dependencies = [
- "crypto-common",
+ "crypto-common 0.1.7",
  "inout",
 ]
 
@@ -254,7 +263,7 @@ checksum = "7edc7e251d9a65d428e223ff795986e9983eff5430cc1029ddacc4451f26299a"
 dependencies = [
  "serde",
  "serde_json",
- "thiserror",
+ "thiserror 1.0.69",
 ]
 
 [[package]]
@@ -265,11 +274,11 @@ checksum = "317ed25adf9a1aad00722a215c3397dea694fcdf90730542e82acdea559644aa"
 dependencies = [
  "ed25519-dalek",
  "p256",
- "rand_core",
+ "rand_core 0.6.4",
  "serde",
  "serde_json",
- "sha2",
- "thiserror",
+ "sha2 0.10.9",
+ "thiserror 1.0.69",
 ]
 
 [[package]]
@@ -281,7 +290,7 @@ dependencies = [
  "chrono",
  "confium-api",
  "confium-net",
- "confium-store",
+ "confium-store 0.3.0",
  "confium-tc-core",
  "data-encoding",
  "hex",
@@ -290,12 +299,12 @@ dependencies = [
  "num-bigint",
  "num-traits",
  "p256",
- "rand_core",
+ "rand_core 0.6.4",
  "serde",
  "serde_json",
- "sha2",
+ "sha2 0.10.9",
  "snafu 0.8.9",
- "thiserror",
+ "thiserror 1.0.69",
  "tracing",
  "zeroize",
 ]
@@ -327,12 +336,12 @@ dependencies = [
  "num-traits",
  "p256",
  "rand",
- "rand_core",
+ "rand_core 0.6.4",
  "serde",
  "serde_json",
- "sha2",
+ "sha2 0.10.9",
  "subtle",
- "thiserror",
+ "thiserror 1.0.69",
 ]
 
 [[package]]
@@ -346,11 +355,11 @@ dependencies = [
  "num-bigint",
  "num-traits",
  "p256",
- "rand_core",
+ "rand_core 0.6.4",
  "serde",
  "serde_json",
- "sha2",
- "thiserror",
+ "sha2 0.10.9",
+ "thiserror 1.0.69",
 ]
 
 [[package]]
@@ -364,7 +373,7 @@ dependencies = [
  "serde",
  "serde_json",
  "snafu 0.8.9",
- "thiserror",
+ "thiserror 1.0.69",
  "toml",
  "url",
 ]
@@ -401,27 +410,25 @@ dependencies = [
  "chrono",
  "hex",
  "hmac",
- "rand_core",
+ "rand_core 0.6.4",
  "serde",
  "serde_json",
- "sha2",
+ "sha2 0.10.9",
 ]
 
 [[package]]
 name = "confium-pki"
-version = "0.3.1"
+version = "0.5.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b68dff75f1a02a0acf9145740a8e837b9c8f25cf4c71bad08d0c2b2c9bf2ac61"
+checksum = "22882ad7e4b3d84eed93c6dee7f8fdc24abf81fb0305fb0737c85875b83c6376"
 dependencies = [
  "chrono",
  "data-encoding",
- "der",
+ "der 0.8.1",
  "serde",
  "serde_json",
- "sha2",
- "snafu 0.8.9",
- "spki",
- "thiserror",
+ "sha2 0.11.0",
+ "thiserror 2.0.20",
  "x509-cert",
 ]
 
@@ -438,11 +445,11 @@ dependencies = [
  "num-traits",
  "p256",
  "rand",
- "rand_core",
+ "rand_core 0.6.4",
  "serde",
  "serde_json",
- "sha2",
- "thiserror",
+ "sha2 0.10.9",
+ "thiserror 1.0.69",
 ]
 
 [[package]]
@@ -456,6 +463,16 @@ dependencies = [
  "snafu 0.8.9",
 ]
 
+[[package]]
+name = "confium-store"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5559e7f26bcf9f6dd3a76cf7eb0cf0684966c504cf662efef14f69ade8103e26"
+dependencies = [
+ "inventory",
+ "snafu 0.9.2",
+]
+
 [[package]]
 name = "confium-tc"
 version = "0.3.1"
@@ -466,7 +483,7 @@ dependencies = [
  "confium-api",
  "confium-coordinator",
  "confium-net",
- "confium-store",
+ "confium-store 0.3.0",
  "confium-tc-keys",
  "data-encoding",
  "hex",
@@ -478,13 +495,13 @@ dependencies = [
  "num-traits",
  "p256",
  "rand",
- "rand_core",
+ "rand_core 0.6.4",
  "serde",
  "serde_json",
- "sha2",
+ "sha2 0.10.9",
  "snafu 0.8.9",
  "subtle",
- "thiserror",
+ "thiserror 1.0.69",
  "tracing",
  "zeroize",
 ]
@@ -506,7 +523,7 @@ dependencies = [
  "num-traits",
  "p256",
  "rand",
- "sha2",
+ "sha2 0.10.9",
  "snafu 0.8.9",
  "zeroize",
 ]
@@ -520,19 +537,19 @@ dependencies = [
  "chrono",
  "confium-api",
  "confium-net",
- "confium-store",
+ "confium-store 0.3.0",
  "data-encoding",
  "hex",
  "hmac",
  "inventory",
  "p256",
- "rand_core",
+ "rand_core 0.6.4",
  "serde",
  "serde_json",
- "sha2",
+ "sha2 0.10.9",
  "snafu 0.8.9",
  "subtle",
- "thiserror",
+ "thiserror 1.0.69",
  "tracing",
  "zeroize",
 ]
@@ -546,8 +563,8 @@ dependencies = [
  "elliptic-curve",
  "p256",
  "serde",
- "sha2",
- "thiserror",
+ "sha2 0.10.9",
+ "thiserror 1.0.69",
 ]
 
 [[package]]
@@ -559,10 +576,10 @@ dependencies = [
  "elliptic-curve",
  "hex",
  "p256",
- "rand_core",
+ "rand_core 0.6.4",
  "serde",
- "sha2",
- "thiserror",
+ "sha2 0.10.9",
+ "thiserror 1.0.69",
 ]
 
 [[package]]
@@ -578,7 +595,7 @@ dependencies = [
  "hex",
  "inventory",
  "p256",
- "sha2",
+ "sha2 0.10.9",
  "snafu 0.8.9",
  "zeroize",
 ]
@@ -594,12 +611,12 @@ dependencies = [
  "hex",
  "hmac",
  "p256",
- "rand_core",
+ "rand_core 0.6.4",
  "serde",
  "serde_json",
- "sha2",
+ "sha2 0.10.9",
  "subtle",
- "thiserror",
+ "thiserror 1.0.69",
 ]
 
 [[package]]
@@ -612,9 +629,9 @@ dependencies = [
  "data-encoding",
  "serde",
  "serde_json",
- "sha2",
+ "sha2 0.10.9",
  "snafu 0.8.9",
- "thiserror",
+ "thiserror 1.0.69",
 ]
 
 [[package]]
@@ -631,6 +648,7 @@ dependencies = [
  "confium-observability",
  "confium-pki",
  "confium-privacy",
+ "confium-store 0.5.8",
  "confium-tc",
  "confium-tc-cmp20",
  "confium-tc-core",
@@ -642,11 +660,11 @@ dependencies = [
  "hex",
  "magnus",
  "p256",
- "rand_core",
+ "rand_core 0.6.4",
  "rb-sys",
  "rnp-rs",
  "serde_json",
- "sha2",
+ "sha2 0.10.9",
  "subtle",
 ]
 
@@ -656,6 +674,12 @@ version = "0.9.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
 
+[[package]]
+name = "const-oid"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
+
 [[package]]
 name = "core-foundation-sys"
 version = "0.8.7"
@@ -671,6 +695,15 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "cpufeatures"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "crc"
 version = "3.4.0"
@@ -702,7 +735,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76"
 dependencies = [
  "generic-array",
- "rand_core",
+ "rand_core 0.6.4",
  "subtle",
  "zeroize",
 ]
@@ -714,10 +747,19 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
 dependencies = [
  "generic-array",
- "rand_core",
+ "rand_core 0.6.4",
  "typenum",
 ]
 
+[[package]]
+name = "crypto-common"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
+dependencies = [
+ "hybrid-array",
+]
+
 [[package]]
 name = "ctr"
 version = "0.9.2"
@@ -734,9 +776,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "97fb8b7c4503de7d6ae7b42ab72a5a59857b4c937ec27a3d4539dba95b5ab2be"
 dependencies = [
  "cfg-if",
- "cpufeatures",
+ "cpufeatures 0.2.17",
  "curve25519-dalek-derive",
- "digest",
+ "digest 0.10.7",
  "fiat-crypto",
  "rustc_version",
  "subtle",
@@ -766,18 +808,29 @@ version = "0.7.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
 dependencies = [
- "const-oid",
+ "const-oid 0.9.6",
+ "pem-rfc7468 0.7.0",
+ "zeroize",
+]
+
+[[package]]
+name = "der"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a69dedd701da44b0536442edf09c81a64b0ab97a7a4a5e3d1971f00027cbc63d"
+dependencies = [
+ "const-oid 0.10.2",
  "der_derive",
  "flagset",
- "pem-rfc7468",
+ "pem-rfc7468 1.0.0",
  "zeroize",
 ]
 
 [[package]]
 name = "der_derive"
-version = "0.7.3"
+version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8034092389675178f570469e6c3b0465d3d30b4505c294a6550db47f3c17ad18"
+checksum = "59600e2c2d636fde9b65e99cc6445ac770c63d3628195ff39932b8d6d7409903"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -790,12 +843,23 @@ version = "0.10.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
- "block-buffer",
- "const-oid",
- "crypto-common",
+ "block-buffer 0.10.4",
+ "const-oid 0.9.6",
+ "crypto-common 0.1.7",
  "subtle",
 ]
 
+[[package]]
+name = "digest"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
+dependencies = [
+ "block-buffer 0.12.1",
+ "const-oid 0.10.2",
+ "crypto-common 0.2.2",
+]
+
 [[package]]
 name = "displaydoc"
 version = "0.2.6"
@@ -813,13 +877,13 @@ version = "0.16.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ee27f32b5c5292967d2d4a9d7f1e0b0aed2c15daded5a60300e4abb9d8020bca"
 dependencies = [
- "der",
- "digest",
+ "der 0.7.10",
+ "digest 0.10.7",
  "elliptic-curve",
  "rfc6979",
  "serdect",
- "signature",
- "spki",
+ "signature 2.2.0",
+ "spki 0.7.3",
 ]
 
 [[package]]
@@ -829,7 +893,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53"
 dependencies = [
  "pkcs8",
- "signature",
+ "signature 2.2.0",
 ]
 
 [[package]]
@@ -840,9 +904,9 @@ checksum = "70e796c081cee67dc755e1a36a0a172b897fab85fc3f6bc48307991f64e4eca9"
 dependencies = [
  "curve25519-dalek",
  "ed25519",
- "rand_core",
+ "rand_core 0.6.4",
  "serde",
- "sha2",
+ "sha2 0.10.9",
  "subtle",
  "zeroize",
 ]
@@ -861,13 +925,13 @@ checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47"
 dependencies = [
  "base16ct",
  "crypto-bigint",
- "digest",
+ "digest 0.10.7",
  "ff",
  "generic-array",
  "group",
- "pem-rfc7468",
+ "pem-rfc7468 0.7.0",
  "pkcs8",
- "rand_core",
+ "rand_core 0.6.4",
  "sec1",
  "serdect",
  "subtle",
@@ -896,7 +960,7 @@ version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c0b50bfb653653f9ca9095b427bed08ab8d75a137839d9ad64eb11810d5b6393"
 dependencies = [
- "rand_core",
+ "rand_core 0.6.4",
  "subtle",
 ]
 
@@ -1028,7 +1092,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f0f9ef7462f7c099f518d754361858f86d8a07af53ba9af0fe635bbccb151a63"
 dependencies = [
  "ff",
- "rand_core",
+ "rand_core 0.6.4",
  "subtle",
 ]
 
@@ -1067,7 +1131,7 @@ version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
 dependencies = [
- "digest",
+ "digest 0.10.7",
 ]
 
 [[package]]
@@ -1086,6 +1150,15 @@ version = "1.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
 
+[[package]]
+name = "hybrid-array"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "707114b52a152fa7bdb290cd7cd5912d9467273b6d74e21b8d81aca1f8533f6b"
+dependencies = [
+ "typenum",
+]
+
 [[package]]
 name = "iana-time-zone"
 version = "0.1.65"
@@ -1460,7 +1533,7 @@ dependencies = [
  "elliptic-curve",
  "primeorder",
  "serdect",
- "sha2",
+ "sha2 0.10.9",
 ]
 
 [[package]]
@@ -1472,6 +1545,15 @@ dependencies = [
  "base64ct",
 ]
 
+[[package]]
+name = "pem-rfc7468"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6305423e0e7738146434843d1694d621cce767262b2a86910beab705e4493d9"
+dependencies = [
+ "base64ct",
+]
+
 [[package]]
 name = "percent-encoding"
 version = "2.3.2"
@@ -1490,8 +1572,8 @@ version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
 dependencies = [
- "der",
- "spki",
+ "der 0.7.10",
+ "spki 0.7.3",
 ]
 
 [[package]]
@@ -1507,7 +1589,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9d1fe60d06143b2430aa532c94cfe9e29783047f06c0d7fd359a9a51b729fa25"
 dependencies = [
  "cfg-if",
- "cpufeatures",
+ "cpufeatures 0.2.17",
  "opaque-debug",
  "universal-hash",
 ]
@@ -1582,7 +1664,7 @@ checksum = "22f6172bdec972074665ed81ed53b71da00bfc44b65a753cfde883ec4c702a1a"
 dependencies = [
  "libc",
  "rand_chacha",
- "rand_core",
+ "rand_core 0.6.4",
 ]
 
 [[package]]
@@ -1592,7 +1674,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
 dependencies = [
  "ppv-lite86",
- "rand_core",
+ "rand_core 0.6.4",
 ]
 
 [[package]]
@@ -1604,6 +1686,12 @@ dependencies = [
  "getrandom",
 ]
 
+[[package]]
+name = "rand_core"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
+
 [[package]]
 name = "rb-sys"
 version = "0.9.128"
@@ -1788,7 +1876,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc"
 dependencies = [
  "base16ct",
- "der",
+ "der 0.7.10",
  "generic-array",
  "pkcs8",
  "serdect",
@@ -1872,13 +1960,13 @@ dependencies = [
 
 [[package]]
 name = "sha1"
-version = "0.10.7"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a978451301f4db1d02937a4ab3ccce137717b81826e79b7d49ffe3244a13c3b8"
+checksum = "aacc4cc499359472b4abe1bf11d0b12e688af9a805fa5e3016f9a386dc2d0214"
 dependencies = [
  "cfg-if",
- "cpufeatures",
- "digest",
+ "cpufeatures 0.3.0",
+ "digest 0.11.3",
 ]
 
 [[package]]
@@ -1888,8 +1976,19 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
 dependencies = [
  "cfg-if",
- "cpufeatures",
- "digest",
+ "cpufeatures 0.2.17",
+ "digest 0.10.7",
+]
+
+[[package]]
+name = "sha2"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.0",
+ "digest 0.11.3",
 ]
 
 [[package]]
@@ -1916,8 +2015,17 @@ version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
 dependencies = [
- "digest",
- "rand_core",
+ "digest 0.10.7",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "signature"
+version = "3.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28d567dcbaf0049cb8ac2608a76cd95ff9e4412e1899d389ee400918ca7537f5"
+dependencies = [
+ "rand_core 0.10.1",
 ]
 
 [[package]]
@@ -1987,7 +2095,17 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
 dependencies = [
  "base64ct",
- "der",
+ "der 0.7.10",
+]
+
+[[package]]
+name = "spki"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d9efca8738c78ee9484207732f728b1ef517bbb1833d6fc0879ca898a522f6f"
+dependencies = [
+ "base64ct",
+ "der 0.8.1",
 ]
 
 [[package]]
@@ -2058,7 +2176,16 @@ version = "1.0.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
 dependencies = [
- "thiserror-impl",
+ "thiserror-impl 1.0.69",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec86235f5fcc2a73650310756d2ac5b138a5780bbbdfae3eeccec992c435ba4f"
+dependencies = [
+ "thiserror-impl 2.0.20",
 ]
 
 [[package]]
@@ -2072,6 +2199,17 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "thiserror-impl"
+version = "2.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc04cd3e1236dd4a98afca4569f2deb3f120e5422a4023be2cb683f8486292af"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
 [[package]]
 name = "tinystr"
 version = "0.8.3"
@@ -2193,7 +2331,7 @@ version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc1de2c688dc15305988b563c3854064043356019f97a4b46276fe734c4f07ea"
 dependencies = [
- "crypto-common",
+ "crypto-common 0.1.7",
  "subtle",
 ]
 
@@ -2489,15 +2627,15 @@ dependencies = [
 
 [[package]]
 name = "x509-cert"
-version = "0.2.5"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1301e935010a701ae5f8655edc0ad17c44bad3ac5ce8c39185f75453b720ae94"
+checksum = "105ef4642d9cb137ef83d623d0e4bf08b8adf69e9918ca904a174adb6d3d038b"
 dependencies = [
- "const-oid",
- "der",
+ "const-oid 0.10.2",
+ "der 0.8.1",
  "sha1",
- "signature",
- "spki",
+ "signature 3.0.0",
+ "spki 0.8.0",
  "tls_codec",
 ]
 

data/ext/confium_native/Cargo.toml

@@ -36,7 +36,8 @@ confium-core = "0.2"
 confium-transparency = "0.4"
 confium-composite = "0.3.1"
 confium-attributes = "0.3.1"
-confium-pki = "0.3.1"
+confium-pki = "0.5.6"
+confium-store = "0.5.8"
 confium-deployment = "0.3"
 confium-tc = "0.3.1"
 confium-tc-frost-p256 = "0.3"

data/ext/confium_native/src/lib.rs

@@ -12,6 +12,7 @@ mod ers;
 mod openpgp_verify;
 mod path;
 mod pki;
+mod store;
 mod tc;
 mod transparency;
 mod util;
@@ -49,6 +50,7 @@ fn init(ruby: &Ruby) -> Result<(), Error> {
     composite::init(ruby, confium)?;
     attributes::init(ruby, confium)?;
     pki::init(ruby, confium)?;
+    store::init(ruby, confium)?;
     path::init(ruby, confium)?;
     deployment::init(ruby, confium)?;
     tc::init(ruby, confium)?;

data/ext/confium_native/src/pki.rs

@@ -33,8 +33,9 @@ pub struct Certificate {
 impl Certificate {
     fn from_der(bytes: Value) -> Result<Obj<Self>, Error> {
         let der = bytes_from_value(bytes)?;
-        let cert = RustCert::from_der(&der)
-            .map_err(|e| parse_error(e.to_string(), "Certificate.from_der", Some("der"), None))?;
+        let cert = RustCert::from_der(&der).map_err(|e| {
+            parse_error(e.to_string(), "Certificate.from_der", Some("der"), e.der_offset())
+        })?;
         let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
         Ok(ruby.obj_wrap(Self { inner: cert }))
     }
@@ -101,8 +102,9 @@ pub struct Csr {
 impl Csr {
     fn from_der(bytes: Value) -> Result<Obj<Self>, Error> {
         let der = bytes_from_value(bytes)?;
-        let csr = RustCsr::from_der(&der)
-            .map_err(|e| parse_error(e.to_string(), "Csr.from_der", Some("der"), None))?;
+        let csr = RustCsr::from_der(&der).map_err(|e| {
+            parse_error(e.to_string(), "Csr.from_der", Some("der"), e.der_offset())
+        })?;
         let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
         Ok(ruby.obj_wrap(Self { inner: csr }))
     }
@@ -299,7 +301,7 @@ impl SignedData {
 #[derive(TypedData, DataTypeFunctions)]
 #[magnus(class = "Confium::PKI::CMS::VerificationResult", size)]
 pub struct CmsVerificationResult {
-    pub inner: confium_pki::cms::VerificationResult,
+    pub inner: confium_pki::cms::CmsVerificationResult,
 }
 
 impl CmsVerificationResult {

data/ext/confium_native/src/store.rs

@@ -0,0 +1,108 @@
+//! Confium::Store — Ruby surface for `confium_store`.
+//!
+//! `Confium::Store::Keystore` opens a keystore by backend wire name
+//! (`"memory"`, plus the remote-holding backends when the extension is
+//! built with their features) and exposes the remote-sign path added
+//! by the sign-with-handle contract:
+//!
+//!   ks = Confium::Store::Keystore.new("memory")
+//!   ks.sign(key_id, algorithm, message)  # => binary String
+//!
+//! Local backends raise for `#sign` — remote signing is implemented by
+//! the cloud KMS backends (`aws-kms`, `gcp-kms`, `azure-keyvault`),
+//! which source builds opt into via cargo features.
+
+use confium_store::Keystore as RustKeystore;
+use magnus::{
+    function, method, prelude::*, DataTypeFunctions, Error, Module, RHash, Ruby, TryConvert,
+    TypedData, Value,
+};
+
+use crate::util::{bytes_from_value, bytes_to_rstring, confium_error, new_details};
+
+#[derive(TypedData, DataTypeFunctions)]
+#[magnus(class = "Confium::Store::Keystore", size)]
+pub struct Keystore {
+    inner: std::cell::RefCell<RustKeystore>,
+}
+
+fn store_error(e: confium_store::error::Error, operation: &str) -> Error {
+    let ruby = match Ruby::get() {
+        Ok(r) => r,
+        Err(_) => return Error::new(magnus::exception::runtime_error(), e.to_string()),
+    };
+    let details = new_details(&ruby);
+    let _ = details.aset("operation", operation);
+    match &e {
+        confium_store::error::Error::NotImplemented { what } => {
+            let _ = details.aset("what", *what);
+        }
+        confium_store::error::Error::UnknownBackend { name } => {
+            let _ = details.aset("backend", name.as_str());
+        }
+        _ => {}
+    }
+    confium_error(e.to_string(), "Error", details)
+}
+
+impl Keystore {
+    fn initialize(ruby: &Ruby, args: &[Value]) -> Result<Self, Error> {
+        let scanned = magnus::scan_args::scan_args::<(String,), (Option<RHash>,), (), (), (), ()>(args)
+            .map_err(|e| crate::util::arg_error(e.to_string()))?;
+        let backend = scanned.required.0;
+        let mut options = confium_store::backend::Options::new();
+        if let Some(hash) = scanned.optional.0 {
+            hash.foreach(|k: Value, v: Value| {
+                let key: String = <String as TryConvert>::try_convert(k)?;
+                let value: String = <String as TryConvert>::try_convert(v)?;
+                options.insert(key, value);
+                Ok(magnus::r_hash::ForEach::Continue)
+            })?;
+        }
+        let inner =
+            RustKeystore::new(&backend, &options).map_err(|e| store_error(e, "Keystore.new"))?;
+        let _ = ruby;
+        Ok(Self {
+            inner: std::cell::RefCell::new(inner),
+        })
+    }
+
+    /// Sign `message` with the remotely-held key `key_id` under the
+    /// provider algorithm name. Returns binary String signature bytes.
+    fn sign(&self, args: &[Value]) -> Result<magnus::RString, Error> {
+        let scanned = magnus::scan_args::scan_args::<(String, String), (Option<Value>,), (), (), (), ()>(args)
+            .map_err(|e| crate::util::arg_error(e.to_string()))?;
+        let (key_id, algorithm) = scanned.required;
+        let message = scanned
+            .optional
+            .0
+            .ok_or_else(|| crate::util::arg_error("Keystore#sign: message is required"))?;
+        let bytes = bytes_from_value(message)?;
+        let signature = self
+            .inner
+            .borrow()
+            .sign("confium", "ruby", &key_id, &algorithm, &bytes)
+            .map_err(|e| store_error(e, "Keystore#sign"))?;
+        Ok(bytes_to_rstring(
+            &Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?,
+            &signature,
+        ))
+    }
+}
+
+/// The backend wire names registered at link time
+/// (`Confium::Store.backends`).
+fn backends() -> Result<Vec<String>, Error> {
+    Ok(confium_store::backend::iter()
+        .map(|b| b.name().to_string())
+        .collect())
+}
+
+pub fn init(ruby: &Ruby, parent: magnus::RModule) -> Result<(), Error> {
+    let store = parent.define_module("Store")?;
+    let class = store.define_class("Keystore", ruby.class_object())?;
+    class.define_singleton_method("new", function!(Keystore::initialize, -1))?;
+    class.define_method("sign", method!(Keystore::sign, -1))?;
+    store.define_module_function("backends", function!(backends, 0))?;
+    Ok(())
+}

data/lib/confium/errors.rb

@@ -12,8 +12,17 @@ module Confium
   class Error < StandardError
     attr_reader :details
 
-    def initialize(message = nil, details: {})
-      @details = details.transform_keys(&:to_sym)
+    # The native extension constructs errors positionally
+    # (message, details_hash) — the same shape every typed subclass
+    # accepts via Errors::Coerce. Accepting it here keeps the whole
+    # family uniform; the keyword form still works.
+    def initialize(message = nil, details_hash = nil, details: {})
+      base = if details_hash.is_a?(Hash) && !details_hash.empty?
+               details_hash
+             else
+               details
+             end
+      @details = base.transform_keys(&:to_sym)
       super(message)
     end
 

data/lib/confium/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Confium
-  VERSION = '0.6.0'
+  VERSION = '0.6.2'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: confium
 version: !ruby/object:Gem::Version
-  version: 0.6.0
+  version: 0.6.2
 platform: ruby
 authors:
 - Ribose Open
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-08-25 00:00:00.000000000 Z
+date: 2026-08-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rb_sys
@@ -124,6 +124,7 @@ files:
 - ext/confium_native/src/openpgp_verify.rs
 - ext/confium_native/src/path.rs
 - ext/confium_native/src/pki.rs
+- ext/confium_native/src/store.rs
 - ext/confium_native/src/tc.rs
 - ext/confium_native/src/transparency.rs
 - ext/confium_native/src/util.rs