confium 0.6.3-x86_64-linux → 0.7.0-x86_64-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6374fdd38da6467d6cf9e3b364f507144b79bed515fc14bf2abe0e9cc980715f
-  data.tar.gz: 4f851ce4c48fc94ee59a2ea0e3deadf79e806a0b0e2eb0c7d8d1a063d242c541
+  metadata.gz: fb9023ca3c9c99f8f85682ea118c7604844a9369c23640491b731ec1d9990d9d
+  data.tar.gz: ffc0c63634bdaa2a6c43c295b53532a35ab7dcea7e4d864486af8df2d5abab98
 SHA512:
-  metadata.gz: 33cb9182abce977a4ba06e337bf57548ba83d7e55deb2627679728013f20e0d28cc232de9c0422b7abdeebed0a685e6a52a471441db24d50586159cc57fb4318
-  data.tar.gz: e34e0e83fa42f2a6db5af6c97de8c509f36e7592010780f1fac6c2e7054534681322acece914d3f1e671d524f0830e8dc4b995e7689654a00f05956321b4d046
+  metadata.gz: d062e24ba4dc4fb6faf6219fbdc53d529c71a99324b419227dafbb1076fc2a800caf88c754b218b699b60607243207f1cdd6aaddabef3e755e1be8b6b72d0b51
+  data.tar.gz: 0f97546fed40c7a4539b3223d79e3f135abb8266f5852738fb57c139f351629bd08bb903849a5b42e1716dd3a06c869f051cedb81a1020634b8dd3a9d4510428

data/CHANGELOG.md

@@ -1,5 +1,48 @@
 # Changelog
 
+## [0.7.0] — 2026-09-07
+
+### Added
+
+- `Confium::Transport::SignerClient` / `CoordinatorServer` —
+  coordinator sessions over any registry transport the extension
+  links, addressed by URL: `tcp://host:port` for local/trusted
+  networks, `noise://host:port` for Noise_XX
+  (`Noise_XX_25519_ChaChaPoly_BLAKE2s`) encrypted sessions.
+  `noise://` URLs take `key=<hex>` (local static private key;
+  ephemeral and trust-on-first-use when omitted) and `pinned=<hex>`
+  (SHA-256 fingerprint of the expected peer static key — the
+  handshake aborts on mismatch). The handshake carries a 10-second
+  deadline so a non-Noise peer fails fast instead of hanging.
+  `SignerClient` exposes `#register`, `#create_session`,
+  `#submit_commitment`, `#submit_share` (returns the aggregated
+  signature once the threshold is met, else nil);
+  `CoordinatorServer.new(url)` serves any linked scheme for tests
+  and single-process deployments.
+
+### Changed
+
+- **BREAKING**: `Confium::Net` is `Confium::Transport`. Defining
+  `Confium::Net` shadowed Ruby stdlib `Net` for every constant
+  lookup under the `Confium` namespace — `Confium::Audit::OtlpSink`'s
+  `Net::HTTP` resolved to `Confium::Net::HTTP` and raised
+  `NameError`. No prior release shipped the `Net` names.
+
+## [0.6.3] — 2026-08-26
+
+### Added
+
+- `Confium::TC::Session` — per-party threshold protocol sessions
+  over confium-tc-core 0.4: each signer process runs its own
+  session (`"FROST-ed25519-dkg"` for distributed key generation,
+  `"FROST-ed25519"` for signing with the DKG share and message) and
+  exchanges only `round_step` messages — the share never leaves the
+  process. `#round_step(incoming)` returns
+  `{ "outgoing" => [...], "complete" => bool }`; the completed DKG
+  session's `#result` is the party's share blob, the signing
+  session's `#result` an RFC 8032 Ed25519 signature verifiable under
+  the group public key.
+
 ## [0.6.2] — 2026-08-26
 
 ### Added

data/Cargo.lock

@@ -135,6 +135,15 @@ dependencies = [
  "wyz",
 ]
 
+[[package]]
+name = "blake2"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46502ad458c9a52b69d4d4d32775c788b7a1b85e8bc9d482d92250fc0e3f8efe"
+dependencies = [
+ "digest 0.10.7",
+]
+
 [[package]]
 name = "block-buffer"
 version = "0.10.4"
@@ -207,6 +216,30 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 
+[[package]]
+name = "chacha20"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3613f74bd2eac03dad61bd53dbe620703d4371614fe0bc3b9f04dd36fe4e818"
+dependencies = [
+ "cfg-if",
+ "cipher",
+ "cpufeatures 0.2.17",
+]
+
+[[package]]
+name = "chacha20poly1305"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10cd79432192d1c0f4e1a0fef9527696cc039165d729fb41b3f4f4f354c2dc35"
+dependencies = [
+ "aead",
+ "chacha20",
+ "cipher",
+ "poly1305",
+ "zeroize",
+]
+
 [[package]]
 name = "chrono"
 version = "0.4.45"
@@ -229,6 +262,7 @@ checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
 dependencies = [
  "crypto-common 0.1.7",
  "inout",
+ "zeroize",
 ]
 
 [[package]]
@@ -301,7 +335,7 @@ checksum = "e8c96d4d5997726cf0eb794410e3e8bbce839cfba9c4a32e26ede0c076b02e64"
 dependencies = [
  "chrono",
  "confium-api",
- "confium-net",
+ "confium-net 0.3.0",
  "confium-store 0.3.0",
  "confium-tc-core 0.3.0",
  "data-encoding",
@@ -321,6 +355,26 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "confium-coordinator"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52f49eae3301b6f1f2f36b2eb66d0fdd863bcecb1dc18b51ec51e5f8d1bb9dc3"
+dependencies = [
+ "chrono",
+ "confium-net 0.8.5",
+ "getrandom 0.4.3",
+ "hex",
+ "hmac 0.13.0",
+ "p256 0.14.0",
+ "rand_core 0.6.4",
+ "serde",
+ "serde_json",
+ "sha2 0.11.0",
+ "thiserror 2.0.20",
+ "tracing",
+]
+
 [[package]]
 name = "confium-core"
 version = "0.2.0"
@@ -413,6 +467,44 @@ dependencies = [
  "url",
 ]
 
+[[package]]
+name = "confium-net"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2bd7098e54033a09b1f6a4ebd0c0f54d6c44da8f46cfdff7ae156895f1083fc6"
+dependencies = [
+ "inventory",
+ "snafu 0.9.2",
+ "url",
+]
+
+[[package]]
+name = "confium-net-noise"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "213e90ce6daa40d1ec92d8e524276744a07f027c453bd32815f80c29ba947237"
+dependencies = [
+ "confium-net 0.8.5",
+ "inventory",
+ "sha2 0.11.0",
+ "snafu 0.9.2",
+ "snow",
+ "url",
+ "x25519-dalek",
+]
+
+[[package]]
+name = "confium-net-tcp"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b80e3d692ed5328a72e754a0f73d81f6c8fde3714d05fc0be1953f657e05f76"
+dependencies = [
+ "confium-net 0.8.5",
+ "inventory",
+ "snafu 0.9.2",
+ "url",
+]
+
 [[package]]
 name = "confium-observability"
 version = "0.3.0"
@@ -493,8 +585,8 @@ checksum = "3dd7d4965aef12324cb76d397294c317b83b774de029f1d37b387cf54ba9593c"
 dependencies = [
  "chrono",
  "confium-api",
- "confium-coordinator",
- "confium-net",
+ "confium-coordinator 0.3.0",
+ "confium-net 0.3.0",
  "confium-store 0.3.0",
  "confium-tc-keys",
  "data-encoding",
@@ -566,7 +658,7 @@ checksum = "add3e15337ce81944f78c9ce844d870a081cbe91506a85b9a5c4e4c0da983771"
 dependencies = [
  "chrono",
  "confium-api",
- "confium-net",
+ "confium-net 0.3.0",
  "confium-store 0.3.0",
  "data-encoding",
  "hex",
@@ -703,10 +795,13 @@ dependencies = [
  "chrono",
  "confium-attributes",
  "confium-composite",
+ "confium-coordinator 0.8.5",
  "confium-core",
  "confium-crypto-vss",
  "confium-crypto-zk",
  "confium-deployment",
+ "confium-net-noise",
+ "confium-net-tcp",
  "confium-observability",
  "confium-pki",
  "confium-privacy",
@@ -1215,6 +1310,18 @@ dependencies = [
  "wasi",
 ]
 
+[[package]]
+name = "getrandom"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 5.3.0",
+ "wasip2",
+]
+
 [[package]]
 name = "getrandom"
 version = "0.4.3"
@@ -1223,7 +1330,7 @@ checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
 dependencies = [
  "cfg-if",
  "libc",
- "r-efi",
+ "r-efi 6.0.0",
  "rand_core 0.10.1",
 ]
 
@@ -1785,6 +1892,17 @@ version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548"
 
+[[package]]
+name = "poly1305"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8159bd90725d2df49889a078b54f4f79e87f1f8a8444194cdca81d38f5393abf"
+dependencies = [
+ "cpufeatures 0.2.17",
+ "opaque-debug",
+ "universal-hash",
+]
+
 [[package]]
 name = "polyval"
 version = "0.6.2"
@@ -1879,6 +1997,12 @@ dependencies = [
  "proc-macro2",
 ]
 
+[[package]]
+name = "r-efi"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+
 [[package]]
 name = "r-efi"
 version = "6.0.0"
@@ -2348,6 +2472,23 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "snow"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "599b506ccc4aff8cf7844bc42cf783009a434c1e26c964432560fb6d6ad02d82"
+dependencies = [
+ "aes-gcm",
+ "blake2",
+ "chacha20poly1305",
+ "curve25519-dalek",
+ "getrandom 0.3.4",
+ "ring",
+ "rustc_version",
+ "sha2 0.10.9",
+ "subtle",
+]
+
 [[package]]
 name = "spki"
 version = "0.7.3"
@@ -2666,6 +2807,15 @@ version = "0.11.1+wasi-snapshot-preview1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
 
+[[package]]
+name = "wasip2"
+version = "1.0.4+wasi-0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b67efb37e106e55ce722a510d6b5f9c17f083e5fc79afc2badeb12cc313d9487"
+dependencies = [
+ "wit-bindgen",
+]
+
 [[package]]
 name = "wasm-bindgen"
 version = "0.2.126"
@@ -2870,6 +3020,12 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "wit-bindgen"
+version = "0.57.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
+
 [[package]]
 name = "wnaf"
 version = "0.14.0"
@@ -2896,6 +3052,18 @@ dependencies = [
  "tap",
 ]
 
+[[package]]
+name = "x25519-dalek"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7e468321c81fb07fa7f4c636c3972b9100f0346e5b6a9f2bd0603a52f7ed277"
+dependencies = [
+ "curve25519-dalek",
+ "rand_core 0.6.4",
+ "serde",
+ "zeroize",
+]
+
 [[package]]
 name = "x509-cert"
 version = "0.3.0"

data/README.adoc

@@ -18,7 +18,7 @@ Add to your Gemfile:
 
 [source,ruby]
 ----
-gem "confium", "~> 0.3"
+gem "confium", "~> 0.7"
 ----
 
 Or install directly:
@@ -78,18 +78,38 @@ kp = Confium::TC::FrostP256.generate_keypair
 shares = Confium::TC::FrostP256.split_secret(kp["private_key"], 3, 5)
 recovered = Confium::TC::FrostP256.recover_secret(shares.first(3).map { |s| { "x" => s.x, "y" => s.y_bytes } })
 recovered == kp["private_key"]  # => true
+
+# Distributed key generation + 2-of-3 FROST-ed25519 signing (each party
+# holds its own Confium::TC::Session and only exchanges round messages)
+parties = %w[alice bob carol]
+sessions = parties.each_with_index.map do |id, i|
+  Confium::TC::Session.new("FROST-ed25519-dkg", parties: parties, threshold: 2, this_party_idx: i)
+end
+# run rounds: session.round_step(messages_in) -> {"outgoing" => [...], "complete" => bool}
+# broadcast "outgoing" payloads between sessions until every session is complete
+dkg_share = sessions.first.result  # this party's share (embeds the group public key)
+
+signers = sessions.first(2).map.with_index do |s, i|
+  Confium::TC::Session.new("FROST-ed25519",
+                           parties: parties.first(2), threshold: 2, this_party_idx: i,
+                           local_share: dkg_share, message: "authentic message")
+end
+# run rounds as above; the completed session's #result is an RFC 8032
+# Ed25519 signature verifiable under the group public key
 ----
 
-== API surface (v0.3)
+== API surface (v0.7)
 
 === `Confium::Transparency`
 - `MerkleTree.new` / `#append(artifact_hash)` / `#root` / `#length` / `#empty?` / `#inclusion_proof(seq)`
 - `InclusionProof#sequence` / `#steps` / `#verify(root)`
+- `Ots.stamp(hash)` / `Ots.verify(receipt, hash)` — OpenTimestamps anchoring interface (pure-Ruby stub; calendar-server wiring lands with the Rust client)
 
 === `Confium::Composite` — PQ migration
 - `.generate_ed25519_keypair` → `{ private_key:, public_key: }`
 - `.sign_ed25519(private_key, message)` → component Hash
-- `Signature.new(components)` / `#verify(message)` / `#component_count` / `#algorithms`
+- `Signature.new(components)` / `#verify(message)` / `#component_count` / `#algorithms` / `#to_json`
+- `.from_json(json)` / `.components_to_json(components)` / `.canonical_json(json, data)`
 - `VerificationResult#all_verified?` / `#per_component`
 
 === `Confium::Attributes` — threshold policy DSL
@@ -99,11 +119,14 @@ recovered == kp["private_key"]  # => true
 - DSL: `min_count("attr", n)`, `min_distinct("attr", n)`, `any("attr")`, `all("attr")`, `none("attr")`, `and(...)`, `or(...)`, `not(p)`
 
 === `Confium::PKI`
-- `Certificate.from_der(bytes)` / `.from_pem(str)` / `#to_der` / `#to_pem` / `#fingerprint_sha256` / `#serial_hex` / `#not_before` / `#not_after` / `#valid_at?(iso8601)` / `#public_key_bytes`
+- `Certificate.from_der(bytes)` / `.from_pem(str)` / `#to_der` / `#to_pem` / `#fingerprint_sha256` / `#serial_hex` / `#not_before` / `#not_after` / `#valid_at?(iso8601)` / `#public_key_bytes`; DER parse failures carry a byte `offset` in the error details
+- `CertificateBuilder` / `CMS::SignedDataBuilder` — build certificates and signed data in Ruby
+- `PathValidator.validate(leaf, intermediates, root, now_iso8601 = nil)` → `PathValidationResult` (chain validation leaf → root at a point in time)
 - `CSR.from_der` / `.from_pem` / `#to_der` / `#to_pem`
 - `CMS::SignedData.from_json` / `#to_json` / `#signer_count` / `#content_type` / `#content` / `#certificate_count` / `#certificate_at(i)`
 - `CMS::Content#bytes` / `#length`
 - `XMLDSig.canonicalize(xml)` / `.canonicalize_exclusive(xml)` (Canonical XML RFC 3076 + Exclusive C14N)
+- `Cnml` — institutional certificate workflow helpers
 
 === `Confium::Identity` — actor roles
 - `.actor_types` → `["manufacturer", "testing_lab", "issuing_authority_officer", "biml_director", "quorum_coordinator", "verifier"]`
@@ -123,6 +146,51 @@ recovered == kp["private_key"]  # => true
 - `.partial_decrypt(party_index, share_bytes, ciphertext)` → `{ party_index:, bytes: }`
 - `.aggregate_partials(partials, threshold, ciphertext)` → shared_secret bytes
 
+=== `Confium::TC::Cmp20` / `Confium::TC::Gg18` — threshold ECDSA protocols
+- `.keygen(threshold, parties)` → `{ public_key, shares }`
+- `.sign(shares, public_key, message)` → DER ECDSA signature
+
+=== `Confium::TC::Session` — per-party threshold sessions (real FROST)
+- `Session.new(scheme, parties:, threshold:, this_party_idx:, local_share: nil, message: nil)` — `"FROST-ed25519-dkg"` for distributed key generation, `"FROST-ed25519"` for signing (pass the DKG share and the message)
+- `#scheme_name` / `#threshold` / `#party_count` / `#this_party_idx` / `#round` / `#complete?`
+- `#round_step(messages)` → `{ "outgoing" => [{from, to, round, payload}...], "complete" => bool }` — feed each round's incoming messages, broadcast the outgoing ones
+- `#result` — after DKG: share blob (group public key + party share); after signing: RFC 8032 Ed25519 signature
+
+=== `Confium::TC::Coordinator` — quorum signing orchestration
+- `Coordinator.new(quorum_id:)` / `#create_session(message:, threshold:, scheme: "CMP20-ECDSA-P256")` / `#submit_commitment` / `#submit_share` / `#aggregate` / `#session_state`
+- `SigningSession#add_commitment` / `#add_share` / `#threshold_met?` / `#aggregate` — the seam every transport adapts to
+- `NetworkCoordinator` — TCP/NDJSON server (`#start` / `#stop` / `#running?`); `SignerClient` — remote submit + aggregate with typed `RemoteError`
+- `ShareFile` — encrypted share-file persistence
+
+=== `Confium::Store::Keystore` — key handles and remote signing
+- `Keystore.new(backend, **options)` / `.backends`
+- `#sign(key_id, algorithm, message)` → signature bytes (sign-with-handle contract; cloud KMS backends `aws-kms` / `gcp-kms` / `azure-keyvault` via cargo features)
+
+=== `Confium::Audit` — structured audit trail
+- `Audit.sink =` / `Audit.sink` / `Audit.enabled?` / `Audit.record(...)`
+- `Sink` (base) / `MemorySink` / `StderrSink` / `FileSink`
+- `OtlpSink.new(endpoint:, headers:, service_name:, ...)` — OTLP/HTTP export with retry and `#dropped` counter
+
+=== `Confium::OpenPGP`
+- `.armor(data, type)` / `.dearmor(data)` — RFC 9580 §6 ASCII armor with CRC-24 (pure Ruby)
+- `.verify_detached(message, signature, keys)` / `.verify(...)` — real signature verification when the extension is built with the `pgp` feature; `PGP_AVAILABLE` reports it
+
+=== `Confium::Transport` — coordinator clients over any transport
+- `SignerClient.new(url)` — connect over any registry transport: `tcp://host:port` (local/trusted) or `noise://host:port?key=<hex>&pinned=<hex>` (Noise_XX encrypted, stable identity + peer pinning)
+- `#register(signer_id, quorum_id)` / `#create_session(quorum_id, scheme, message, threshold, num_parties)` → session id
+- `#submit_commitment(session_id, signer_id, bytes)` / `#submit_share(session_id, signer_id, bytes)`
+- `CoordinatorServer.new(url)` — serve coordinator sessions over any linked scheme (test/in-process use)
+
+=== `Confium::ERS` — evidence records
+- `EvidenceRecord.build_initial(...)` / `#renew(...)` / `#renewal_count` (RFC 4998 / RFC 6283 archival)
+
+=== `Confium::Policy` / `Confium::SecureBytes`
+- `Policy.jurisdiction = :eu` — jurisdictional algorithm policy (EU/US profiles; SM2/SM3/SM4 for CN planned)
+- `SecureBytes.wrap(raw)` — zeroize-on-clear wrapper for private keys, shares, and secrets (`#bytes` non-destructive read, `#clear`)
+
+=== Errors
+- Typed error hierarchy (`ParseError`, `ThresholdError`, `VerificationError`, `PolicyViolationError`, ...) — native failures surface positional `details` hashes (including DER byte offsets for parse errors)
+
 == Development
 
 After checking out the repo:

data/confium.gemspec

@@ -40,6 +40,8 @@ Gem::Specification.new do |spec|
   ]
   spec.files.reject! { |f| File.directory?(f) }
   spec.files.reject! { |f| f =~ /\.(dll|so|dylib|lib|bundle)\Z/ }
+  # Windows socket diagnostic crate — development-only, never shipped.
+  spec.files.reject! { |f| f.start_with?('ext/socket-smoke/') }
   spec.require_paths = ['lib']
 
   spec.required_ruby_version = '>= 3.1.0'

data/lib/confium/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Confium
-  VERSION = '0.6.3'
+  VERSION = '0.7.0'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: confium
 version: !ruby/object:Gem::Version
-  version: 0.6.3
+  version: 0.7.0
 platform: x86_64-linux
 authors:
 - Ribose Open
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-08-26 00:00:00.000000000 Z
+date: 2026-09-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake