confium 0.7.0 → 0.7.2

data/README.adoc

@@ -103,7 +103,7 @@ end
 === `Confium::Transparency`
 - `MerkleTree.new` / `#append(artifact_hash)` / `#root` / `#length` / `#empty?` / `#inclusion_proof(seq)`
 - `InclusionProof#sequence` / `#steps` / `#verify(root)`
-- `Ots.stamp(hash)` / `Ots.verify(receipt, hash)` — OpenTimestamps anchoring interface (pure-Ruby stub; calendar-server wiring lands with the Rust client)
+- `Ots.stamp(hash)` / `Ots.verify(proof)` / `Ots.upgrade(proof)` — real OpenTimestamps anchoring over the wire protocol (calendar HTTP, servers tried in order; the network round trip releases the GVL). `Ots::Client.new(servers)` for a custom pool; `Ots::Proof#verify` replays the op tree and classifies attestations. Network failures raise — there is no silent nil
 
 === `Confium::Composite` — PQ migration
 - `.generate_ed25519_keypair` → `{ private_key:, public_key: }`

data/ext/confium_native/Cargo.toml

@@ -36,33 +36,30 @@ magnus = { version = "0.8", features = ["bytes"] }
 
 # Confium crates — all from crates.io so gem install works without workspace checkout.
 confium-core = "0.2"
-confium-transparency = "0.4"
+confium-transparency = { version = "0.9", features = ["calendar"] }
 confium-composite = "0.3.1"
 confium-attributes = "0.3.1"
 confium-pki = "0.5.6"
 confium-store = "0.5.8"
 confium-deployment = "0.3"
-confium-tc = "0.3.1"
+confium-tc = "0.9"
 confium-tc-frost-p256 = "0.4"
 confium-tc-elgamal-p256 = "0.4"
-confium-tc-cmp20 = "0.4"
-confium-tc-gg18 = "0.4"
+confium-tc-cmp20 = "0.9"
+confium-tc-gg18 = "0.9"
 
 # Per-party session protocol: the tc-core 0.4 registry line. The 0.3-era
 # in-process drivers above keep their own registry harmlessly.
-confium-tc-session = { package = "confium-tc-core", version = "0.4.7" }
-confium-tc-frost-ed25519 = "0.4.7"
-
-# Newly published shared crypto crates (confium product restructuring).
-confium-tc-core = "0.3"
-confium-crypto-vss = "0.3"
-confium-crypto-zk = "0.3"
-confium-privacy = "0.3"
-confium-observability = "0.3"
+confium-tc-session = { package = "confium-tc-core", version = "0.9" }
+confium-tc-frost-ed25519 = "0.9"
 
 # P-256 scalar/point types used by the TC surface.
 p256 = { version = "0.13", features = ["ecdsa"] }
 
+# Hex integer codecs for the MtA surface.
+num-bigint = "0.4"
+num-traits = "0.2"
+
 ed25519-dalek = { version = "2", features = ["rand_core"] }
 rand_core = { version = "0.6", default-features = false, features = ["getrandom"] }
 

data/ext/confium_native/src/gvl.rs

@@ -0,0 +1,56 @@
+//! GVL release for long blocking calls.
+//!
+//! magnus 0.8 does not wrap `rb_thread_call_without_gvl`, so the OTS
+//! calendar round trip (up to 30s) would hold the GVL and freeze the
+//! entire Ruby VM — including any Ruby thread serving as the peer.
+//! This is the standard MRI mechanism: release the GVL for the
+//! duration of a blocking FFI call, reacquire before touching Ruby
+//! objects again. The closure must not touch the Ruby API.
+
+use std::ffi::c_void;
+
+unsafe extern "C" {
+    fn rb_thread_call_without_gvl(
+        func: extern "C" fn(*mut c_void) -> *mut c_void,
+        data1: *mut c_void,
+        ubf: Option<extern "C" fn(*mut c_void) -> *mut c_void>,
+        data2: *mut c_void,
+    ) -> *mut c_void;
+}
+
+struct CallBox<F: FnOnce() -> T, T> {
+    func: Option<F>,
+    out: Option<T>,
+}
+
+extern "C" fn trampoline<F: FnOnce() -> T, T>(data: *mut c_void) -> *mut c_void {
+    // SAFETY: data points at the CallBox constructed by without_gvl,
+    // live for the duration of the call, on this same thread.
+    let box_ = unsafe { &mut *(data as *mut CallBox<F, T>) };
+    let func = box_.func.take().expect("trampoline runs once");
+    box_.out = Some(func());
+    std::ptr::null_mut()
+}
+
+/// Run `func` with the GVL released. Reacquires before returning.
+///
+/// # Safety (caller obligations)
+///
+/// `func` must not call the Ruby C API (no Ruby objects) and must be
+/// callable from this thread while the GVL is released.
+pub unsafe fn without_gvl<F: FnOnce() -> T, T>(func: F) -> T {
+    let mut call = CallBox {
+        func: Some(func),
+        out: None,
+    };
+    // SAFETY: the trampoline and box are used per the contract above.
+    unsafe {
+        rb_thread_call_without_gvl(
+            trampoline::<F, T>,
+            &mut call as *mut CallBox<F, T> as *mut c_void,
+            None,
+            std::ptr::null_mut(),
+        );
+    }
+    call.out.take().expect("trampoline stored the result")
+}

data/ext/confium_native/src/lib.rs

@@ -9,12 +9,15 @@ mod attributes;
 mod composite;
 mod deployment;
 mod ers;
+mod gvl;
 mod openpgp_verify;
 mod path;
 mod pki;
 mod store;
 mod tc;
+mod tc_mta;
 mod net;
+mod ots;
 mod tc_session;
 mod transparency;
 mod util;
@@ -66,6 +69,8 @@ fn init(ruby: &Ruby) -> Result<(), Error> {
     native.define_module_function("winsock_probe", function!(winsock_probe_fn, 1))?;
 
     transparency::init(ruby, confium)?;
+    let transparency = confium.define_module("Transparency")?;
+    ots::init(ruby, transparency)?;
     openpgp_verify::init(ruby, confium)?;
     #[cfg(feature = "pgp")]
     openpgp_verify::init_pgp(ruby, &confium)?;

data/ext/confium_native/src/ots.rs

@@ -0,0 +1,183 @@
+//! Confium::Transparency::OTS — OpenTimestamps calendar client.
+//!
+//! Binds confium-transparency's real wire-protocol client (0.9):
+//! `stamp` POSTs the 32-byte digest to a calendar server and parses
+//! the returned partial proof (op stream + pending attestation);
+//! `upgrade` fetches a more complete proof; `verify` replays the op
+//! tree from the digest and classifies the attestations. Network
+//! errors surface as Ruby exceptions — there is no silent nil.
+
+use std::cell::RefCell;
+
+use confium_transparency::ots::OtsClient;
+use confium_transparency::ots::wire;
+use magnus::prelude::*;
+use magnus::Error;
+use magnus::RHash;
+use magnus::RString;
+use magnus::Ruby;
+use magnus::TypedData;
+use magnus::DataTypeFunctions;
+
+/// An OTS proof: the raw .ots file bytes plus the digest it anchors.
+#[derive(TypedData, DataTypeFunctions)]
+#[magnus(class = "Confium::Transparency::OTS::Proof", size)]
+pub struct OtsProof {
+    digest: Vec<u8>,
+    bytes: Vec<u8>,
+}
+
+fn digest_arg_error() -> Error {
+    Error::new(magnus::exception::arg_error(), "digest must be exactly 32 bytes")
+}
+
+impl OtsProof {
+    fn initialize(_ruby: &Ruby, digest: RString, bytes: RString) -> Result<Self, Error> {
+        let digest = digest.to_bytes().to_vec();
+        if digest.len() != 32 {
+            return Err(digest_arg_error());
+        }
+        Ok(Self {
+            digest,
+            bytes: bytes.to_bytes().to_vec(),
+        })
+    }
+
+    fn digest(&self) -> RString {
+        RString::from_slice(&self.digest)
+    }
+
+    fn to_bytes(&self) -> RString {
+        RString::from_slice(&self.bytes)
+    }
+
+    /// Replay the proof tree and classify attestations. Returns a Hash:
+    /// { pending: [uri, ...], bitcoin: [height, ...],
+    ///   litecoin: [height, ...], anchored: bool }
+    fn verify(&self) -> Result<RHash, Error> {
+        let ruby = Ruby::get().map_err(|_| Error::new(magnus::exception::runtime_error(), "not on Ruby thread"))?;
+        let file = wire::parse(&self.digest, &self.bytes)
+            .map_err(|e| Error::new(parse_error_class(&ruby), format!("invalid OTS proof: {e}")))?;
+        let summary = wire::verify(&file)
+            .map_err(|e| Error::new(ruby.exception_runtime_error(), format!("replay failed: {e}")))?;
+
+        let out = RHash::new();
+        let pending: Vec<String> = summary
+            .pending
+            .iter()
+            .map(|(_, uri)| uri.clone())
+            .collect();
+        out.aset(
+            "pending",
+            ruby.into_value(ruby.ary_from_vec(pending)),
+        )?;
+        let bitcoin: Vec<i64> = summary.bitcoin.iter().map(|(_, h)| i64::from(*h)).collect();
+        out.aset(
+            "bitcoin",
+            ruby.into_value(ruby.ary_from_vec(bitcoin)),
+        )?;
+        let litecoin: Vec<i64> = summary.litecoin.iter().map(|(_, h)| i64::from(*h)).collect();
+        out.aset(
+            "litecoin",
+            ruby.into_value(ruby.ary_from_vec(litecoin)),
+        )?;
+        // Bitcoin/Litecoin attestations are on-chain anchors; pending
+        // means recorded at a calendar awaiting confirmation.
+        let anchored = !summary.bitcoin.is_empty() || !summary.litecoin.is_empty();
+        out.aset("anchored", ruby.into_value(anchored))?;
+        Ok(out)
+    }
+}
+
+/// A calendar client bound to a server pool.
+#[derive(TypedData, DataTypeFunctions)]
+#[magnus(class = "Confium::Transparency::OTS::Client", size)]
+pub struct Client {
+    inner: RefCell<OtsClient>,
+}
+
+impl Client {
+    fn initialize(_ruby: &Ruby, servers: Vec<String>) -> Result<Self, Error> {
+        Ok(Self {
+            inner: RefCell::new(OtsClient::with_servers(servers)),
+        })
+    }
+
+    /// Submit a 32-byte digest to the calendar pool. Returns a Proof
+    /// carrying the returned partial proof (pending attestation).
+    fn stamp(&self, digest: RString) -> Result<OtsProof, Error> {
+        let ruby = Ruby::get().map_err(|_| Error::new(magnus::exception::runtime_error(), "not on Ruby thread"))?;
+        let digest = digest.to_bytes().to_vec();
+        if digest.len() != 32 {
+            return Err(digest_arg_error());
+        }
+        let arr: [u8; 32] = digest.as_slice().try_into().map_err(|_| digest_arg_error())?;
+        let mut inner = self.inner.borrow_mut();
+        // Release the GVL for the network round trip: calendars take
+        // seconds-to-tens-of-seconds, and holding the VM would freeze
+        // every Ruby thread (including any in-process peer).
+        let stamped = unsafe {
+            crate::gvl::without_gvl(|| inner.stamp_wire(arr))
+        };
+        let file = stamped
+            .map_err(|e| Error::new(ruby.exception_io_error(), format!("calendar stamp failed: {e}")))?;
+        let bytes = wire::serialize(&file).map_err(|e| {
+            Error::new(
+                ruby.exception_runtime_error(),
+                format!("calendar returned an unserializable proof: {e}"),
+            )
+        })?;
+        Ok(OtsProof { digest, bytes })
+    }
+
+    /// Fetch a more complete proof for a pending attestation. Returns
+    /// the upgraded Proof (replaces the pending one).
+    fn upgrade(&self, proof: &OtsProof) -> Result<OtsProof, Error> {
+        let ruby = Ruby::get().map_err(|_| Error::new(magnus::exception::runtime_error(), "not on Ruby thread"))?;
+        let file = wire::parse(&proof.digest, &proof.bytes)
+            .map_err(|e| Error::new(parse_error_class(&ruby), format!("invalid OTS proof: {e}")))?;
+        let mut inner = self.inner.borrow_mut();
+        let upgraded_result = unsafe { crate::gvl::without_gvl(|| inner.upgrade(&file)) };
+        let upgraded = upgraded_result
+            .map_err(|e| Error::new(ruby.exception_io_error(), format!("calendar upgrade failed: {e}")))?;
+        let bytes = wire::serialize(&upgraded).map_err(|e| {
+            Error::new(
+                ruby.exception_runtime_error(),
+                format!("calendar returned an unserializable proof: {e}"),
+            )
+        })?;
+        Ok(OtsProof {
+            digest: proof.digest.clone(),
+            bytes,
+        })
+    }
+}
+
+pub fn init(ruby: &Ruby, parent: magnus::RModule) -> Result<(), Error> {
+    let ots = parent.define_module("OTS")?;
+    let parse_error = ots.define_error("ParseError", ruby.exception_standard_error())?;
+    ots.const_set("PARSE_ERROR", parse_error)?;
+
+    let proof = ots.define_class("Proof", ruby.class_object())?;
+    proof.define_singleton_method("new", magnus::function!(OtsProof::initialize, 2))?;
+    proof.define_method("digest", magnus::method!(OtsProof::digest, 0))?;
+    proof.define_method("to_bytes", magnus::method!(OtsProof::to_bytes, 0))?;
+    proof.define_method("verify", magnus::method!(OtsProof::verify, 0))?;
+
+    let client = ots.define_class("Client", ruby.class_object())?;
+    client.define_singleton_method("new", magnus::function!(Client::initialize, 1))?;
+    client.define_method("stamp", magnus::method!(Client::stamp, 1))?;
+    client.define_method("upgrade", magnus::method!(Client::upgrade, 1))?;
+
+    Ok(())
+}
+
+fn parse_error_class(ruby: &Ruby) -> magnus::ExceptionClass {
+    ruby
+        .class_object()
+        .const_get::<_, magnus::RModule>("Confium")
+        .and_then(|m| m.const_get::<_, magnus::RModule>("Transparency"))
+        .and_then(|m| m.const_get::<_, magnus::RModule>("OTS"))
+        .and_then(|m| m.const_get::<_, magnus::ExceptionClass>("PARSE_ERROR"))
+        .unwrap_or_else(|_| ruby.exception_runtime_error())
+}

data/ext/confium_native/src/tc.rs

@@ -232,6 +232,7 @@ pub fn init(ruby: &Ruby, parent: magnus::RModule) -> Result<(), Error> {
     let cmp20 = tc.define_module("Cmp20")?;
     cmp20.define_module_function("keygen", function!(cmp20_keygen, 2))?;
     cmp20.define_module_function("sign", function!(cmp20_sign, 3))?;
+    crate::tc_mta::init(ruby, &cmp20)?;
 
     let gg18 = tc.define_module("Gg18")?;
     gg18.define_module_function("keygen", function!(gg18_keygen, 2))?;