confium 0.3.0 → 0.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 36b9e9d9aa6a0b038c85ea24caefa5d0e16e9a4efda0bc9a73b1558cc2b52d97
-  data.tar.gz: d2490e0cf9169a5bf7f05a74600d0a0de115a13d2bb08d58e3e5e121cbe39d2c
+  metadata.gz: 975eebface92795a6a5493274a696fae3bd9bc451fdd8011be74af8ab5bf7b9b
+  data.tar.gz: a0b92a831f5391175e789fbc02ad5e674d097b20d92e1fd7059cc91890a9fbc8
 SHA512:
-  metadata.gz: fd4fde001b8e29ce40d58df86914b2ef6f5322d48bee02858df0a954a7e1575ef4ce42750acd27830bbe1e4ad6e247df56931c9bd8ee1eff0f25b9477fed8602
-  data.tar.gz: 8b99c6f42ee573a1075fc950dc49ec167b3bde4180243df990c2fcab946d2c5a10af6f226434005158e740441dd84097f0efcd2ce0ee72e187e5792237dbc8df
+  metadata.gz: 244d4c7edcafe5cc22234cc3ad58676f765e8b840c22b1427817d3ed6e33f22cb5f57415cc2fdc7dccf7faa2bad217ec50ede0ea6a4bfd859ae3ea61ed6e5c25
+  data.tar.gz: 8a71c86a8b467209b49e1526d0be8a9c35d528e339851db5703e7a0e64993c70d6d68ea8198c8c22649daa1e3688fabaad8d9d2eb8a32dfb2502ca225e4fb38e

data/CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## [0.3.1] — 2026-08-21
+
+Native platform gems (linux x86_64/aarch64, macOS x86_64/arm64,
+Windows x64-mingw-ucrt) ship alongside the source gem — `gem install`
+no longer needs a Rust toolchain on those platforms.
+
+### Added
+
+- ERS archival binding (`Confium::EvidenceRecord`, RFC 4998) and the
+  `CONFIUM_LIB` explicit dylib path override.
+- Audit log bindings with sign-triggered autofire and an Enumerable
+  `MemorySink`.
+- Typed error hierarchy across all subsystems with native-error
+  coercion.
+- CMP20/GG18 in-process threshold ECDSA (`Confium::TC::Cmp20`,
+  `Confium::TC::Gg18`) and TC share files with the documented
+  envelope shape.
+- Twenty worked examples plus the examples and CNML-profile guides.
+
+### Fixed
+
+- The PKI CSR spec no longer shells out to the openssl CLI (it
+  generated its fixture with a key file that was never created).
+- CI: first `.rubocop.yml`, Ruby-3.1-compatible lockfile, and a test
+  matrix matching the shipped platforms.
+
 ## [0.3.0] — 2026-08-04
 
 Synced with Confium Rust workspace v0.3.0 (product restructuring).

data/Cargo.lock

@@ -1,6 +1,6 @@
 # This file is automatically @generated by Cargo.
 # It is not intended for manual editing.
-version = 3
+version = 4
 
 [[package]]
 name = "adler2"
@@ -239,6 +239,8 @@ dependencies = [
 [[package]]
 name = "confium-api"
 version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "edbc3fc8f6518e979ff76837b40c543b85bfc764bac2855d87ae79c68cbfcc5a"
 dependencies = [
  "confium-macros",
  "inventory",
@@ -273,6 +275,8 @@ dependencies = [
 [[package]]
 name = "confium-coordinator"
 version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8c96d4d5997726cf0eb794410e3e8bbce839cfba9c4a32e26ede0c076b02e64"
 dependencies = [
  "chrono",
  "confium-api",
@@ -310,6 +314,45 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "confium-crypto-vss"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19bea8bcb5a76b88ccca2471352176ea234e86c1360982f4a1d7357c2f89ab73"
+dependencies = [
+ "hex",
+ "hmac",
+ "num-bigint",
+ "num-integer",
+ "num-traits",
+ "p256",
+ "rand",
+ "rand_core",
+ "serde",
+ "serde_json",
+ "sha2",
+ "subtle",
+ "thiserror",
+]
+
+[[package]]
+name = "confium-crypto-zk"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f65c763c1e55aee550db1ba49ba0b97fbfd8373766e4ca48d9ca742897c82f34"
+dependencies = [
+ "hex",
+ "hmac",
+ "num-bigint",
+ "num-traits",
+ "p256",
+ "rand_core",
+ "serde",
+ "serde_json",
+ "sha2",
+ "thiserror",
+]
+
 [[package]]
 name = "confium-deployment"
 version = "0.3.0"
@@ -329,6 +372,8 @@ dependencies = [
 [[package]]
 name = "confium-macros"
 version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "783f0dbfa6cd490f4670a5491254f4122d1f87604931724d99a2de37f0a73123"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -338,6 +383,8 @@ dependencies = [
 [[package]]
 name = "confium-net"
 version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "98a17fd08f3f04772fa0227e0855d38d7de0637996fb44e058da098e069fab28"
 dependencies = [
  "confium-api",
  "inventory",
@@ -345,6 +392,21 @@ dependencies = [
  "url",
 ]
 
+[[package]]
+name = "confium-observability"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "767f898b6437a5cc67d403140bcf8cd1dbffa35a450afe28c64147e3175ee091"
+dependencies = [
+ "chrono",
+ "hex",
+ "hmac",
+ "rand_core",
+ "serde",
+ "serde_json",
+ "sha2",
+]
+
 [[package]]
 name = "confium-pki"
 version = "0.3.1"
@@ -363,9 +425,31 @@ dependencies = [
  "x509-cert",
 ]
 
+[[package]]
+name = "confium-privacy"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dcbe8f16e42291a63bcc480745653aa1ad993982fb708531778270de9677dd9"
+dependencies = [
+ "chrono",
+ "hex",
+ "hmac",
+ "num-bigint",
+ "num-traits",
+ "p256",
+ "rand",
+ "rand_core",
+ "serde",
+ "serde_json",
+ "sha2",
+ "thiserror",
+]
+
 [[package]]
 name = "confium-store"
 version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "66f760cf6182b532f7746b95842e2b4599ab78a5bbe35af2992df309417e5975"
 dependencies = [
  "confium-api",
  "inventory",
@@ -374,7 +458,9 @@ dependencies = [
 
 [[package]]
 name = "confium-tc"
-version = "0.3.0"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3dd7d4965aef12324cb76d397294c317b83b774de029f1d37b387cf54ba9593c"
 dependencies = [
  "chrono",
  "confium-api",
@@ -405,7 +491,9 @@ dependencies = [
 
 [[package]]
 name = "confium-tc-cmp20"
-version = "0.3.0"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f28758121e44a86beefdf54a63428ab9bd9ec7a3797f7c065351b876518815c"
 dependencies = [
  "confium-tc",
  "confium-tc-core",
@@ -426,6 +514,8 @@ dependencies = [
 [[package]]
 name = "confium-tc-core"
 version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "add3e15337ce81944f78c9ce844d870a081cbe91506a85b9a5c4e4c0da983771"
 dependencies = [
  "chrono",
  "confium-api",
@@ -477,7 +567,9 @@ dependencies = [
 
 [[package]]
 name = "confium-tc-gg18"
-version = "0.3.0"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f5e3522da6c2352ff26f1a0719781e8f392cdfb7c264c681c87d0f0207540384"
 dependencies = [
  "confium-tc",
  "confium-tc-core",
@@ -494,6 +586,8 @@ dependencies = [
 [[package]]
 name = "confium-tc-keys"
 version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "476fce2efcefa4d7a48cfe5accecd1bc3f39959b5ea719fdedac9cfcbfeeb710"
 dependencies = [
  "chrono",
  "confium-tc-core",
@@ -525,15 +619,21 @@ dependencies = [
 
 [[package]]
 name = "confium_native"
-version = "0.1.0"
+version = "0.3.0"
 dependencies = [
  "chrono",
  "confium-attributes",
  "confium-composite",
  "confium-core",
+ "confium-crypto-vss",
+ "confium-crypto-zk",
  "confium-deployment",
+ "confium-observability",
  "confium-pki",
+ "confium-privacy",
+ "confium-tc",
  "confium-tc-cmp20",
+ "confium-tc-core",
  "confium-tc-elgamal-p256",
  "confium-tc-frost-p256",
  "confium-tc-gg18",

data/Rakefile

@@ -1,16 +1,16 @@
 # frozen_string_literal: true
 
-require "bundler/gem_tasks"
-require "rspec/core/rake_task"
+require 'bundler/gem_tasks'
+require 'rspec/core/rake_task'
 RSpec::Core::RakeTask.new(:spec)
 
-require "rubocop/rake_task"
+require 'rubocop/rake_task'
 RuboCop::RakeTask.new
 
-require "rb_sys/extensiontask"
-gemspec = Gem::Specification.load("confium.gemspec")
-RbSys::ExtensionTask.new("confium_native", gemspec) do |ext|
-  ext.lib_dir = "lib/confium_native"
+require 'rb_sys/extensiontask'
+gemspec = Gem::Specification.load('confium.gemspec')
+RbSys::ExtensionTask.new('confium_native', gemspec) do |ext|
+  ext.lib_dir = 'lib/confium_native'
 end
 
 task compile: :clean

data/confium.gemspec

@@ -1,35 +1,35 @@
 # frozen_string_literal: true
 
-require_relative "lib/confium/version"
+require_relative 'lib/confium/version'
 
 Gem::Specification.new do |spec|
-  spec.name = "confium"
+  spec.name = 'confium'
   spec.version = Confium::VERSION
   spec.platform = Gem::Platform::RUBY
 
-  spec.authors = ["Ribose Open"]
-  spec.email = ["open.source@ribose.com"]
+  spec.authors = ['Ribose Open']
+  spec.email = ['open.source@ribose.com']
 
-  spec.summary = "Ruby bindings for the Confium multi-stakeholder threshold cryptography framework."
-  spec.description = "Confium provides threshold cryptography for Ruby: FROST / CMP20 / GG18 " \
-                     "signing sessions, X.509 certificate issuance (CNML-ready), composite " \
-                     "PQ-migration signatures, and transparency-log anchoring. Powered by a " \
-                     "Rust native extension (magnus + rb_sys) — no separate C ABI to install."
-  spec.homepage = "https://www.confium.org"
-  spec.license = "BSD-2-Clause"
+  spec.summary = 'Ruby bindings for the Confium multi-stakeholder threshold cryptography framework.'
+  spec.description = 'Confium provides threshold cryptography for Ruby: FROST / CMP20 / GG18 ' \
+                     'signing sessions, X.509 certificate issuance (CNML-ready), composite ' \
+                     'PQ-migration signatures, and transparency-log anchoring. Powered by a ' \
+                     'Rust native extension (magnus + rb_sys) — no separate C ABI to install.'
+  spec.homepage = 'https://www.confium.org'
+  spec.license = 'BSD-2-Clause'
 
   spec.metadata = {
-    "bug_tracker_uri" => "https://github.com/confium/confium-ruby/issues",
-    "changelog_uri" => "https://github.com/confium/confium-ruby/blob/main/CHANGELOG.md",
-    "homepage_uri" => spec.homepage,
-    "source_code_uri" => "https://github.com/confium/confium-ruby",
-    "rubygems_mfa_required" => "true",
+    'bug_tracker_uri' => 'https://github.com/confium/confium-ruby/issues',
+    'changelog_uri' => 'https://github.com/confium/confium-ruby/blob/main/CHANGELOG.md',
+    'homepage_uri' => spec.homepage,
+    'source_code_uri' => 'https://github.com/confium/confium-ruby',
+    'rubygems_mfa_required' => 'true'
   }
 
   # Rust extension — compiled at gem install via rb_sys.
-  spec.extensions = ["ext/confium_native/extconf.rb"]
+  spec.extensions = ['ext/confium_native/extconf.rb']
 
-  spec.files = Dir.glob("{lib,ext}/**/*") + %w[
+  spec.files = Dir.glob('{lib,ext}/**/*') + %w[
     CHANGELOG.md
     LICENSE.txt
     Rakefile
@@ -40,17 +40,17 @@ Gem::Specification.new do |spec|
   ]
   spec.files.reject! { |f| File.directory?(f) }
   spec.files.reject! { |f| f =~ /\.(dll|so|dylib|lib|bundle)\Z/ }
-  spec.require_paths = ["lib"]
+  spec.require_paths = ['lib']
 
-  spec.required_ruby_version = ">= 3.1.0"
+  spec.required_ruby_version = '>= 3.1.0'
 
   # Required for the Rust extension.
-  spec.add_dependency "rb_sys", "~> 0.9.39"
-
-  spec.add_development_dependency "rake", "~> 13.0"
-  spec.add_development_dependency "rake-compiler", "~> 1.2.0"
-  spec.add_development_dependency "rake-compiler-dock", "~> 1.3"
-  spec.add_development_dependency "rspec", "~> 3.0"
-  spec.add_development_dependency "rubocop", "~> 1.0"
-  spec.add_development_dependency "steep", "~> 1.5"
+  spec.add_dependency 'rb_sys', '~> 0.9.39'
+
+  spec.add_development_dependency 'rake', '~> 13.0'
+  spec.add_development_dependency 'rake-compiler', '~> 1.2.0'
+  spec.add_development_dependency 'rake-compiler-dock', '~> 1.3'
+  spec.add_development_dependency 'rspec', '~> 3.0'
+  spec.add_development_dependency 'rubocop', '~> 1.0'
+  spec.add_development_dependency 'steep', '~> 1.5'
 end

data/ext/confium_native/Cargo.toml

@@ -50,6 +50,7 @@ ed25519-dalek = { version = "2", features = ["rand_core"] }
 rand_core = { version = "0.6", default-features = false, features = ["getrandom"] }
 
 sha2 = "0.10"
+subtle = "2"
 chrono = "0.4"
 hex = "0.4"
 serde_json = "1"

data/ext/confium_native/extconf.rb

@@ -1,10 +1,10 @@
 # frozen_string_literal: true
 
-require "mkmf"
-require "rb_sys/mkmf"
+require 'mkmf'
+require 'rb_sys/mkmf'
 
-create_rust_makefile("confium_native") do |r|
-  r.profile = ENV.fetch("RB_SYS_CARGO_PROFILE", :dev).to_sym
+create_rust_makefile('confium_native') do |r|
+  r.profile = ENV.fetch('RB_SYS_CARGO_PROFILE', :dev).to_sym
   r.use_stable_api_compiled_fallback = true
   r.force_install_rust_toolchain = false
 end

data/ext/confium_native/src/attributes.rs

@@ -12,7 +12,7 @@
 
 use confium_attributes::{evaluate, parse as dsl_parse, Predicate, SignerAttributes};
 use magnus::{
-    exception, function, method, prelude::*, typed_data::Obj, DataTypeFunctions, Error, Module,
+    exception, function, method, typed_data::Obj, DataTypeFunctions, Error, Module,
     Object, Ruby, TryConvert, TypedData, Value,
 };
 

data/ext/confium_native/src/audit.rs

@@ -11,7 +11,7 @@
 //! sink raises, the calling operation still succeeds. Audit
 //! failures must never break a signing ceremony.
 
-use magnus::{exception, function, prelude::*, Error, Module, Object, RHash, Ruby, Value};
+use magnus::{exception, function, prelude::*, Error, Module, Ruby, Value};
 use sha2::{Digest, Sha256};
 
 const SINK_IVAR: &str = "@sink";

data/ext/confium_native/src/composite.rs

@@ -12,7 +12,7 @@
 //!     with `#all_verified?` and `#per_component` accessors.
 
 use confium_composite::{CompositeSignature, ComponentSignature, VerificationResult};
-use ed25519_dalek::{Signer, SigningKey};
+use ed25519_dalek::SigningKey;
 use magnus::{
     exception, function, method, prelude::*, scan_args,
     typed_data::Obj, DataTypeFunctions, Error, IntoValue,

data/ext/confium_native/src/deployment.rs

@@ -12,7 +12,7 @@ use confium_deployment::{
     validate::validate_manifest,
 };
 use crate::util::enforce_size;
-use magnus::{exception, function, method, prelude::*, typed_data::Obj, DataTypeFunctions, Error, Module, Object, Ruby, TypedData};
+use magnus::{exception, function, method, typed_data::Obj, DataTypeFunctions, Error, Module, Object, Ruby, TypedData};
 
 #[derive(TypedData, DataTypeFunctions)]
 #[magnus(class = "Confium::Identity::Actor", size)]

data/ext/confium_native/src/ers.rs

@@ -5,7 +5,7 @@ use confium_transparency::ers::{
     EvidenceRecord, HashAlgorithm,
 };
 use magnus::{
-    exception, function, method, prelude::*, typed_data::Obj,
+    exception, function, method, typed_data::Obj,
     DataTypeFunctions, Error, Module, Object, Ruby, TryConvert, TypedData, Value,
 };
 

data/ext/confium_native/src/openpgp.rs

@@ -39,7 +39,7 @@ fn native_dearmor(ruby: &Ruby, data: Value) -> Result<magnus::RString, Error> {
 }
 
 /// Initialize the `Confium::OpenPGP` module.
-pub fn init(ruby: &Ruby, parent: RModule) -> Result<(), Error> {
+pub fn init(_ruby: &Ruby, parent: RModule) -> Result<(), Error> {
     let openpgp = parent.define_module("OpenPGP")?;
 
     openpgp.define_singleton_method("_native_armor", function!(native_armor, 2))?;

data/ext/confium_native/src/path.rs

@@ -10,7 +10,7 @@ use confium_pki::{
     path::{validate_path, CertPath},
     result::VerificationResult as PathVerificationResult,
 };
-use magnus::{exception, function, method, prelude::*, DataTypeFunctions, Error, Module, Object, Ruby, TypedData, Value};
+use magnus::{exception, function, method, prelude::*, DataTypeFunctions, Error, Module, Ruby, TypedData, Value};
 
 /// Wraps a confium_pki::path::VerificationResult.
 #[derive(TypedData, DataTypeFunctions)]

data/ext/confium_native/src/pki.rs

@@ -205,7 +205,7 @@ impl SignedData {
     /// any standards-compliant CMS consumer.
     fn to_der(&self) -> Result<RString, Error> {
         let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
-        let der = encode_signed_data_der(&*self.inner.borrow())
+        let der = encode_signed_data_der(&self.inner.borrow())
             .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
         Ok(bytes_to_rstring(&ruby, &der))
     }

data/ext/confium_native/src/tc.rs

@@ -97,7 +97,7 @@ fn recover(shares_value: Value) -> Result<magnus::RString, Error> {
     let secret = recover_secret(&refs)
         .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
     let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
-    Ok(bytes_to_rstring(&ruby, &scalar_to_bytes(&secret).to_vec()))
+    Ok(bytes_to_rstring(&ruby, scalar_to_bytes(&secret).as_ref()))
 }
 
 fn keypair(ruby: &Ruby) -> Result<RHash, Error> {
@@ -105,7 +105,7 @@ fn keypair(ruby: &Ruby) -> Result<RHash, Error> {
     let result = ruby.hash_new();
     let signing_bytes = kp.to_signing_key().to_bytes();
     let verifying_bytes = kp.to_verifying_key().to_sec1_bytes();
-    result.aset("private_key", bytes_to_rstring(ruby, &signing_bytes.to_vec()))?;
+    result.aset("private_key", bytes_to_rstring(ruby, &signing_bytes))?;
     result.aset("public_key", bytes_to_rstring(ruby, &verifying_bytes))?;
     Ok(result)
 }

data/ext/confium_native/src/transparency.rs

@@ -11,7 +11,7 @@ use confium_transparency::{
 };
 use magnus::{
     exception, function, method, prelude::*, typed_data::Obj, DataTypeFunctions, Error, IntoValue,
-    Module, Object, RHash, RString, Ruby, TryConvert, TypedData, Value,
+    Module, Object, RString, Ruby, TryConvert, TypedData, Value,
 };
 
 #[derive(TypedData, DataTypeFunctions)]
@@ -221,7 +221,8 @@ impl InclusionProofWrap {
                 Side::Right => hash_internal(current, step.sibling),
             };
         }
-        Ok(current == root)
+        use subtle::ConstantTimeEq;
+        Ok(current.ct_eq(&root).into())
     }
 
     /// External-auditor inclusion verification. Accepts an explicit
@@ -255,7 +256,8 @@ impl InclusionProofWrap {
                 Side::Right => hash_internal(current, step.sibling),
             };
         }
-        Ok(current == root)
+        use subtle::ConstantTimeEq;
+        Ok(current.ct_eq(&root).into())
     }
 }
 

data/ext/confium_native/src/util.rs

@@ -134,6 +134,7 @@ pub fn new_details(ruby: &Ruby) -> RHash {
 // only the domain-specific fields; :operation and :component are
 // filled automatically.
 
+#[allow(dead_code)]
 pub fn parse_error(msg: impl Into<String>, operation: &str, format: Option<&str>, offset: Option<usize>) -> Error {
     let ruby = match Ruby::get() {
         Ok(r) => r,
@@ -147,6 +148,7 @@ pub fn parse_error(msg: impl Into<String>, operation: &str, format: Option<&str>
     confium_error(msg, "ParseError", d)
 }
 
+#[allow(dead_code)]
 pub fn validation_error(msg: impl Into<String>, operation: &str, param: &str, expected: &str, actual: &str) -> Error {
     let ruby = match Ruby::get() {
         Ok(r) => r,
@@ -160,6 +162,7 @@ pub fn validation_error(msg: impl Into<String>, operation: &str, param: &str, ex
     confium_error(msg, "ValidationError", d)
 }
 
+#[allow(dead_code)]
 pub fn verification_error(msg: impl Into<String>, operation: &str, signer_index: Option<usize>, algorithm: Option<&str>) -> Error {
     let ruby = match Ruby::get() {
         Ok(r) => r,
@@ -172,6 +175,7 @@ pub fn verification_error(msg: impl Into<String>, operation: &str, signer_index:
     confium_error(msg, "VerificationError", d)
 }
 
+#[allow(dead_code)]
 pub fn crypto_error(msg: impl Into<String>, operation: &str, primitive: &str) -> Error {
     let ruby = match Ruby::get() {
         Ok(r) => r,
@@ -183,6 +187,7 @@ pub fn crypto_error(msg: impl Into<String>, operation: &str, primitive: &str) ->
     confium_error(msg, "CryptoError", d)
 }
 
+#[allow(dead_code)]
 pub fn threshold_error(msg: impl Into<String>, operation: &str, have: usize, need: usize) -> Error {
     let ruby = match Ruby::get() {
         Ok(r) => r,

data/lib/confium/audit.rb

@@ -12,8 +12,8 @@
 # per record). Custom sinks can subclass {Sink} for HTTP / syslog /
 # Kafka backends.
 
-require "json"
-require "time"
+require 'json'
+require 'time'
 
 module Confium
   module Audit
@@ -81,8 +81,8 @@ module Confium
       end
 
       # Enumerable contract: yield each record in insertion order.
-      def each(&block)
-        @records.each(&block)
+      def each(&)
+        @records.each(&)
       end
     end
 
@@ -109,7 +109,7 @@ module Confium
 
       def initialize(path)
         @path = path
-        @io = File.open(path, "a")
+        @io = File.open(path, 'a')
         @io.sync = true
       end
 

data/lib/confium/cfm.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'ffi'
 
 module Confium
@@ -17,6 +19,5 @@ module Confium
     def load_plugin(name, path)
       Confium.call_ffi(:cfm_plugin_load, @ptr, name, path, nil, nil)
     end
-
   end
 end

data/lib/confium/digest.rb

@@ -1,10 +1,11 @@
+# frozen_string_literal: true
+
 require 'ffi'
 require 'digest'
 
 module Confium
   class Digest < ::Digest::Class
-    attr_reader :name
-    attr_reader :ptr
+    attr_reader :name, :ptr
 
     def initialize(cfm, name)
       @name = name
@@ -12,6 +13,7 @@ module Confium
       Confium.call_ffi(:cfm_hash_create, cfm.ptr, pptr, name, nil, nil, nil)
       ptr = pptr.read_pointer
       raise if ptr.null?
+
       @ptr = ::FFI::AutoPointer.new(ptr, self.class.method(:destroy))
     end
 

data/lib/confium/errors/coerce.rb

@@ -39,9 +39,7 @@ module Confium
           kwargs = message.transform_keys(&:to_sym).merge(kwargs)
           message = kwargs.delete(:message)
         end
-        if details_hash.is_a?(Hash)
-          kwargs = details_hash.transform_keys(&:to_sym).merge(kwargs)
-        end
+        kwargs = details_hash.transform_keys(&:to_sym).merge(kwargs) if details_hash.is_a?(Hash)
         [message, kwargs]
       end
     end

data/lib/confium/errors/crypto_error.rb

@@ -2,12 +2,14 @@
 
 # Raised when a primitive-level crypto operation fails (invalid scalar,
 # bad key derivation).
-class Confium::CryptoError < Confium::Error
-  attr_reader :primitive
+module Confium
+  class CryptoError < Confium::Error
+    attr_reader :primitive
 
-  def initialize(message = nil, details_hash = nil, **kwargs)
-    message, kwargs = Confium::Errors::Coerce.args(message, details_hash, kwargs)
-    @primitive = kwargs.delete(:primitive)
-    super(message, details: { primitive: @primitive, **kwargs })
+    def initialize(message = nil, details_hash = nil, **kwargs)
+      message, kwargs = Confium::Errors::Coerce.args(message, details_hash, kwargs)
+      @primitive = kwargs.delete(:primitive)
+      super(message, details: { primitive: @primitive, **kwargs })
+    end
   end
 end