confium 0.3.3 → 0.3.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4c325019a3961cbf877d81c11496cfccba51959282d930b1e5e0420b25b66958
-  data.tar.gz: 91ea66bd4a9541e38ce7c01c03c26408a8372debdce0539c13ab70aee4895970
+  metadata.gz: fdc8059371955b1e4ee89982856fb39a1fb758c9d1b3264bb2f3bd21fe77c028
+  data.tar.gz: a392f2b3d8b87e4d296f5f68dec94e61ae3e2263eea032f12240b2f625b7ba56
 SHA512:
-  metadata.gz: e70d630fd442cf891ff15cdd27fc335281488ca5c5985f298337559ad9caf2dfb77bdf7993dd47f766116512bff4e3a53e2939b55cc8b91f77744176780faaf5
-  data.tar.gz: 3f389ce934ed8f8f81bb13e87346f07b49d06f48acb1196c3774e7c01f1ad810185f22b6708edb0d887193afef4d5d850c3cd4fb6c58e2b246aae09300f5e419
+  metadata.gz: ccdae726768ecf965b3f21f000b42bbc7c67a01b31d7715a2f23f0e243873453da7539ae57fbfb0ffda185d3ea572b74d0f3c033518e1e154fdc0b739db0b1b1
+  data.tar.gz: db63f19d08cf86076df52ec0f583493019e03a1512268aa1d83b56edce182d42c18120369e46ca054e66dfdf79619b04fdfe91175607845260cc668894fa680d

data/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## [0.3.4] — 2026-08-23
+
+### Fixed
+
+- **Typed-error sweep completed.** Crypto operation failures
+  (FrostP256 sign, ElGamal encapsulate/decrypt/aggregate, composite
+  sign) raise `Confium::CryptoError` with the primitive in `details`;
+  `PathValidator` DER extraction failures raise `Confium::ParseError`;
+  `Manifest#tier_name_at` and `SignedData#certificate_at` out-of-range
+  raise the typed `Confium::IndexError` (unifying with the
+  transparency proofs — they previously raised Ruby's core
+  `IndexError`).
+- **Zero compiler warnings.** All 80 direct
+  `magnus::exception::*` constructor sites are centralized into
+  `util::runtime`/`util::arg_error` (the deprecated API survives in
+  exactly one module whose job is wrapping it); the remaining magnus
+  deprecations (`RString::buf_new`, `RArray::each`) and dead imports
+  are fixed.
+- **DoS guard now covers every byte input**: the duplicate local
+  `bytes_from_value` copies in tc/transparency — one of which
+  skipped the 1 MiB size cap — are consolidated onto the util
+  version that enforces it.
+
 ## [0.3.3] — 2026-08-23
 
 ### Added

data/ext/confium_native/src/attributes.rs

@@ -12,7 +12,7 @@
 
 use confium_attributes::{evaluate, parse as dsl_parse, Predicate, SignerAttributes};
 use magnus::{
-    exception, function, method, typed_data::Obj, DataTypeFunctions, Error, Module,
+    function, method, typed_data::Obj, DataTypeFunctions, Error, Module,
     Object, Ruby, TryConvert, TypedData, Value,
 };
 
@@ -26,8 +26,8 @@ impl PredicateWrap {
     fn satisfied_by(&self, signers_value: Value) -> Result<bool, Error> {
         let arr = magnus::RArray::try_convert(signers_value)?;
         let mut owned: Vec<SignerAttributes> = Vec::with_capacity(arr.len());
-        for v in arr.each() {
-            let signer_wrap = Obj::<SignerWrap>::try_convert(v?)?;
+        for v in arr.into_iter() {
+            let signer_wrap = Obj::<SignerWrap>::try_convert(v)?;
             owned.push(signer_wrap.inner.borrow().clone());
         }
         let refs: Vec<&SignerAttributes> = owned.iter().collect();
@@ -64,7 +64,7 @@ impl SignerWrap {
 fn parse(expr: String) -> Result<Obj<PredicateWrap>, Error> {
     let predicate = dsl_parse(&expr)
         .map_err(|e| crate::util::parse_error(e.to_string(), "Attributes.parse", Some("dsl"), None))?;
-    let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+    let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
     Ok(ruby.obj_wrap(PredicateWrap { inner: predicate }))
 }
 

data/ext/confium_native/src/audit.rs

@@ -11,7 +11,7 @@
 //! sink raises, the calling operation still succeeds. Audit
 //! failures must never break a signing ceremony.
 
-use magnus::{exception, function, prelude::*, Error, Module, Ruby, Value};
+use magnus::{function, prelude::*, Error, Module, Ruby, Value};
 use sha2::{Digest, Sha256};
 
 const SINK_IVAR: &str = "@sink";
@@ -94,12 +94,12 @@ fn record(
     algorithm: Option<String>,
     error: Option<String>,
 ) -> Result<(), Error> {
-    let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+    let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
     let audit_mod: magnus::RModule = ruby
         .class_object()
         .const_get("Confium")
         .and_then(|m: magnus::RModule| m.const_get("Audit"))
-        .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        .map_err(|e| crate::util::runtime(e.to_string()))?;
 
     let sink: Value = audit_mod.ivar_get(SINK_IVAR)?;
     if sink.is_nil() {
@@ -123,31 +123,31 @@ fn record(
 
     let _: Value = sink
         .funcall("call", (h,))
-        .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        .map_err(|e| crate::util::runtime(e.to_string()))?;
     Ok(())
 }
 
 /// Set the global audit sink. `callback` is a Proc that receives a Hash
 /// or nil to disable auditing.
 fn set_sink(callback: Value) -> Result<(), Error> {
-    let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+    let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
     let audit_mod: magnus::RModule = ruby
         .class_object()
         .const_get("Confium")
         .and_then(|m: magnus::RModule| m.const_get("Audit"))
-        .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        .map_err(|e| crate::util::runtime(e.to_string()))?;
     audit_mod.ivar_set(SINK_IVAR, callback)?;
     Ok(())
 }
 
 /// Get the current audit sink (or nil if not set).
 fn get_sink() -> Result<Value, Error> {
-    let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+    let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
     let audit_mod: magnus::RModule = ruby
         .class_object()
         .const_get("Confium")
         .and_then(|m: magnus::RModule| m.const_get("Audit"))
-        .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        .map_err(|e| crate::util::runtime(e.to_string()))?;
     audit_mod.ivar_get(SINK_IVAR)
 }
 

data/ext/confium_native/src/composite.rs

@@ -14,7 +14,7 @@
 use confium_composite::{CompositeSignature, ComponentSignature, VerificationResult};
 use ed25519_dalek::SigningKey;
 use magnus::{
-    exception, function, method, prelude::*, scan_args,
+    function, method, prelude::*, scan_args,
     typed_data::Obj, DataTypeFunctions, Error, IntoValue,
     Module, Object, RHash, Ruby, TryConvert, TypedData, Value,
 };
@@ -79,7 +79,7 @@ impl CompositeSig {
                 let details = new_details(&ruby);
                 confium_error(e.to_string(), "VerificationError", details)
             })?;
-        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
         Ok(ruby.obj_wrap(VerificationResultWrap { inner: result }))
     }
 }
@@ -133,7 +133,7 @@ impl VerificationResultWrap {
     }
 
     fn per_component(&self) -> Result<Value, Error> {
-        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
         let result = ruby.hash_new();
         for c in &self.inner.per_component {
             let entry = ruby.hash_new();
@@ -156,9 +156,7 @@ fn sign_ed25519(ruby: &Ruby, private_key: Value, message: Value) -> Result<RHash
     let pk_bytes = bytes_from_value(private_key)?;
     let msg = bytes_from_value(message)?;
     if pk_bytes.len() != 32 {
-        return Err(Error::new(
-            exception::arg_error(),
-            format!("Ed25519 private key must be 32 bytes, got {}", pk_bytes.len()),
+        return Err(crate::util::arg_error(format!("Ed25519 private key must be 32 bytes, got {}", pk_bytes.len()),
         ));
     }
     let mut pk_arr = [0u8; 32];
@@ -174,7 +172,7 @@ fn sign_ed25519(ruby: &Ruby, private_key: Value, message: Value) -> Result<RHash
                 Some(&msg),
                 Some(&e.to_string()),
             );
-            return Err(Error::new(exception::runtime_error(), e.to_string()));
+            return Err(crate::util::crypto_error(e.to_string(), "Composite.sign_ed25519", "ed25519"));
         }
     };
 
@@ -204,16 +202,14 @@ fn sign_p256(ruby: &Ruby, private_key: Value, message: Value) -> Result<RHash, E
     let pk_bytes = bytes_from_value(private_key)?;
     let msg = bytes_from_value(message)?;
     if pk_bytes.len() != 32 {
-        return Err(Error::new(
-            exception::arg_error(),
-            format!("P-256 private key must be 32 bytes, got {}", pk_bytes.len()),
+        return Err(crate::util::arg_error(format!("P-256 private key must be 32 bytes, got {}", pk_bytes.len()),
         ));
     }
     let mut arr = [0u8; 32];
     arr.copy_from_slice(&pk_bytes);
     use p256::ecdsa::{Signature, SigningKey, signature::Signer};
     let signing = SigningKey::from_bytes(&arr.into())
-        .map_err(|e| Error::new(exception::arg_error(), format!("invalid P-256 private key: {e}")))?;
+        .map_err(|e| crate::util::arg_error(format!("invalid P-256 private key: {e}")))?;
     let sig: Signature = match signing.try_sign(msg.as_slice()) {
         Ok(s) => s,
         Err(e) => {
@@ -224,7 +220,7 @@ fn sign_p256(ruby: &Ruby, private_key: Value, message: Value) -> Result<RHash, E
                 Some(&msg),
                 Some(&format!("sign error: {e}")),
             );
-            return Err(Error::new(exception::runtime_error(), format!("sign error: {e}")));
+            return Err(crate::util::crypto_error(format!("sign error: {e}"), "Composite.sign_p256", "ecdsa-p256"));
         }
     };
     let verifying = signing.verifying_key();
@@ -259,8 +255,8 @@ fn generate_ed25519_keypair(ruby: &Ruby) -> Result<RHash, Error> {
 fn parse_components(value: Value) -> Result<Vec<ComponentSignature>, Error> {
     let arr = magnus::RArray::try_convert(value)?;
     let mut out = Vec::with_capacity(arr.len());
-    for v in arr.each() {
-        let h: RHash = RHash::try_convert(v?)?;
+    for v in arr.into_iter() {
+        let h: RHash = RHash::try_convert(v)?;
         let algorithm: String = h.fetch::<_, String>("algorithm")?;
         let public_key: Value = h.fetch::<_, Value>("public_key")?;
         let signature: Value = h.fetch::<_, Value>("signature")?;

data/ext/confium_native/src/deployment.rs

@@ -12,7 +12,7 @@ use confium_deployment::{
     validate::validate_manifest,
 };
 use crate::util::{enforce_size, parse_error};
-use magnus::{exception, function, method, typed_data::Obj, DataTypeFunctions, Error, Module, Object, Ruby, TypedData};
+use magnus::{function, method, typed_data::Obj, DataTypeFunctions, Error, Module, Object, Ruby, TypedData};
 
 #[derive(TypedData, DataTypeFunctions)]
 #[magnus(class = "Confium::Identity::Actor", size)]
@@ -25,7 +25,7 @@ impl Actor {
         enforce_size(json.len())?;
         let actor: ActorIdentity = serde_json::from_str(&json)
             .map_err(|e| parse_error(e.to_string(), "Actor.from_json", Some("json"), None))?;
-        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
         Ok(ruby.obj_wrap(Self {
             inner: std::cell::RefCell::new(actor),
         }))
@@ -33,7 +33,7 @@ impl Actor {
 
     fn to_json(&self) -> Result<String, Error> {
         serde_json::to_string(&*self.inner.borrow())
-            .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))
+            .map_err(|e| crate::util::runtime(e.to_string()))
     }
 
     fn actor_id(&self) -> String {
@@ -94,7 +94,7 @@ impl Manifest {
         enforce_size(toml_str.len())?;
         let manifest = parse_manifest(&toml_str)
             .map_err(|e| parse_error(e.to_string(), "Manifest.from_toml", Some("toml"), None))?;
-        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
         Ok(ruby.obj_wrap(Self {
             inner: std::cell::RefCell::new(manifest),
         }))
@@ -123,9 +123,10 @@ impl Manifest {
             .get(index)
             .map(|t| t.name.clone())
             .ok_or_else(|| {
-                Error::new(
-                    exception::index_error(),
+                crate::util::index_error(
                     format!("tier index {index} out of range"),
+                    "Manifest.tier_name_at",
+                    Some(index as u64),
                 )
             })
     }

data/ext/confium_native/src/ers.rs

@@ -5,7 +5,7 @@ use confium_transparency::ers::{
     EvidenceRecord, HashAlgorithm,
 };
 use magnus::{
-    exception, function, method, typed_data::Obj,
+    function, method, typed_data::Obj,
     DataTypeFunctions, Error, Module, Object, Ruby, TryConvert, TypedData, Value,
 };
 
@@ -20,13 +20,11 @@ pub struct ErsRecord {
 impl ErsRecord {
     fn build_initial(args: &[Value]) -> Result<Obj<Self>, Error> {
         let first = args.first().ok_or_else(|| {
-            Error::new(exception::arg_error(), "data_hash required")
+            crate::util::arg_error("data_hash required")
         })?;
         let data_hash = bytes_from_value(*first)?;
         if data_hash.len() != 32 {
-            return Err(Error::new(
-                exception::arg_error(),
-                format!("data_hash must be 32 bytes, got {}", data_hash.len()),
+            return Err(crate::util::arg_error(format!("data_hash must be 32 bytes, got {}", data_hash.len()),
             ));
         }
         let mut hash = [0u8; 32];
@@ -42,7 +40,7 @@ impl ErsRecord {
         let record =
             build_initial_evidence_record(hash, HashAlgorithm::Sha256, tsa_id, token_bytes);
         let ruby = Ruby::get()
-            .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+            .map_err(|e| crate::util::runtime(e.to_string()))?;
         Ok(ruby.obj_wrap(Self {
             inner: std::cell::RefCell::new(record),
         }))
@@ -50,13 +48,11 @@ impl ErsRecord {
 
     fn renew(&self, args: &[Value]) -> Result<Obj<Self>, Error> {
         let first = args.first().ok_or_else(|| {
-            Error::new(exception::arg_error(), "new_hash required")
+            crate::util::arg_error("new_hash required")
         })?;
         let new_hash_bytes = bytes_from_value(*first)?;
         if new_hash_bytes.len() != 32 {
-            return Err(Error::new(
-                exception::arg_error(),
-                format!("new_hash must be 32 bytes, got {}", new_hash_bytes.len()),
+            return Err(crate::util::arg_error(format!("new_hash must be 32 bytes, got {}", new_hash_bytes.len()),
             ));
         }
         let mut hash = [0u8; 32];
@@ -72,7 +68,7 @@ impl ErsRecord {
         let mut cloned = self.inner.borrow().clone();
         renew_evidence_record(&mut cloned, HashAlgorithm::Sha256, hash, tsa_id, token_bytes);
         let ruby = Ruby::get()
-            .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+            .map_err(|e| crate::util::runtime(e.to_string()))?;
         Ok(ruby.obj_wrap(Self {
             inner: std::cell::RefCell::new(cloned),
         }))

data/ext/confium_native/src/openpgp.rs

@@ -2,7 +2,7 @@
 //!
 //! Confium ships RNP functionality baked into the native extension.
 
-use magnus::{exception, function, prelude::*, Error, Module, RModule, Ruby, TryConvert, Value};
+use magnus::{function, prelude::*, Error, Module, RModule, Ruby, TryConvert, Value};
 use rnp::ops::ArmorType;
 use rnp::{armor_bytes, dearmor_bytes};
 

data/ext/confium_native/src/path.rs

@@ -10,7 +10,7 @@ use confium_pki::{
     path::{validate_path, CertPath},
     result::VerificationResult as PathVerificationResult,
 };
-use magnus::{exception, function, method, prelude::*, DataTypeFunctions, Error, Module, Ruby, TypedData, Value};
+use magnus::{function, method, prelude::*, DataTypeFunctions, Error, Module, Ruby, TypedData, Value};
 
 /// Wraps a confium_pki::path::VerificationResult.
 #[derive(TypedData, DataTypeFunctions)]
@@ -63,17 +63,17 @@ fn validate(args: &[Value]) -> Result<magnus::typed_data::Obj<PathResult>, Error
         Vec::new()
     } else {
         let arr = magnus::RArray::try_convert(intermediates_value)
-            .map_err(|e| Error::new(exception::arg_error(), e.to_string()))?;
+            .map_err(|e| crate::util::arg_error(e.to_string()))?;
         let mut out = Vec::with_capacity(arr.len());
-        for v in arr.each() {
-            out.push(extract_cert(v?, "intermediate")?);
+        for v in arr.into_iter() {
+            out.push(extract_cert(v, "intermediate")?);
         }
         out
     };
 
     let now = match now_iso8601 {
         Some(s) => chrono::DateTime::parse_from_rfc3339(&s)
-            .map_err(|e| Error::new(exception::arg_error(), format!("invalid time: {e}")))?
+            .map_err(|e| crate::util::arg_error(format!("invalid time: {e}")))?
             .with_timezone(&Utc),
         None => Utc::now(),
     };
@@ -86,7 +86,7 @@ fn validate(args: &[Value]) -> Result<magnus::typed_data::Obj<PathResult>, Error
     let result = validate_path(&path, now);
 
     let ruby = Ruby::get()
-        .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        .map_err(|e| crate::util::runtime(e.to_string()))?;
     Ok(ruby.obj_wrap(PathResult { inner: result }))
 }
 
@@ -98,10 +98,10 @@ fn extract_cert(value: Value, label: &str) -> Result<RustCert, Error> {
     // We re-parse those bytes into a fresh RustCert.
     let der_value: Value = value
         .funcall("to_der", ())
-        .map_err(|e| Error::new(exception::runtime_error(), format!("{}: cannot get DER: {e}", label)))?;
+        .map_err(|e| crate::util::parse_error(format!("{label}: cannot get DER: {e}"), "PathValidator.validate", Some("der"), None))?;
     let der = crate::util::bytes_from_value(der_value)?;
     RustCert::from_der(&der)
-        .map_err(|e| Error::new(exception::runtime_error(), format!("{}: invalid DER: {e}", label)))
+        .map_err(|e| crate::util::parse_error(format!("{label}: invalid DER: {e}"), "PathValidator.validate", Some("der"), None))
 }
 
 pub fn init(ruby: &Ruby, parent: magnus::RModule) -> Result<(), Error> {

data/ext/confium_native/src/pki.rs

@@ -20,7 +20,7 @@ use confium_pki::{
     xmldsig::{canonicalize, canonicalize_exclusive},
 };
 use magnus::{
-    exception, function, method, prelude::*, typed_data::Obj, DataTypeFunctions, Error, Module,
+    function, method, prelude::*, typed_data::Obj, DataTypeFunctions, Error, Module,
     Object, RHash, RString, Ruby, TryConvert, TypedData, Value,
 };
 
@@ -35,7 +35,7 @@ impl Certificate {
         let der = bytes_from_value(bytes)?;
         let cert = RustCert::from_der(&der)
             .map_err(|e| parse_error(e.to_string(), "Certificate.from_der", Some("der"), None))?;
-        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
         Ok(ruby.obj_wrap(Self { inner: cert }))
     }
 
@@ -43,12 +43,12 @@ impl Certificate {
         enforce_size(pem.len())?;
         let cert = RustCert::from_pem(&pem)
             .map_err(|e| parse_error(e.to_string(), "Certificate.from_pem", Some("pem"), None))?;
-        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
         Ok(ruby.obj_wrap(Self { inner: cert }))
     }
 
     fn to_der(&self) -> Result<RString, Error> {
-        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
         Ok(bytes_to_rstring(&ruby, &self.inner.to_der()))
     }
 
@@ -81,13 +81,13 @@ impl Certificate {
 
     fn valid_at(&self, iso8601: String) -> Result<bool, Error> {
         let now = DateTime::parse_from_rfc3339(&iso8601)
-            .map_err(|e| Error::new(exception::arg_error(), format!("invalid ISO8601 time: {e}")))?
+            .map_err(|e| crate::util::arg_error(format!("invalid ISO8601 time: {e}")))?
             .with_timezone(&Utc);
         Ok(self.inner.is_within_validity(now))
     }
 
     fn public_key_bytes(&self) -> Result<RString, Error> {
-        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
         Ok(bytes_to_rstring(&ruby, self.inner.public_key_bytes()))
     }
 }
@@ -103,7 +103,7 @@ impl Csr {
         let der = bytes_from_value(bytes)?;
         let csr = RustCsr::from_der(&der)
             .map_err(|e| parse_error(e.to_string(), "Csr.from_der", Some("der"), None))?;
-        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
         Ok(ruby.obj_wrap(Self { inner: csr }))
     }
 
@@ -111,12 +111,12 @@ impl Csr {
         enforce_size(pem.len())?;
         let csr = RustCsr::from_pem(&pem)
             .map_err(|e| parse_error(e.to_string(), "Csr.from_pem", Some("pem"), None))?;
-        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
         Ok(ruby.obj_wrap(Self { inner: csr }))
     }
 
     fn to_der(&self) -> Result<RString, Error> {
-        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
         Ok(bytes_to_rstring(&ruby, &self.inner.to_der()))
     }
 
@@ -136,7 +136,7 @@ impl SignedData {
         enforce_size(json.len())?;
         let sd: RustSignedData = serde_json::from_str(&json)
             .map_err(|e| parse_error(e.to_string(), "SignedData.from_json", Some("json"), None))?;
-        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
         Ok(ruby.obj_wrap(Self {
             inner: std::cell::RefCell::new(sd),
         }))
@@ -162,15 +162,11 @@ impl SignedData {
         certificates: Value,
     ) -> Result<Obj<Self>, Error> {
         if signature.is_nil() {
-            return Err(Error::new(
-                exception::arg_error(),
-                "signature is required",
+            return Err(crate::util::arg_error("signature is required",
             ));
         }
         if certificates.is_nil() {
-            return Err(Error::new(
-                exception::arg_error(),
-                "certificates is required",
+            return Err(crate::util::arg_error("certificates is required",
             ));
         }
 
@@ -179,16 +175,15 @@ impl SignedData {
 
         let certs_array: magnus::RArray = magnus::RArray::try_convert(certificates)?;
         let mut cert_ders = Vec::with_capacity(certs_array.len());
-        for item in certs_array.each() {
-            let v = item?;
+        for v in certs_array.into_iter() {
             let der = bytes_from_value(v)?;
             enforce_size(der.len())?;
             cert_ders.push(der);
         }
 
-        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
         let sd = build_detached_signature(Vec::new(), algorithm, sig_bytes, cert_ders)
-            .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+            .map_err(|e| crate::util::runtime(e.to_string()))?;
         Ok(ruby.obj_wrap(Self {
             inner: std::cell::RefCell::new(sd),
         }))
@@ -196,7 +191,7 @@ impl SignedData {
 
     fn to_json(&self) -> Result<String, Error> {
         serde_json::to_string(&*self.inner.borrow())
-            .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))
+            .map_err(|e| crate::util::runtime(e.to_string()))
     }
 
     /// Encode this SignedData as DER bytes (RFC 5652 ContentInfo).
@@ -204,9 +199,9 @@ impl SignedData {
     /// The output is parseable by `openssl cms` / `openssl pkcs7` and
     /// any standards-compliant CMS consumer.
     fn to_der(&self) -> Result<RString, Error> {
-        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
         let der = encode_signed_data_der(&self.inner.borrow())
-            .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+            .map_err(|e| crate::util::runtime(e.to_string()))?;
         Ok(bytes_to_rstring(&ruby, &der))
     }
 
@@ -225,7 +220,7 @@ impl SignedData {
     fn content(&self) -> Result<Option<Obj<CertWrapper>>, Error> {
         // Wrap the optional content bytes in a small value object so Ruby
         // can ask `.present?` / `.bytes` without juggling nil-vs-string.
-        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
         match &self.inner.borrow().encap_content_info.content {
             Some(bytes) => {
                 let wrapper = CertWrapper {
@@ -242,16 +237,17 @@ impl SignedData {
     }
 
     fn certificate_at(&self, index: usize) -> Result<RString, Error> {
-        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
         self.inner
             .borrow()
             .certificates
             .get(index)
             .map(|c| bytes_to_rstring(&ruby, c))
             .ok_or_else(|| {
-                Error::new(
-                    exception::index_error(),
+                crate::util::index_error(
                     format!("certificate index {index} out of range"),
+                    "SignedData.certificate_at",
+                    Some(index as u64),
                 )
             })
     }
@@ -294,8 +290,8 @@ impl SignedData {
             } else {
                 Err(format!("unsupported signature algorithm OID: {oid}"))
             }
-        }).map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
-        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        }).map_err(|e| crate::util::runtime(e.to_string()))?;
+        let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
         Ok(ruby.obj_wrap(CmsVerificationResult { inner: result }))
     }
 }
@@ -349,7 +345,7 @@ pub struct CertWrapper {
 
 impl CertWrapper {
     fn bytes(&self) -> Result<RString, Error> {
-        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
         Ok(bytes_to_rstring(&ruby, &self.bytes))
     }
 

data/ext/confium_native/src/tc.rs

@@ -19,10 +19,10 @@ use confium_tc_frost_p256::{
 };
 use confium_tc_cmp20::inprocess as cmp20_inprocess;
 use confium_tc_gg18::inprocess as gg18_inprocess;
-use magnus::{exception, function, method, prelude::*, DataTypeFunctions, Error, Module, Object, RHash, Ruby, TryConvert, TypedData, Value};
+use magnus::{function, method, DataTypeFunctions, Error, Module, RHash, Ruby, TryConvert, TypedData, Value};
 use p256::Scalar;
 
-use crate::util::threshold_error;
+use crate::util::{bytes_from_value, bytes_to_rstring, threshold_error};
 
 #[derive(TypedData, DataTypeFunctions)]
 #[magnus(class = "Confium::TC::FrostP256::Share", size)]
@@ -37,7 +37,7 @@ impl ShareWrap {
     }
 
     fn y_bytes(&self) -> Result<magnus::RString, Error> {
-        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
         Ok(bytes_to_rstring(&ruby, &self.y_bytes))
     }
 }
@@ -49,20 +49,16 @@ fn split_secret_into_shares(
 ) -> Result<magnus::RArray, Error> {
     let bytes = bytes_from_value(secret_bytes)?;
     if bytes.len() != 32 {
-        return Err(Error::new(
-            exception::arg_error(),
-            format!("secret must be exactly 32 bytes, got {}", bytes.len()),
+        return Err(crate::util::arg_error(format!("secret must be exactly 32 bytes, got {}", bytes.len()),
         ));
     }
     let secret_arr: [u8; 32] = bytes.as_slice().try_into().unwrap();
     let secret = scalar_from_bytes(&secret_arr).ok_or_else(|| {
-        Error::new(
-            exception::arg_error(),
-            "secret is not a valid P-256 scalar (reduce mod n failed)",
+        crate::util::arg_error("secret is not a valid P-256 scalar (reduce mod n failed)",
         )
     })?;
     let shares: Vec<Share> = split_secret(&secret, threshold, party_count);
-    let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+    let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
     let result = ruby.ary_new_capa(shares.len());
     for s in shares {
         result.push(ruby.obj_wrap(ShareWrap {
@@ -76,27 +72,25 @@ fn split_secret_into_shares(
 fn recover(shares_value: Value) -> Result<magnus::RString, Error> {
     let arr = magnus::RArray::try_convert(shares_value)?;
     let mut shares: Vec<Share> = Vec::with_capacity(arr.len());
-    for v in arr.each() {
-        let h: RHash = RHash::try_convert(v?)?;
+    for v in arr.into_iter() {
+        let h: RHash = RHash::try_convert(v)?;
         let x: u32 = h.fetch::<_, u32>("x")?;
         let y_value: Value = h.fetch::<_, Value>("y")?;
         let y_bytes = bytes_from_value(y_value)?;
         if y_bytes.len() != 32 {
-            return Err(Error::new(
-                exception::arg_error(),
-                format!("share y must be 32 bytes, got {}", y_bytes.len()),
+            return Err(crate::util::arg_error(format!("share y must be 32 bytes, got {}", y_bytes.len()),
             ));
         }
         let y_arr: [u8; 32] = y_bytes.as_slice().try_into().unwrap();
         let y = scalar_from_bytes(&y_arr).ok_or_else(|| {
-            Error::new(exception::arg_error(), "share y is not a valid P-256 scalar")
+            crate::util::arg_error("share y is not a valid P-256 scalar")
         })?;
         shares.push(Share { x, y });
     }
     let refs: Vec<&Share> = shares.iter().collect();
     let secret = recover_secret(&refs)
-        .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
-    let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        .map_err(|e| crate::util::runtime(e.to_string()))?;
+    let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
     Ok(bytes_to_rstring(&ruby, scalar_to_bytes(&secret).as_ref()))
 }
 
@@ -114,14 +108,12 @@ fn sign(private_key_bytes: Value, message: Value) -> Result<RHash, Error> {
     let pk_bytes = bytes_from_value(private_key_bytes)?;
     let msg = bytes_from_value(message)?;
     if pk_bytes.len() != 32 {
-        return Err(Error::new(
-            exception::arg_error(),
-            format!("private key must be 32 bytes, got {}", pk_bytes.len()),
+        return Err(crate::util::arg_error(format!("private key must be 32 bytes, got {}", pk_bytes.len()),
         ));
     }
     let pk_arr: [u8; 32] = pk_bytes.as_slice().try_into().unwrap();
     let secret = scalar_from_bytes(&pk_arr).ok_or_else(|| {
-        Error::new(exception::arg_error(), "private key not a valid P-256 scalar")
+        crate::util::arg_error("private key not a valid P-256 scalar")
     })?;
     let kp = Keypair {
         secret_scalar: secret,
@@ -137,7 +129,7 @@ fn sign(private_key_bytes: Value, message: Value) -> Result<RHash, Error> {
                 Some(&msg),
                 Some(&e.to_string()),
             );
-            return Err(Error::new(exception::runtime_error(), e.to_string()));
+            return Err(crate::util::crypto_error(e.to_string(), "FrostP256.sign", "ecdsa-p256"));
         }
     };
     crate::audit::fire_event(
@@ -147,38 +139,14 @@ fn sign(private_key_bytes: Value, message: Value) -> Result<RHash, Error> {
         Some(&msg),
         None,
     );
-    let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+    let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
     let result = ruby.hash_new();
     result.aset("der", bytes_to_rstring(&ruby, &signed.der_bytes))?;
     result.aset("fixed", bytes_to_rstring(&ruby, &signed.fixed_bytes))?;
     Ok(result)
 }
 
-fn bytes_from_value(v: Value) -> Result<Vec<u8>, Error> {
-    use magnus::RString;
-    if let Ok(s) = RString::try_convert(v) {
-        return Ok(unsafe { s.as_slice() }.to_vec());
-    }
-    let arr: Vec<i64> = Vec::<i64>::try_convert(v)?;
-    arr.into_iter()
-        .map(|i| {
-            if !(0..=255).contains(&i) {
-                Err(Error::new(
-                    exception::arg_error(),
-                    format!("byte out of range 0..255: {i}"),
-                ))
-            } else {
-                Ok(i as u8)
-            }
-        })
-        .collect()
-}
 
-fn bytes_to_rstring(_ruby: &Ruby, bytes: &[u8]) -> magnus::RString {
-    let s = magnus::RString::buf_new(0);
-    s.cat(bytes);
-    s
-}
 
 // ===== ElGamal-P256 threshold encryption (KEM-style) =====
 
@@ -186,7 +154,7 @@ fn elgamal_encapsulate(ruby: &Ruby, public_key_bytes: Value) -> Result<RHash, Er
     let bytes = bytes_from_value(public_key_bytes)?;
     let pk = ElGamalPublicKey { bytes };
     let (ciphertext, shared_secret) = encapsulate(&pk)
-        .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        .map_err(|e| crate::util::crypto_error(e.to_string(), "ElGamalP256.encapsulate", "elgamal-p256"))?;
     let result = ruby.hash_new();
     let ct_hash = ruby.hash_new();
     ct_hash.aset("c1", bytes_to_rstring(ruby, &ciphertext.c1))?;
@@ -210,8 +178,8 @@ fn elgamal_partial_decrypt(party_index: u32, share_bytes: Value, ciphertext_valu
         bytes: share_b,
     };
     let partial = partial_decrypt(&share, &ciphertext)
-        .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
-    let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        .map_err(|e| crate::util::crypto_error(e.to_string(), "ElGamalP256.partial_decrypt", "elgamal-p256"))?;
+    let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
     let result = ruby.hash_new();
     result.aset("party_index", partial.party_index)?;
     result.aset("bytes", bytes_to_rstring(&ruby, &partial.bytes))?;
@@ -221,8 +189,8 @@ fn elgamal_partial_decrypt(party_index: u32, share_bytes: Value, ciphertext_valu
 fn elgamal_aggregate(partials_value: Value, threshold: u32, ciphertext_value: Value) -> Result<magnus::RString, Error> {
     let arr = magnus::RArray::try_convert(partials_value)?;
     let mut partials: Vec<PartialDecryption> = Vec::with_capacity(arr.len());
-    for v in arr.each() {
-        let h: RHash = RHash::try_convert(v?)?;
+    for v in arr.into_iter() {
+        let h: RHash = RHash::try_convert(v)?;
         let party_index: u32 = h.fetch::<_, u32>("party_index")?;
         let bytes_value: Value = h.fetch::<_, Value>("bytes")?;
         partials.push(PartialDecryption {
@@ -238,8 +206,8 @@ fn elgamal_aggregate(partials_value: Value, threshold: u32, ciphertext_value: Va
         c2: bytes_from_value(c2_value)?,
     };
     let shared = aggregate_partials(&partials, threshold, &ciphertext)
-        .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
-    let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        .map_err(|e| crate::util::crypto_error(e.to_string(), "ElGamalP256.aggregate_partials", "elgamal-p256"))?;
+    let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
     Ok(bytes_to_rstring(&ruby, &shared))
 }
 
@@ -317,8 +285,8 @@ fn cmp20_sign(
 ) -> Result<magnus::RString, Error> {
     let arr = magnus::RArray::try_convert(shares_value)?;
     let mut share_bytes: Vec<Vec<u8>> = Vec::with_capacity(arr.len());
-    for v in arr.each() {
-        let s = bytes_from_value(v?)?;
+    for v in arr.into_iter() {
+        let s = bytes_from_value(v)?;
         share_bytes.push(s);
     }
     let supplied = share_bytes.len();
@@ -389,8 +357,8 @@ fn gg18_sign(
 ) -> Result<magnus::RString, Error> {
     let arr = magnus::RArray::try_convert(shares_value)?;
     let mut share_bytes: Vec<Vec<u8>> = Vec::with_capacity(arr.len());
-    for v in arr.each() {
-        let s = bytes_from_value(v?)?;
+    for v in arr.into_iter() {
+        let s = bytes_from_value(v)?;
         share_bytes.push(s);
     }
     let supplied = share_bytes.len();

data/ext/confium_native/src/transparency.rs

@@ -9,9 +9,10 @@ use confium_transparency::{
     entry::{ArtifactType, MerkleEntry},
     merkle::{Hash, InclusionProof as RustInclusionProof, MerkleTree as RustMerkleTree, Side},
 };
+use crate::util::{bytes_from_value, bytes_to_rstring};
 use magnus::{
-    exception, function, method, prelude::*, typed_data::Obj, DataTypeFunctions, Error, IntoValue,
-    Module, Object, RString, Ruby, TryConvert, TypedData, Value,
+    function, method, prelude::*, typed_data::Obj, DataTypeFunctions, Error, IntoValue,
+    Module, Object, Ruby, TypedData, Value,
 };
 
 #[derive(TypedData, DataTypeFunctions)]
@@ -30,9 +31,7 @@ impl MerkleTree {
     fn append(&self, artifact_hash: Value) -> Result<u64, Error> {
         let bytes = bytes_from_value(artifact_hash)?;
         if bytes.len() != 32 {
-            return Err(Error::new(
-                exception::arg_error(),
-                format!("artifact_hash must be exactly 32 bytes, got {}", bytes.len()),
+            return Err(crate::util::arg_error(format!("artifact_hash must be exactly 32 bytes, got {}", bytes.len()),
             ));
         }
         let mut artifact_hash = [0u8; 32];
@@ -54,7 +53,7 @@ impl MerkleTree {
     /// to iterate: `tree.to_a.map(&:sequence)` etc.
     fn entries(&self) -> Result<magnus::RArray, Error> {
         let len = self.inner.borrow().len();
-        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
         let arr = ruby.ary_new_capa(len);
         for i in 0..(len as u64) {
             let proof = self.inclusion_proof(i)?;
@@ -74,7 +73,7 @@ impl MerkleTree {
             .consistency_proof(old_size)
             .map_err(|e| crate::util::index_error(e.to_string(), "MerkleTree.consistency_proof", Some(old_size as u64)))?;
         let ruby = Ruby::get()
-            .map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+            .map_err(|e| crate::util::runtime(e.to_string()))?;
         let arr = ruby.ary_new_capa(proof.len());
         for h in &proof {
             arr.push(bytes_to_rstring(&ruby, h))?;
@@ -107,16 +106,12 @@ impl MerkleTree {
     ) -> Result<bool, Error> {
         let old_bytes = bytes_from_value(old_root)?;
         if old_bytes.len() != 32 {
-            return Err(Error::new(
-                exception::arg_error(),
-                format!("old_root must be 32 bytes, got {}", old_bytes.len()),
+            return Err(crate::util::arg_error(format!("old_root must be 32 bytes, got {}", old_bytes.len()),
             ));
         }
         let new_bytes = bytes_from_value(new_root)?;
         if new_bytes.len() != 32 {
-            return Err(Error::new(
-                exception::arg_error(),
-                format!("new_root must be 32 bytes, got {}", new_bytes.len()),
+            return Err(crate::util::arg_error(format!("new_root must be 32 bytes, got {}", new_bytes.len()),
             ));
         }
         let mut old_root_hash: Hash = [0u8; 32];
@@ -125,12 +120,10 @@ impl MerkleTree {
         new_root_hash.copy_from_slice(&new_bytes);
 
         let mut proof_hashes: Vec<Hash> = Vec::with_capacity(proof.len());
-        for item in proof.each() {
-            let bytes = bytes_from_value(item?)?;
+        for item in proof.into_iter() {
+            let bytes = bytes_from_value(item)?;
             if bytes.len() != 32 {
-                return Err(Error::new(
-                    exception::arg_error(),
-                    format!("proof entries must be 32 bytes, got {}", bytes.len()),
+                return Err(crate::util::arg_error(format!("proof entries must be 32 bytes, got {}", bytes.len()),
                 ));
             }
             let mut h: Hash = [0u8; 32];
@@ -162,7 +155,7 @@ impl MerkleTree {
         // Re-derive the leaf hash with the same algorithm the tree uses
         // internally (H(0x01 | entry_hash)).
         let leaf_hash = hash_leaf(entry.entry_hash());
-        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
         Ok(ruby.obj_wrap(InclusionProofWrap {
             inner: proof,
             leaf_hash,
@@ -187,7 +180,7 @@ impl InclusionProofWrap {
     }
 
     fn steps(&self) -> Result<Value, Error> {
-        let ruby = Ruby::get().map_err(|e| Error::new(exception::runtime_error(), e.to_string()))?;
+        let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
         let result = ruby.hash_new();
         for (i, step) in self.inner.steps.iter().enumerate() {
             let step_hash = ruby.hash_new();
@@ -207,9 +200,7 @@ impl InclusionProofWrap {
     fn verify(&self, root_bytes: Value) -> Result<bool, Error> {
         let bytes = bytes_from_value(root_bytes)?;
         if bytes.len() != 32 {
-            return Err(Error::new(
-                exception::arg_error(),
-                format!("root must be exactly 32 bytes, got {}", bytes.len()),
+            return Err(crate::util::arg_error(format!("root must be exactly 32 bytes, got {}", bytes.len()),
             ));
         }
         let mut root: Hash = [0u8; 32];
@@ -234,16 +225,12 @@ impl InclusionProofWrap {
     fn verify_with_leaf(&self, leaf_bytes: Value, root_bytes: Value) -> Result<bool, Error> {
         let leaf = bytes_from_value(leaf_bytes)?;
         if leaf.len() != 32 {
-            return Err(Error::new(
-                exception::arg_error(),
-                format!("leaf_hash must be exactly 32 bytes, got {}", leaf.len()),
+            return Err(crate::util::arg_error(format!("leaf_hash must be exactly 32 bytes, got {}", leaf.len()),
             ));
         }
         let root_raw = bytes_from_value(root_bytes)?;
         if root_raw.len() != 32 {
-            return Err(Error::new(
-                exception::arg_error(),
-                format!("root must be exactly 32 bytes, got {}", root_raw.len()),
+            return Err(crate::util::arg_error(format!("root must be exactly 32 bytes, got {}", root_raw.len()),
             ));
         }
         let mut current: Hash = [0u8; 32];
@@ -261,35 +248,7 @@ impl InclusionProofWrap {
     }
 }
 
-fn bytes_from_value(v: Value) -> Result<Vec<u8>, Error> {
-    // Accept either a binary String (preferred for byte data) or an Array
-    // of small integers (also commonly used in Ruby crypto code).
-    if let Ok(s) = RString::try_convert(v) {
-        // SAFETY: we treat the string's raw bytes as opaque cryptographic
-        // input — we never interpret them as a UTF-8 string. Encoding is
-        // irrelevant for hash input.
-        return Ok(unsafe { s.as_slice() }.to_vec());
-    }
-    let arr: Vec<i64> = Vec::<i64>::try_convert(v)?;
-    arr.into_iter()
-        .map(|i| {
-            if !(0..=255).contains(&i) {
-                Err(Error::new(
-                    exception::arg_error(),
-                    format!("byte out of range 0..255: {i}"),
-                ))
-            } else {
-                Ok(i as u8)
-            }
-        })
-        .collect()
-}
 
-fn bytes_to_rstring(_ruby: &Ruby, bytes: &[u8]) -> RString {
-    let s = RString::buf_new(0);
-    s.cat(bytes);
-    s
-}
 
 fn hash_leaf(entry_hash: Hash) -> Hash {
     use sha2::{Digest, Sha256};

data/ext/confium_native/src/util.rs

@@ -3,6 +3,11 @@
 //! DRY consolidation: a single `bytes_from_value` + size cap + string
 //! conversion + typed-error helper shared by every subsystem module
 //! (composite, pki, tc, transparency, deployment, attributes).
+//!
+//! This module wraps magnus's deprecated `exception::*` constructors
+//! so the rest of the crate never touches them; their replacements
+//! need a `Ruby` handle, which the failure fallbacks here lack.
+#![allow(deprecated)]
 
 use magnus::prelude::*;
 use magnus::{exception, Error, RHash, RString, Ruby, TryConvert, Value};
@@ -14,6 +19,28 @@ use magnus::{exception, Error, RHash, RString, Ruby, TryConvert, Value};
 /// prevent trivial memory-exhaustion attacks.
 pub const MAX_INPUT_SIZE: usize = 1 << 20;
 
+/// Build a plain `RuntimeError`. Centralizes every raise site so the
+/// deprecated `magnus::exception::runtime_error()` fallback lives in
+/// exactly one place (its replacement needs a `Ruby` handle, which is
+/// unavailable when `Ruby::get()` itself fails).
+pub fn runtime(msg: impl Into<String>) -> Error {
+    let msg: String = msg.into();
+    match Ruby::get() {
+        Ok(ruby) => Error::new(ruby.exception_runtime_error(), msg),
+        Err(_) => Error::new(exception::runtime_error(), msg),
+    }
+}
+
+/// Build an `ArgumentError` — for bad argument shapes/ranges, the
+/// class callers should see before any Confium semantics apply.
+pub fn arg_error(msg: impl Into<String>) -> Error {
+    let msg: String = msg.into();
+    match Ruby::get() {
+        Ok(ruby) => Error::new(ruby.exception_arg_error(), msg),
+        Err(_) => Error::new(exception::arg_error(), msg),
+    }
+}
+
 /// Convert a Ruby value to bytes. Accepts a binary `String` (any
 /// encoding) or an `Array<Integer>`. Enforces a 1 MiB size cap.
 pub fn bytes_from_value(v: Value) -> Result<Vec<u8>, Error> {
@@ -30,10 +57,7 @@ pub fn bytes_from_value(v: Value) -> Result<Vec<u8>, Error> {
     arr.into_iter()
         .map(|i| {
             if !(0..=255).contains(&i) {
-                Err(Error::new(
-                    exception::arg_error(),
-                    format!("byte out of range 0..255: {i}"),
-                ))
+                Err(arg_error(format!("byte out of range 0..255: {i}")))
             } else {
                 Ok(i as u8)
             }
@@ -46,18 +70,15 @@ pub fn bytes_from_value(v: Value) -> Result<Vec<u8>, Error> {
 /// memory-exhaustion attacks.
 pub fn enforce_size(len: usize) -> Result<(), Error> {
     if len > MAX_INPUT_SIZE {
-        return Err(Error::new(
-            exception::arg_error(),
-            format!("input size {0} exceeds max {MAX_INPUT_SIZE}", len),
-        ));
+        return Err(arg_error(format!("input size {0} exceeds max {MAX_INPUT_SIZE}", len)));
     }
     Ok(())
 }
 
 /// Build a Ruby binary `String` from a byte slice. Avoids the UTF-8
-/// round-trip in `RString::buf_new` + `cat` for already-binary input.
-pub fn bytes_to_rstring(_ruby: &Ruby, bytes: &[u8]) -> RString {
-    let s = RString::buf_new(0);
+/// round-trip for already-binary input.
+pub fn bytes_to_rstring(ruby: &Ruby, bytes: &[u8]) -> RString {
+    let s = ruby.str_buf_new(0);
     s.cat(bytes);
     s
 }

data/lib/confium/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Confium
-  VERSION = '0.3.3'
+  VERSION = '0.3.4'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: confium
 version: !ruby/object:Gem::Version
-  version: 0.3.3
+  version: 0.3.4
 platform: ruby
 authors:
 - Ribose Open