confium 0.6.1 → 0.6.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8d42dc62222d0c92dfa68876099cbac875766094cd9220c4ec10d5b6f605cd09
-  data.tar.gz: 940eae5a8b8e090a5a1638885dc3bc3b4c9663deaa084dfed0852064432ee141
+  metadata.gz: 922db9bc620ddee90ba36a32d0c01d7a50dc13d685af98651288d7c913333af6
+  data.tar.gz: a46a79237e9b643fd31ee0e1f9fcfdf0df3a1d3f846f7f66bf22273394029944
 SHA512:
-  metadata.gz: 04b73aaa3d4adf174c0c36af482de3b64d0e8ecaca91793a7996c04a50f78e8778189958697e4dc9a813f82d65c39ed36465871972584f03b509e3129c9242ef
-  data.tar.gz: 0f2ee3e4d4d51958e278733bd3c7ee8160b9fea55d2073ca23ec88c321923c768469be5517d690b94d9308f8a85301389310c7591fbed934ee66d4a893c22f2c
+  metadata.gz: 84d6d5f4c7822d46d7f96fbc0d25800de7fd6d9548542c4deb8f219ec291750d932d079211b9a2e6671aa998cb340b77a26bf1678aa6a7b94e33ecebf4f32fc0
+  data.tar.gz: 1f95d17bf74f58728e280ca052519a2538afd1ec530538fc1aa7ebb6bdce2e60dcf7bd4b9c170db572634a23622b5b228d810548e4c89bde2c624a02fc6beb6c

data/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [0.6.2] — 2026-08-26
+
+### Added
+
+- `Confium::Store::Keystore` — Ruby surface for the store layer and
+  the sign-with-handle contract: `.new(backend, options)`,
+  `#sign(key_id, algorithm, message)` returning binary signature
+  bytes, plus `Confium::Store.backends`. Local backends raise a
+  typed `Confium::Error` for `#sign`; remote-holding backends (cloud
+  KMS) come via source builds that opt into their cargo features
+  (confium-store 0.5.8). `Confium::Error` now also accepts the
+  positional details-Hash form every typed subclass already accepts,
+  so native-constructed base errors carry `details` too.
+
 ## [0.6.1] — 2026-08-25
 
 ### Changed

data/Cargo.lock

@@ -290,7 +290,7 @@ dependencies = [
  "chrono",
  "confium-api",
  "confium-net",
- "confium-store",
+ "confium-store 0.3.0",
  "confium-tc-core",
  "data-encoding",
  "hex",
@@ -463,6 +463,16 @@ dependencies = [
  "snafu 0.8.9",
 ]
 
+[[package]]
+name = "confium-store"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5559e7f26bcf9f6dd3a76cf7eb0cf0684966c504cf662efef14f69ade8103e26"
+dependencies = [
+ "inventory",
+ "snafu 0.9.2",
+]
+
 [[package]]
 name = "confium-tc"
 version = "0.3.1"
@@ -473,7 +483,7 @@ dependencies = [
  "confium-api",
  "confium-coordinator",
  "confium-net",
- "confium-store",
+ "confium-store 0.3.0",
  "confium-tc-keys",
  "data-encoding",
  "hex",
@@ -527,7 +537,7 @@ dependencies = [
  "chrono",
  "confium-api",
  "confium-net",
- "confium-store",
+ "confium-store 0.3.0",
  "data-encoding",
  "hex",
  "hmac",
@@ -638,6 +648,7 @@ dependencies = [
  "confium-observability",
  "confium-pki",
  "confium-privacy",
+ "confium-store 0.5.8",
  "confium-tc",
  "confium-tc-cmp20",
  "confium-tc-core",

data/ext/confium_native/Cargo.toml

@@ -37,6 +37,7 @@ confium-transparency = "0.4"
 confium-composite = "0.3.1"
 confium-attributes = "0.3.1"
 confium-pki = "0.5.6"
+confium-store = "0.5.8"
 confium-deployment = "0.3"
 confium-tc = "0.3.1"
 confium-tc-frost-p256 = "0.3"

data/ext/confium_native/src/lib.rs

@@ -12,6 +12,7 @@ mod ers;
 mod openpgp_verify;
 mod path;
 mod pki;
+mod store;
 mod tc;
 mod transparency;
 mod util;
@@ -49,6 +50,7 @@ fn init(ruby: &Ruby) -> Result<(), Error> {
     composite::init(ruby, confium)?;
     attributes::init(ruby, confium)?;
     pki::init(ruby, confium)?;
+    store::init(ruby, confium)?;
     path::init(ruby, confium)?;
     deployment::init(ruby, confium)?;
     tc::init(ruby, confium)?;

data/ext/confium_native/src/store.rs

@@ -0,0 +1,108 @@
+//! Confium::Store — Ruby surface for `confium_store`.
+//!
+//! `Confium::Store::Keystore` opens a keystore by backend wire name
+//! (`"memory"`, plus the remote-holding backends when the extension is
+//! built with their features) and exposes the remote-sign path added
+//! by the sign-with-handle contract:
+//!
+//!   ks = Confium::Store::Keystore.new("memory")
+//!   ks.sign(key_id, algorithm, message)  # => binary String
+//!
+//! Local backends raise for `#sign` — remote signing is implemented by
+//! the cloud KMS backends (`aws-kms`, `gcp-kms`, `azure-keyvault`),
+//! which source builds opt into via cargo features.
+
+use confium_store::Keystore as RustKeystore;
+use magnus::{
+    function, method, prelude::*, DataTypeFunctions, Error, Module, RHash, Ruby, TryConvert,
+    TypedData, Value,
+};
+
+use crate::util::{bytes_from_value, bytes_to_rstring, confium_error, new_details};
+
+#[derive(TypedData, DataTypeFunctions)]
+#[magnus(class = "Confium::Store::Keystore", size)]
+pub struct Keystore {
+    inner: std::cell::RefCell<RustKeystore>,
+}
+
+fn store_error(e: confium_store::error::Error, operation: &str) -> Error {
+    let ruby = match Ruby::get() {
+        Ok(r) => r,
+        Err(_) => return Error::new(magnus::exception::runtime_error(), e.to_string()),
+    };
+    let details = new_details(&ruby);
+    let _ = details.aset("operation", operation);
+    match &e {
+        confium_store::error::Error::NotImplemented { what } => {
+            let _ = details.aset("what", *what);
+        }
+        confium_store::error::Error::UnknownBackend { name } => {
+            let _ = details.aset("backend", name.as_str());
+        }
+        _ => {}
+    }
+    confium_error(e.to_string(), "Error", details)
+}
+
+impl Keystore {
+    fn initialize(ruby: &Ruby, args: &[Value]) -> Result<Self, Error> {
+        let scanned = magnus::scan_args::scan_args::<(String,), (Option<RHash>,), (), (), (), ()>(args)
+            .map_err(|e| crate::util::arg_error(e.to_string()))?;
+        let backend = scanned.required.0;
+        let mut options = confium_store::backend::Options::new();
+        if let Some(hash) = scanned.optional.0 {
+            hash.foreach(|k: Value, v: Value| {
+                let key: String = <String as TryConvert>::try_convert(k)?;
+                let value: String = <String as TryConvert>::try_convert(v)?;
+                options.insert(key, value);
+                Ok(magnus::r_hash::ForEach::Continue)
+            })?;
+        }
+        let inner =
+            RustKeystore::new(&backend, &options).map_err(|e| store_error(e, "Keystore.new"))?;
+        let _ = ruby;
+        Ok(Self {
+            inner: std::cell::RefCell::new(inner),
+        })
+    }
+
+    /// Sign `message` with the remotely-held key `key_id` under the
+    /// provider algorithm name. Returns binary String signature bytes.
+    fn sign(&self, args: &[Value]) -> Result<magnus::RString, Error> {
+        let scanned = magnus::scan_args::scan_args::<(String, String), (Option<Value>,), (), (), (), ()>(args)
+            .map_err(|e| crate::util::arg_error(e.to_string()))?;
+        let (key_id, algorithm) = scanned.required;
+        let message = scanned
+            .optional
+            .0
+            .ok_or_else(|| crate::util::arg_error("Keystore#sign: message is required"))?;
+        let bytes = bytes_from_value(message)?;
+        let signature = self
+            .inner
+            .borrow()
+            .sign("confium", "ruby", &key_id, &algorithm, &bytes)
+            .map_err(|e| store_error(e, "Keystore#sign"))?;
+        Ok(bytes_to_rstring(
+            &Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?,
+            &signature,
+        ))
+    }
+}
+
+/// The backend wire names registered at link time
+/// (`Confium::Store.backends`).
+fn backends() -> Result<Vec<String>, Error> {
+    Ok(confium_store::backend::iter()
+        .map(|b| b.name().to_string())
+        .collect())
+}
+
+pub fn init(ruby: &Ruby, parent: magnus::RModule) -> Result<(), Error> {
+    let store = parent.define_module("Store")?;
+    let class = store.define_class("Keystore", ruby.class_object())?;
+    class.define_singleton_method("new", function!(Keystore::initialize, -1))?;
+    class.define_method("sign", method!(Keystore::sign, -1))?;
+    store.define_module_function("backends", function!(backends, 0))?;
+    Ok(())
+}

data/lib/confium/errors.rb

@@ -12,8 +12,17 @@ module Confium
   class Error < StandardError
     attr_reader :details
 
-    def initialize(message = nil, details: {})
-      @details = details.transform_keys(&:to_sym)
+    # The native extension constructs errors positionally
+    # (message, details_hash) — the same shape every typed subclass
+    # accepts via Errors::Coerce. Accepting it here keeps the whole
+    # family uniform; the keyword form still works.
+    def initialize(message = nil, details_hash = nil, details: {})
+      base = if details_hash.is_a?(Hash) && !details_hash.empty?
+               details_hash
+             else
+               details
+             end
+      @details = base.transform_keys(&:to_sym)
       super(message)
     end
 

data/lib/confium/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Confium
-  VERSION = '0.6.1'
+  VERSION = '0.6.2'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: confium
 version: !ruby/object:Gem::Version
-  version: 0.6.1
+  version: 0.6.2
 platform: ruby
 authors:
 - Ribose Open
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-08-25 00:00:00.000000000 Z
+date: 2026-08-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rb_sys
@@ -124,6 +124,7 @@ files:
 - ext/confium_native/src/openpgp_verify.rs
 - ext/confium_native/src/path.rs
 - ext/confium_native/src/pki.rs
+- ext/confium_native/src/store.rs
 - ext/confium_native/src/tc.rs
 - ext/confium_native/src/transparency.rs
 - ext/confium_native/src/util.rs