nexusq 4.1.0 → 4.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fc02cce3fd358aad750b503011f71a74be3788f74eae505f0f5ffa2295f8466c
-  data.tar.gz: 7a8f14601b0b7036eca9e83279b54abbfee9f0d1806b1689d37e2eec6c09ac85
+  metadata.gz: 0d0cbd6ccb5958fd4306054feb0b4bf35a7af7e30eb7715976bf143b155a7780
+  data.tar.gz: 2a60ad05e3c5876ef9baba273da02514a87911edc6933f226190a22621117cbf
 SHA512:
-  metadata.gz: 4507def0f5dd466ef8becd4bc1395436b33d7adfd0d5bdff73d2e493deac679eebafb031a64d189782b3ced2061655fa51a1af5fbc79f64a6cb7864aac7bcd58
-  data.tar.gz: 5f3bfde921eb8734001f5fefdb54db60540766c634980ffe9fa5e178fa7cb5559285b4c31440b7a967b10fdd02c5eec69a4b319ce063226f6ab3564d2788f09d
+  metadata.gz: 3c5bebf374836d3917df4cec3d9cc45751d51395469ab3c3b17849364c81426dffa88eb7354c455a47aecc14036b1dad48756c1a57a6c1cde709456888cf23a6
+  data.tar.gz: 94f5b08433de43c04f93b7403318f5944a10bd2cae04965db9a68f1b885b2f97d3e4a01ec8fd866cd3da39d4d6abbf6a2ef8d26ed23f0ce09093e3cad1816be2

data/README.md

@@ -8,9 +8,11 @@ through `libnexusq`.
 
 - Ruby 3.0 or newer.
 - The `ffi` gem (`gem install ffi`).
-- The C SDK built (`cargo build -p nexusq-c`).
-- `libnexusq.so` available at runtime through `LD_LIBRARY_PATH` or
-  `NEXUSQ_LIBRARY`.
+- Published releases automatically download the version-matched runtime and
+  verify its SHA-256 checksum on Linux x64/ARM64 glibc, macOS ARM64, and Windows
+  x64. Rust is not required by SDK consumers; the library is cached under
+  `~/.cache/nexusq/<version>/<runtime-asset>`.
+- `NEXUSQ_LIBRARY` remains an advanced override for a local/custom library.
 
 ## Usage
 
@@ -25,17 +27,13 @@ puts "vault created at #{vault.path}"
 puts "format version: #{vault.format_version}"
 ```
 
-Run with:
+Run normally after installing the published SDK:
 
 ```bash
-NEXUSQ_LIBRARY=/path/to/nexusq/target/debug/libnexusq.so ruby your_program.rb
+ruby your_program.rb
 ```
 
-If the library directory is already on the dynamic loader path:
-
-```bash
-LD_LIBRARY_PATH=/path/to/nexusq/target/debug ruby your_program.rb
-```
+For source-checkout smoke tests or a custom build, set `NEXUSQ_LIBRARY` to the library path.
 
 ## What is available
 

data/examples/smoke/smoke.rb

@@ -10,6 +10,9 @@ require "tmpdir"
 require_relative "../../lib/nexusq"
 
 puts "nexusq version: #{Nexusq.version}"
+provider = Nexusq.backend_info
+abort "invalid backend metadata" unless provider[:name] && provider[:native_available] == (provider[:name] == "native-experimental") && provider[:experimental] == provider[:native_available]
+puts "PQC backend: #{provider[:name]}"
 
 path = File.join(Dir.tmpdir, "nexusq_ruby_smoke_#{$$}.nqv")
 File.delete(path) if File.exist?(path)

data/lib/nexusq.rb

@@ -6,13 +6,71 @@
 # cryptography or business logic; every operation delegates to libnexusq.
 
 require "ffi"
+require "digest"
+require "fileutils"
+require "open-uri"
+require "rbconfig"
 
 module Nexusq
   extend FFI::Library
 
-  ffi_lib ENV.fetch("NEXUSQ_LIBRARY", "nexusq")
+  RUNTIME_VERSION = "4.1.1"
+
+  def self.resolve_library
+    override = ENV["NEXUSQ_LIBRARY"]
+    return override unless override.nil? || override.empty?
+
+    os = RbConfig::CONFIG.fetch("host_os", "").downcase
+    arch = RbConfig::CONFIG.fetch("host_cpu", "").downcase
+    if os.include?("linux") && ["/lib/ld-musl-x86_64.so.1", "/lib/ld-musl-aarch64.so.1", "/lib/ld-musl-armhf.so.1"].any? { |path| File.exist?(path) }
+      raise LoadError, "Prebuilt NEXUS-Q Linux runtimes require glibc, not musl/Alpine; set NEXUSQ_LIBRARY to a compatible build."
+    end
+    asset, local_name = if os.include?("linux") && %w[x86_64 amd64].include?(arch)
+      ["nexusq-sdk-runtime-linux-x64.so", "libnexusq.so"]
+    elsif os.include?("linux") && %w[aarch64 arm64].include?(arch)
+      ["nexusq-sdk-runtime-linux-arm64.so", "libnexusq.so"]
+    elsif os.include?("darwin") && %w[arm64 aarch64].include?(arch)
+      ["nexusq-sdk-runtime-macos-arm64.dylib", "libnexusq.dylib"]
+    elsif os.match?(/mingw|mswin/) && %w[x86_64 amd64].include?(arch)
+      ["nexusq-sdk-runtime-windows-x64.dll", "nexusq.dll"]
+    else
+      raise LoadError, "No prebuilt NEXUS-Q runtime for #{os}/#{arch}; set NEXUSQ_LIBRARY to a compatible library path."
+    end
+
+    cache = File.join(Dir.home, ".cache", "nexusq", RUNTIME_VERSION, asset)
+    library = File.join(cache, local_name)
+    digest_file = "#{library}.sha256"
+    FileUtils.mkdir_p(cache)
+    if File.file?(library) && File.file?(digest_file) &&
+       Digest::SHA256.file(library).hexdigest == File.read(digest_file).strip
+      return library
+    end
+
+    base = "https://github.com/lecodev-26/nexus-q/releases/download/v#{RUNTIME_VERSION}/"
+    checksums = URI.open("#{base}NATIVE-RUNTIME-SHA256SUMS", "User-Agent" => "NEXUS-Q Ruby SDK", open_timeout: 10, read_timeout: 30, &:read)
+    expected = checksums.lines.find { |line| line.strip.end_with?("  #{asset}") }&.split&.first
+    raise LoadError, "No published checksum for #{asset}" unless expected
+
+    bytes = URI.open("#{base}#{asset}", "User-Agent" => "NEXUS-Q Ruby SDK", open_timeout: 10, read_timeout: 60, &:read)
+    actual = Digest::SHA256.hexdigest(bytes)
+    raise LoadError, "SHA-256 mismatch for #{asset}; refusing to load an unverified runtime" unless actual == expected.downcase
+
+    temporary = "#{library}.download"
+    File.binwrite(temporary, bytes)
+    File.rename(temporary, library)
+    File.write(digest_file, "#{actual}\n")
+    library
+  rescue LoadError
+    raise
+  rescue StandardError => e
+    raise LoadError, "Unable to obtain verified NEXUS-Q #{RUNTIME_VERSION} runtime: #{e.message}. Set NEXUSQ_LIBRARY to a compatible library path."
+  end
+
+  ffi_lib resolve_library
 
   attach_function :nexusq_version, [], :string
+  attach_function :nexusq_backend_name, [], :string
+  attach_function :nexusq_backend_is_experimental, [], :uint8
   attach_function :nexusq_last_error_message, [], :string
   attach_function :nexusq_vault_create, [:string, :string, :string], :int32
   attach_function :nexusq_vault_format_version, [:string], :int32
@@ -21,6 +79,12 @@ module Nexusq
     nexusq_version
   end
 
+  # Reports the provider compiled into the loaded library; it does not switch providers.
+  def self.backend_info
+    name = nexusq_backend_name
+    { name: name, experimental: nexusq_backend_is_experimental != 0, native_available: name == "native-experimental" }
+  end
+
   def self.last_error
     nexusq_last_error_message
   end

metadata

@@ -1,13 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: nexusq
 version: !ruby/object:Gem::Version
-  version: 4.1.0
+  version: 4.1.1
 platform: ruby
 authors:
 - lecodev-26
+autorequire:
 bindir: bin
 cert_chain: []
-date: 1980-01-02 00:00:00.000000000 Z
+date: 2026-10-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ffi
@@ -25,6 +26,7 @@ dependencies:
         version: '1.15'
 description: Thin FFI wrapper over the NEXUS-Q C SDK (libnexusq). No cryptography
   or business logic lives here.
+email:
 executables: []
 extensions: []
 extra_rdoc_files: []
@@ -34,8 +36,10 @@ files:
 - lib/nexusq.rb
 homepage: https://github.com/lecodev-26/nexus-q
 licenses:
-- MIT OR Apache-2.0
+- MIT
+- Apache-2.0
 metadata: {}
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -50,7 +54,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 3.4.20
+signing_key:
 specification_version: 4
 summary: Ruby bindings for NEXUS-Q
 test_files: []