pq_crypto 0.6.7 → 0.6.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cf8d3b17b9579ef551ef337aab16a9eb356846a36ff492577e2d728ec0e285e2
-  data.tar.gz: 26c3c3646d066617e37cb2cb1219e7ee5ca640488c84b480b6259461999b48e5
+  metadata.gz: db8e5b65d14cc5dcc4950a2da14b781efcf4c8dd17774cffc076e9d5591509ca
+  data.tar.gz: '09cf8c3e990a416ab0f8f77fe2a2a6067fdd8a3f4d00607a4162e4259d6044bd'
 SHA512:
-  metadata.gz: bd58150566a566af1c3083ef2c72538acafb6b15c5ebe954d0d7af35f96cdf41a5f1fe17c8d3c956e29b3c51bd89b29ec24245749efbca82389b1d2dc3c91ede
-  data.tar.gz: 5d974df3a99f9284da5c5cdfff25ba1808dc083063c12f97db6b803a34aa15687a0cda9565c8617edd95015c8d23139181d56d69d2483a3ac17b2239bec3cba3
+  metadata.gz: 81a8509efb9d280100975a8e4a9a0a6aab70061b49bbc48a396de490723c316abe63442cfb041c68dbeefd9383fba647b198318082723ffb9bace9d0ffd12c78
+  data.tar.gz: 1055665295f23df22a53880fbf02a2e8d0c0cb33f1b65a43b1fe2f1f040da829bcaf4895440093addc432f15fb9c21792f28bf41e2949c90b9c93bc2784e5e93

data/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## [0.6.8] - 2026-10-28
+
+### Changed
+
+- **Refactored Ruby serialization and streaming paths.** Split SPKI and PKCS#8
+  decoding into focused validation steps, shared the seed/expanded-key codecs,
+  and consolidated ML-DSA streaming builder cleanup. SPKI algorithm matching
+  now uses one shared validator. Public APIs and encoded formats are unchanged.
+
 ## [0.6.7] - 2026-08-10
 
 ### Fixed

data/ext/pqcrypto/pqcrypto_ruby_secure.c

@@ -8,6 +8,8 @@
 #if defined(__clang__) || defined(__GNUC__)
 #pragma GCC diagnostic pop
 #endif
+#include <stdbool.h>
+#include <stdatomic.h>
 #include <stdlib.h>
 #include <string.h>
 
@@ -1460,6 +1462,7 @@ static VALUE pqcrypto_version(VALUE self) {
 
 typedef struct {
     void *builder;
+    atomic_bool busy;
 } mu_builder_wrapper_t;
 
 typedef struct {
@@ -1526,15 +1529,29 @@ static const rb_data_type_t mu_builder_data_type = {
     .flags = RUBY_TYPED_FREE_IMMEDIATELY,
 };
 
-static mu_builder_wrapper_t *mu_builder_unwrap(VALUE obj) {
+static mu_builder_wrapper_t *mu_builder_lock(VALUE obj) {
     mu_builder_wrapper_t *wrapper;
     TypedData_Get_Struct(obj, mu_builder_wrapper_t, &mu_builder_data_type, wrapper);
-    if (wrapper == NULL || wrapper->builder == NULL) {
-        rb_raise(ePQCryptoError, "mu builder used after release");
+    if (wrapper == NULL) {
+        rb_raise(ePQCryptoError, "mu builder is unavailable");
+    }
+    if (atomic_exchange_explicit(&wrapper->busy, true, memory_order_acquire)) {
+        rb_raise(ePQCryptoError, "mu builder is busy");
     }
     return wrapper;
 }
 
+static void mu_builder_unlock(mu_builder_wrapper_t *wrapper) {
+    atomic_store_explicit(&wrapper->busy, false, memory_order_release);
+}
+
+static void mu_builder_require_active(mu_builder_wrapper_t *wrapper) {
+    if (wrapper->builder == NULL) {
+        mu_builder_unlock(wrapper);
+        rb_raise(ePQCryptoError, "mu builder used after release");
+    }
+}
+
 static VALUE pqcrypto__native_mldsa_extract_tr(int argc, VALUE *argv, VALUE self) {
     (void)self;
     VALUE algorithm = ID2SYM(rb_intern("ml_dsa_65"));
@@ -1614,6 +1631,7 @@ static VALUE pqcrypto__native_mldsa_mu_builder_new(VALUE self, VALUE tr, VALUE c
     VALUE obj =
         TypedData_Make_Struct(rb_cObject, mu_builder_wrapper_t, &mu_builder_data_type, wrapper);
     wrapper->builder = builder;
+    atomic_init(&wrapper->busy, false);
     return obj;
 }
 
@@ -1625,24 +1643,31 @@ static void *pq_mu_absorb_nogvl(void *arg) {
 
 static VALUE pqcrypto__native_mldsa_mu_builder_update(VALUE self, VALUE builder_obj, VALUE chunk) {
     (void)self;
-    mu_builder_wrapper_t *wrapper = mu_builder_unwrap(builder_obj);
     StringValue(chunk);
 
     size_t chunk_len = (size_t)RSTRING_LEN(chunk);
+    mu_builder_wrapper_t *wrapper = mu_builder_lock(builder_obj);
+    mu_builder_require_active(wrapper);
     if (chunk_len == 0) {
+        mu_builder_unlock(wrapper);
         return Qnil;
     }
 
     if (chunk_len < PQ_MU_ABSORB_NOGVL_MIN_BYTES) {
-        int rc =
-            pq_mu_builder_absorb(wrapper->builder, (const uint8_t *)RSTRING_PTR(chunk), chunk_len);
+        int rc = pq_mu_builder_absorb(wrapper->builder,
+                                      (const uint8_t *)RSTRING_PTR(chunk), chunk_len);
+        mu_builder_unlock(wrapper);
         if (rc != PQ_SUCCESS) {
             pq_raise_general_error(rc);
         }
         return Qnil;
     }
 
-    uint8_t *copy = pq_alloc_buffer(chunk_len);
+    uint8_t *copy = malloc(chunk_len);
+    if (copy == NULL) {
+        mu_builder_unlock(wrapper);
+        rb_raise(rb_eNoMemError, "Memory allocation failed");
+    }
     memcpy(copy, RSTRING_PTR(chunk), chunk_len);
 
     mu_absorb_call_t call = {0};
@@ -1651,7 +1676,9 @@ static VALUE pqcrypto__native_mldsa_mu_builder_update(VALUE self, VALUE builder_
     call.chunk_len = chunk_len;
 
     rb_nogvl(pq_mu_absorb_nogvl, &call, NULL, NULL, PQ_RB_NOGVL_OFFLOAD_SAFE);
+    RB_GC_GUARD(builder_obj);
     free(copy);
+    mu_builder_unlock(wrapper);
 
     if (call.result != PQ_SUCCESS) {
         pq_raise_general_error(call.result);
@@ -1667,7 +1694,8 @@ static void *pq_mu_finalize_nogvl(void *arg) {
 
 static VALUE pqcrypto__native_mldsa_mu_builder_finalize(VALUE self, VALUE builder_obj) {
     (void)self;
-    mu_builder_wrapper_t *wrapper = mu_builder_unwrap(builder_obj);
+    mu_builder_wrapper_t *wrapper = mu_builder_lock(builder_obj);
+    mu_builder_require_active(wrapper);
 
     uint8_t mu[PQ_MLDSA_MUBYTES];
 
@@ -1676,8 +1704,10 @@ static VALUE pqcrypto__native_mldsa_mu_builder_finalize(VALUE self, VALUE builde
     call.mu_out = mu;
 
     rb_nogvl(pq_mu_finalize_nogvl, &call, NULL, NULL, PQ_RB_NOGVL_OFFLOAD_SAFE);
+    RB_GC_GUARD(builder_obj);
 
     wrapper->builder = NULL;
+    mu_builder_unlock(wrapper);
 
     if (call.result != PQ_SUCCESS) {
         pq_secure_wipe(mu, sizeof(mu));
@@ -1691,12 +1721,12 @@ static VALUE pqcrypto__native_mldsa_mu_builder_finalize(VALUE self, VALUE builde
 
 static VALUE pqcrypto__native_mldsa_mu_builder_release(VALUE self, VALUE builder_obj) {
     (void)self;
-    mu_builder_wrapper_t *wrapper;
-    TypedData_Get_Struct(builder_obj, mu_builder_wrapper_t, &mu_builder_data_type, wrapper);
-    if (wrapper != NULL && wrapper->builder != NULL) {
+    mu_builder_wrapper_t *wrapper = mu_builder_lock(builder_obj);
+    if (wrapper->builder != NULL) {
         pq_mu_builder_release(wrapper->builder);
         wrapper->builder = NULL;
     }
+    mu_builder_unlock(wrapper);
     return Qnil;
 }