quic 0.0.1 → 0.0.2

data/ext/quic/stream.c

@@ -2,7 +2,7 @@
 
 #include <string.h>
 
-VALUE rb_cQuicStream;
+VALUE rb_cQUICStream;
 
 static void
 quic_stream_free(void *ptr)
@@ -18,7 +18,7 @@ quic_stream_size(const void *ptr)
 }
 
 const rb_data_type_t quic_stream_data_type = {
-  "Quic::Stream",
+  "QUIC::Stream",
   {NULL, quic_stream_free, quic_stream_size,},
   NULL, NULL,
   RUBY_TYPED_FREE_IMMEDIATELY,
@@ -35,7 +35,7 @@ quic_stream_alloc(VALUE klass)
 VALUE
 quic_stream_new(int64_t stream_id, VALUE client)
 {
-  VALUE self = quic_stream_alloc(rb_cQuicStream);
+  VALUE self = quic_stream_alloc(rb_cQUICStream);
   quic_stream_t *s;
   TypedData_Get_Struct(self, quic_stream_t, &quic_stream_data_type, s);
   s->stream_id = stream_id;
@@ -53,7 +53,7 @@ quic_stream_new(int64_t stream_id, VALUE client)
    quic_stream_write_m and #write_nonblock returns a partial byte count in
    quic_stream_write_nonblock_m). This helper is reached only after the
    caller has confirmed the bytes fit in the current send window, so it
-   never raises Quic::Error::WaitWritable on its own. */
+   never raises QUIC::Error::WaitWritable on its own. */
 static VALUE
 quic_stream_enqueue(VALUE self, VALUE data, bool fin)
 {
@@ -61,10 +61,10 @@ quic_stream_enqueue(VALUE self, VALUE data, bool fin)
   TypedData_Get_Struct(self, quic_stream_t, &quic_stream_data_type, s);
 
   if (s->reset || s->closed) {
-    rb_raise(rb_eQuicErrorStreamClosed, "stream is closed");
+    rb_raise(rb_eQUICErrorStreamClosed, "stream is closed");
   }
   if (s->fin_sent) {
-    rb_raise(rb_eQuicErrorStreamClosed, "stream FIN already sent");
+    rb_raise(rb_eQUICErrorStreamClosed, "stream FIN already sent");
   }
 
   Check_Type(data, T_STRING);
@@ -110,7 +110,7 @@ quic_stream_window_left(VALUE client_v, quic_stream_t *s)
 /* Blocking write: block by repeatedly invoking Client#pump_once until the
    peer's flow control window has enough room for the full payload, then
    enqueue. IO#write-compatible: always queues all of `data`. Bare Streams
-   (built via Quic::Stream.allocate for unit tests, with @client = nil) skip
+   (built via QUIC::Stream.allocate for unit tests, with @client = nil) skip
    the window check entirely. */
 static VALUE
 quic_stream_write_m(int argc, VALUE *argv, VALUE self)
@@ -132,7 +132,7 @@ quic_stream_write_m(int argc, VALUE *argv, VALUE self)
     quic_stream_t *s;
     TypedData_Get_Struct(self, quic_stream_t, &quic_stream_data_type, s);
     /* Loop until the full payload would fit in the current window. pump_once
-       raises Quic::Error::NotBound if @client has no socket bound; that
+       raises QUIC::Error::NotBound if @client has no socket bound; that
        error surfaces verbatim. */
     while ((uint64_t)needed > quic_stream_window_left(client_v, s)) {
       rb_funcall(client_v, rb_intern("pump_once"), 0);
@@ -143,7 +143,7 @@ quic_stream_write_m(int argc, VALUE *argv, VALUE self)
 }
 
 /* Non-blocking write: enqueue at most `window_left` bytes from `data` and
-   return the count actually queued. Raises Quic::Error::WaitWritable if the
+   return the count actually queued. Raises QUIC::Error::WaitWritable if the
    window is zero and we have a non-empty payload to send. If only a partial
    prefix fits, FIN is NOT set on this call (caller re-issues with
    `fin: true` once the remainder is accepted) so we don't half-commit FIN.
@@ -172,7 +172,7 @@ quic_stream_write_nonblock_m(int argc, VALUE *argv, VALUE self)
   uint64_t avail = quic_stream_window_left(client_v, s);
 
   if (avail == 0) {
-    rb_raise(rb_eQuicErrorWaitWritable, "stream send window is full");
+    rb_raise(rb_eQUICErrorWaitWritable, "stream send window is full");
   }
 
   long take = ((uint64_t)needed <= avail) ? needed : (long)avail;
@@ -198,7 +198,7 @@ quic_stream_close_write_m(VALUE self)
    to drop the returned prefix.
 
    - buffer empty + fin_received: raise EOFError (IO#read_nonblock semantics)
-   - buffer empty + !fin_received: raise Quic::Error::WaitReadable
+   - buffer empty + !fin_received: raise QUIC::Error::WaitReadable
    - buffer non-empty: return min(length, buffer.bytesize) bytes
 */
 static VALUE
@@ -218,7 +218,7 @@ quic_stream_read_nonblock_m(VALUE self, VALUE length_v)
     if (s->fin_received) {
       rb_raise(rb_eEOFError, "end of file reached");
     }
-    rb_raise(rb_eQuicErrorWaitReadable, "no data available");
+    rb_raise(rb_eQUICErrorWaitReadable, "no data available");
   }
 
   long take = (length < have) ? length : have;
@@ -253,7 +253,7 @@ quic_stream_close_read_m(VALUE self)
   ngtcp2_conn *conn = quic_client_conn(client_v);
 
   /* ngtcp2_conn_shutdown_stream_read sends STOP_SENDING. app_error_code 0
-     since no Quic-level error API is exposed yet. */
+     since no QUIC-level error API is exposed yet. */
   int rv = ngtcp2_conn_shutdown_stream_read(conn, 0, s->stream_id, 0);
   if (rv != 0) quic_raise_ngtcp2_error(rv);
   return Qnil;
@@ -268,17 +268,53 @@ quic_stream_close_m(VALUE self)
   return Qnil;
 }
 
+/* Abort the send side of the stream with RESET_STREAM
+   (ngtcp2_conn_shutdown_stream_write), carrying the given application error
+   code (default 0). After #reset, #write / #write_nonblock raise
+   QUIC::Error::StreamClosed because quic_stream_enqueue rejects a stream
+   with s->reset set. The read side is untouched (use #close_read /
+   #close for STOP_SENDING). Idempotent: a second #reset is a no-op.
+
+   A bare Stream (@client == nil, used by unit-test fixtures) skips the
+   ngtcp2 call and only flips s->reset, mirroring the #write / #close_write
+   bare-Stream escapes. */
+static VALUE
+quic_stream_reset_m(int argc, VALUE *argv, VALUE self)
+{
+  VALUE error_code_v = Qnil;
+  rb_scan_args(argc, argv, "01", &error_code_v);
+  uint64_t error_code = NIL_P(error_code_v) ? 0 : NUM2ULL(error_code_v);
+
+  quic_stream_t *s;
+  TypedData_Get_Struct(self, quic_stream_t, &quic_stream_data_type, s);
+
+  if (s->reset) return Qnil;  /* idempotent */
+
+  VALUE client_v = rb_ivar_get(self, rb_intern("@client"));
+  if (NIL_P(client_v)) {
+    s->reset = true;  /* bare Stream escape */
+    return Qnil;
+  }
+
+  ngtcp2_conn *conn = quic_client_conn(client_v);
+  int rv = ngtcp2_conn_shutdown_stream_write(conn, 0, s->stream_id, error_code);
+  if (rv != 0) quic_raise_ngtcp2_error(rv);
+  s->reset = true;
+  return Qnil;
+}
+
 void
-Init_quic_stream(VALUE rb_mQuicArg)
+Init_quic_stream(VALUE rb_mQUICArg)
 {
-  rb_cQuicStream = rb_define_class_under(rb_mQuicArg, "Stream", rb_cObject);
-  rb_define_alloc_func(rb_cQuicStream, quic_stream_alloc);
-  rb_define_method(rb_cQuicStream, "write", quic_stream_write_m, -1);
-  rb_define_method(rb_cQuicStream, "write_nonblock", quic_stream_write_nonblock_m, -1);
-  rb_define_method(rb_cQuicStream, "close_write", quic_stream_close_write_m, 0);
-  rb_define_method(rb_cQuicStream, "read_nonblock", quic_stream_read_nonblock_m, 1);
-  rb_define_method(rb_cQuicStream, "eof?", quic_stream_eof_p, 0);
-  rb_define_method(rb_cQuicStream, "close_read", quic_stream_close_read_m, 0);
-  rb_define_method(rb_cQuicStream, "close", quic_stream_close_m, 0);
+  rb_cQUICStream = rb_define_class_under(rb_mQUICArg, "Stream", rb_cObject);
+  rb_define_alloc_func(rb_cQUICStream, quic_stream_alloc);
+  rb_define_method(rb_cQUICStream, "write", quic_stream_write_m, -1);
+  rb_define_method(rb_cQUICStream, "write_nonblock", quic_stream_write_nonblock_m, -1);
+  rb_define_method(rb_cQUICStream, "close_write", quic_stream_close_write_m, 0);
+  rb_define_method(rb_cQUICStream, "read_nonblock", quic_stream_read_nonblock_m, 1);
+  rb_define_method(rb_cQUICStream, "eof?", quic_stream_eof_p, 0);
+  rb_define_method(rb_cQUICStream, "close_read", quic_stream_close_read_m, 0);
+  rb_define_method(rb_cQUICStream, "close", quic_stream_close_m, 0);
+  rb_define_method(rb_cQUICStream, "reset", quic_stream_reset_m, -1);
   /* #read (blocking) and #initiator are defined in lib/quic/stream.rb. */
 }

data/ext/quic/stream.h

@@ -3,9 +3,9 @@
 
 #include "quic.h"
 
-extern VALUE rb_cQuicStream;
+extern VALUE rb_cQUICStream;
 
-void Init_quic_stream(VALUE rb_mQuicArg);
+void Init_quic_stream(VALUE rb_mQUICArg);
 
 /* Internal helpers used by connection_client.c stream callbacks and
    write_pkt's stream-aware path. */
@@ -29,11 +29,15 @@ typedef struct {
   bool closed;                /* stream_close callback fired */
   uint64_t close_app_error_code;
   bool close_has_app_error_code;
+  /* Set once a peer-initiated (server) stream has been pushed onto the
+     owner Client's @accept_queue, so recv_stream_data does not enqueue it
+     again on subsequent data arrivals. */
+  bool accept_queued;
 } quic_stream_t;
 
 extern const rb_data_type_t quic_stream_data_type;
 
-/* Allocate a new Quic::Stream Ruby object with a zero-initialized
+/* Allocate a new QUIC::Stream Ruby object with a zero-initialized
    quic_stream_t. Caller fills stream_id and ivars (@id / @client /
    @pending_chunks / @recv_buffer). */
 VALUE quic_stream_new(int64_t stream_id, VALUE client);

data/lib/quic/connection.rb

@@ -2,22 +2,45 @@
 
 require "socket"
 
-module Quic
+module QUIC
   module Connection
     class Client
-      def self.new(host:, port:, transport_params: nil, settings: nil)
-        remote_sockaddr = Addrinfo.udp(host, port).to_sockaddr
+      attr_reader :remote_address
+
+      # Build a Client and pin a single peer address. address_family takes a
+      # Symbol (:inet for IPv4, :inet6 for IPv6) or nil to defer family
+      # selection to Addrinfo.udp's implicit resolution. Pin the resolved
+      # Addrinfo into @remote_address so callers can match their UDPSocket's
+      # connected sockaddr (otherwise DNS round-robin between Client.new and
+      # sock.connect can produce a path that ngtcp2 silently drops).
+      def self.new(host:, port:, address_family: nil, transport_params: nil, settings: nil)
+        family = case address_family
+        when nil then nil
+        when :inet then Socket::AF_INET
+        when :inet6 then Socket::AF_INET6
+        else
+          raise ArgumentError, "unknown address_family: #{address_family.inspect}"
+        end
+
+        remote_address = if family
+          Addrinfo.getaddrinfo(host, port, family, :DGRAM, Socket::IPPROTO_UDP).first
+        else
+          Addrinfo.udp(host, port)
+        end
+
+        remote_sockaddr = remote_address.to_sockaddr
         local_sockaddr = Addrinfo.udp("0.0.0.0", 0).to_sockaddr
 
         client = _open(
           local_sockaddr: local_sockaddr,
           remote_sockaddr: remote_sockaddr,
           server_name: host,
-          transport_params: transport_params || Quic::TransportParams.default,
-          settings: settings || Quic::Settings.default
+          transport_params: transport_params || QUIC::TransportParams.default,
+          settings: settings || QUIC::Settings.default
         )
         client.instance_variable_set(:@host, host)
         client.instance_variable_set(:@port, port)
+        client.instance_variable_set(:@remote_address, remote_address)
         client
       end
 
@@ -35,10 +58,10 @@ module Quic
       end
 
       # Drive the handshake to completion using the bound socket. Raises
-      # Quic::Error::NotBound if #bind has not been called. Propagates any
-      # Quic::Error subclass raised by #read_pkt / #handle_expiry.
+      # QUIC::Error::NotBound if #bind has not been called. Propagates any
+      # QUIC::Error subclass raised by #read_pkt / #handle_expiry.
       def run
-        raise Quic::Error::NotBound, "Quic::Connection::Client#bind(sock) has not been called" if @sock.nil?
+        raise QUIC::Error::NotBound, "QUIC::Connection::Client#bind(sock) has not been called" if @sock.nil?
 
         pump_until { handshake_completed? }
       end
@@ -49,7 +72,7 @@ module Quic
       # fire. Public-ish so Stream blocking ops can share it; documented as
       # "internal" for users.
       def pump_once(timeout: nil)
-        raise Quic::Error::NotBound, "Quic::Connection::Client#bind(sock) has not been called" if @sock.nil?
+        raise QUIC::Error::NotBound, "QUIC::Connection::Client#bind(sock) has not been called" if @sock.nil?
 
         while (pkt = write_pkt)
           @sock.send(pkt, 0)
@@ -79,6 +102,43 @@ module Quic
         pump_once until pred.call
       end
 
+      # Pop the next peer-initiated (server) stream off the accept queue,
+      # driving the I/O loop until one arrives. The queue is fed by the
+      # recv_stream_data callback the first time a server stream carries data.
+      #
+      # timeout: nil      block until a stream is available (requires #bind)
+      # timeout: 0        return immediately; nil if the queue is empty
+      # timeout: Numeric  block up to that many seconds, then return nil
+      #
+      # Returns a QUIC::Stream, or nil on timeout.
+      def accept_stream(timeout: nil)
+        stream = @accept_queue.shift
+        return stream unless stream.nil?
+        return nil if timeout == 0
+
+        deadline = timeout && Process.clock_gettime(Process::CLOCK_MONOTONIC) + timeout
+        loop do
+          if deadline
+            remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+            return nil if remaining <= 0.0
+            pump_once(timeout: remaining)
+          else
+            pump_once
+          end
+          stream = @accept_queue.shift
+          return stream unless stream.nil?
+        end
+      end
+
+      # Non-blocking variant of #accept_stream. Returns the next queued
+      # server stream, or raises QUIC::Error::WaitReadable (IO::WaitReadable
+      # mixin) when the queue is empty. Does not require #bind.
+      def accept_stream_nonblock
+        stream = @accept_queue.shift
+        raise QUIC::Error::WaitReadable, "no server-initiated stream available" if stream.nil?
+        stream
+      end
+
       private
 
       def pump_timeout(caller_timeout)

data/lib/quic/settings.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-module Quic
+module QUIC
   Settings = Data.define(
     :cc_algo,
     :initial_rtt,
@@ -8,10 +8,27 @@ module Quic
     :max_stream_window,
     :handshake_timeout,
     :no_pmtud,
-    :alpn
+    :alpn,
+    :verify_mode,
+    :ca_file,
+    :ca_path
   )
 
   class Settings
+    # verify_mode (:peer or :none), ca_file and ca_path control server
+    # certificate verification. They default here so that callers building a
+    # Settings without them keep working.
+    #
+    # With verify_mode :peer and both ca_file and ca_path nil, the system
+    # default store is used, and SSL_CERT_FILE / SSL_CERT_DIR are honoured.
+    # That store is loaded once per process, the first time a connection needs
+    # it; later changes to those variables or to the CA bundle are not picked
+    # up. Setting ca_file or ca_path trusts only the certificates found there.
+    # With verify_mode :none, ca_file and ca_path are ignored.
+    def initialize(verify_mode: :peer, ca_file: nil, ca_path: nil, **rest)
+      super
+    end
+
     def self.default
       new(
         cc_algo: :cubic,
@@ -20,7 +37,10 @@ module Quic
         max_stream_window: 0,
         handshake_timeout: 10_000_000_000,
         no_pmtud: false,
-        alpn: []
+        alpn: [],
+        verify_mode: :peer,
+        ca_file: nil,
+        ca_path: nil
       )
     end
   end

data/lib/quic/stream.rb

@@ -1,10 +1,10 @@
 # frozen_string_literal: true
 
-module Quic
-  # Quic::Stream is defined in the C extension (ext/quic/stream.c); this file
+module QUIC
+  # QUIC::Stream is defined in the C extension (ext/quic/stream.c); this file
   # reopens it to add the bits that are easier to express in Ruby:
   # #initiator (a tiny lookup over @id) and the blocking #read which wraps
-  # the C #read_nonblock with an internal Client#pump_until loop.
+  # the C #read_nonblock with an internal Client#pump_once loop.
   class Stream
     INITIATORS = %i[client_bidi server_bidi client_uni server_uni].freeze
 
@@ -24,28 +24,31 @@ module Quic
     #                 return up to `length` bytes, return nil at EOF.
     #   read(nil):    block until EOF, return everything that was received
     #                 (an empty String if nothing arrived before FIN).
+    #
+    # Both branches drain first and pump only when there is nothing to drain.
+    # #read_nonblock already distinguishes the two states we care about --
+    # QUIC::Error::WaitReadable for "nothing buffered yet" and EOFError for
+    # "nothing buffered and FIN seen" -- so the loop needs no separate
+    # predicate over @recv_buffer / #eof?.
     def read(length = nil)
       if length.nil?
-        @client.pump_until { eof? }
         out = +""
         out.force_encoding(Encoding::BINARY)
-        until eof?
-          # Should not happen given pump_until's predicate, but defensive.
-          out << read_nonblock(4096)
-        end
-        # Drain anything that arrived after the predicate was last evaluated.
         loop do
           out << read_nonblock(4096)
-        rescue Quic::Error::WaitReadable, EOFError
+        rescue QUIC::Error::WaitReadable
+          @client.pump_once
+        rescue EOFError
           break
         end
         out
       else
-        @client.pump_until { @recv_buffer.bytesize > 0 || @fin_received }
-        begin
-          read_nonblock(length)
+        loop do
+          return read_nonblock(length)
+        rescue QUIC::Error::WaitReadable
+          @client.pump_once
         rescue EOFError
-          nil
+          return nil
         end
       end
     end

data/lib/quic/transport_params.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-module Quic
+module QUIC
   TransportParams = Data.define(
     :initial_max_stream_data_bidi_local,
     :initial_max_stream_data_bidi_remote,

data/lib/quic/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
-module Quic
-  VERSION = "0.0.1"
+module QUIC
+  VERSION = "0.0.2"
 end

data/lib/quic.rb

@@ -2,7 +2,7 @@
 
 require_relative "quic/version"
 
-module Quic
+module QUIC
   class Error < StandardError
     attr_reader :code
   end

data/sig/quic.rbs

@@ -1,7 +1,7 @@
-module Quic
+module QUIC
   VERSION: String
 
-  def self.library_versions: () -> { ngtcp2: String, openssl: String }
+  def self.library_versions: () -> { ngtcp2: String, openssl: String, picotls: String }
 
   class Error < StandardError
     attr_reader code: Integer?
@@ -19,6 +19,15 @@ module Quic
     end
 
     class CryptoError < Error
+      # The TLS alert this client sent when the handshake failed in
+      # #read_pkt, or nil. Alerts received from the peer are not recorded.
+      attr_reader tls_alert: Integer?
+    end
+
+    class CertificateVerifyFailed < CryptoError
+      # X509_V_ERR_* (comparable with OpenSSL::X509::V_ERR_*), or nil when
+      # the server sent no certificate.
+      attr_reader verify_result: Integer?
     end
 
     class HandshakeTimeout < Error
@@ -69,13 +78,18 @@ module Quic
     attr_reader handshake_timeout: Integer
     attr_reader no_pmtud: bool
     attr_reader alpn: Array[String]
+    attr_reader verify_mode: :peer | :none
+    attr_reader ca_file: (String | _ToPath)?
+    attr_reader ca_path: (String | _ToPath)?
 
     def self.default: () -> Settings
   end
 
   module Connection
     class Client
-      def self.new: (host: String, port: Integer, ?transport_params: TransportParams?, ?settings: Settings?) -> Client
+      attr_reader remote_address: Addrinfo
+
+      def self.new: (host: String, port: Integer, ?address_family: Symbol?, ?transport_params: TransportParams?, ?settings: Settings?) -> Client
 
       def self._open: (
         local_sockaddr: String,
@@ -102,6 +116,24 @@ module Quic
       def run: () -> void
       def pump_once: (?timeout: Float?) -> void
       def pump_until: () { () -> boolish } -> void
+
+      # Pops the next peer-initiated (server) stream off the accept queue,
+      # driving the I/O loop until one arrives. timeout: nil blocks forever
+      # (requires #bind), timeout: 0 returns immediately, timeout: Numeric
+      # blocks up to that many seconds. Returns nil on timeout.
+      def accept_stream: (?timeout: Numeric?) -> Stream?
+
+      # Non-blocking #accept_stream. Returns the next queued server stream,
+      # or raises QUIC::Error::WaitReadable when the queue is empty.
+      def accept_stream_nonblock: () -> Stream
+
+      # Sends an application CONNECTION_CLOSE (frame type 0x1d) to the peer
+      # carrying error_code and reason, then transitions the underlying
+      # ngtcp2_conn to the closing period. Requires Client#bind to have been
+      # called; raises QUIC::Error::NotBound otherwise. A second #close call
+      # after the connection has already entered the closing or draining
+      # period is a no-op.
+      def close: (?error_code: Integer, ?reason: String) -> nil
     end
   end
 
@@ -118,12 +150,12 @@ module Quic
     # Blocks (by internally calling Client#pump_once) until the peer's flow
     # control window has room for the full payload, then queues all bytes
     # and returns data.bytesize. Requires the parent Client to be bound to
-    # a socket via Client#bind; raises Quic::Error::NotBound otherwise.
+    # a socket via Client#bind; raises QUIC::Error::NotBound otherwise.
     def write: (String data, ?fin: bool) -> Integer
 
     # Non-blocking variant. Queues as much of `data` as the current flow
     # control window allows and returns the byte count actually queued.
-    # Raises Quic::Error::WaitWritable (mixed in with IO::WaitWritable) when
+    # Raises QUIC::Error::WaitWritable (mixed in with IO::WaitWritable) when
     # the window is zero and the payload is non-empty. If only a partial
     # prefix is accepted, `fin: true` is NOT propagated; the caller must
     # re-issue with `fin: true` on the trailing chunk.
@@ -132,5 +164,10 @@ module Quic
     def close_write: () -> nil
     def close_read: () -> nil
     def close: () -> nil
+
+    # Aborts the send side with RESET_STREAM carrying error_code (default 0).
+    # After #reset, #write / #write_nonblock raise QUIC::Error::StreamClosed.
+    # The read side is unaffected. Idempotent: a second #reset is a no-op.
+    def reset: (?Integer error_code) -> nil
   end
 end

metadata

@@ -1,18 +1,34 @@
 --- !ruby/object:Gem::Specification
 name: quic
 version: !ruby/object:Gem::Version
-  version: 0.0.1
+  version: 0.0.2
 platform: ruby
 authors:
 - Yusuke Nakamura
 bindir: exe
 cert_chain: []
 date: 1980-01-02 00:00:00.000000000 Z
-dependencies: []
-description: A thin Ruby binding around ngtcp2 for the QUIC transport protocol, with
-  LibreSSL as the TLS backend. Both are vendored via mini_portile2 at install time;
-  no system libraries required. The API is intentionally optimized for synchronous
-  I/O and String-based buffers. Public API is not yet stable.
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: mini_portile2
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+description: A thin Ruby binding around ngtcp2 for the QUIC transport protocol, using
+  picotls for TLS 1.3. ngtcp2 and picotls are vendored via mini_portile2 at install
+  time and linked statically; the crypto primitives and X.509 come from the host's
+  OpenSSL (or LibreSSL), linked dynamically, so the process shares one libcrypto with
+  Ruby's openssl extension. The API is intentionally optimized for synchronous I/O
+  and String-based buffers. Public API is not yet stable.
 email:
 - yusuke1994525@gmail.com
 executables: []
@@ -22,13 +38,18 @@ extra_rdoc_files: []
 files:
 - CHANGELOG.md
 - CODE_OF_CONDUCT.md
+- LICENSE-DEPENDENCIES.txt
 - LICENSE.txt
 - README.md
 - Rakefile
+- examples/doq_demo.rb
 - examples/echo_demo.rb
 - examples/handshake_demo.rb
+- examples/io_loop_demo.rb
+- examples/verify_demo.rb
 - ext/quic/connection_client.c
 - ext/quic/extconf.rb
+- ext/quic/patches/picotls/0001-openssl-use-raw-public-key-api-for-X25519.patch
 - ext/quic/quic.c
 - ext/quic/quic.h
 - ext/quic/stream.c
@@ -48,6 +69,7 @@ metadata:
   homepage_uri: https://github.com/unasuke/quic-ruby
   source_code_uri: https://github.com/unasuke/quic-ruby
   changelog_uri: https://github.com/unasuke/quic-ruby/blob/main/CHANGELOG.md
+  rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths:
 - lib
@@ -62,8 +84,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.10
+rubygems_version: 4.0.16
 specification_version: 4
-summary: Thin Ruby binding around ngtcp2 for the QUIC transport protocol, with LibreSSL
-  as the TLS backend.
+summary: Thin Ruby binding around ngtcp2 for the QUIC transport protocol, using picotls
+  for TLS 1.3 over the system OpenSSL.
 test_files: []