saro-dat 4.3.4 → 4.6.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 87e1f1949bc6ed97274fa1141ca2d76915b75a09e6010f111f4bfce321316396
-  data.tar.gz: '05139251e2a28e03dd44cbe709b6612267373046c67c789052679dfbd13aec23'
+  metadata.gz: b6d5127dce2e1d7ca632f94e2fa8d6b6a1434a37ab285bbf43dfc589282fccbb
+  data.tar.gz: e26c938570bfe16eae48746935a541e6ed552653b302cf7d15c10b7304dbc0af
 SHA512:
-  metadata.gz: 6b43afc3cac0deb85eb1bbd5174049d91d07a033319078d7f0af2ecc5b3e290e8a0dd768e7a2de9db7cdedc50d62827f2103e5065a8811400c23376aef28650f
-  data.tar.gz: 3a4840105836a569f47af5cecb6bc57bd7aa79ee511b74d66e1cee2b96b4359c226e624849ab9f64be7d1d3cbd560d886bb0d33bd34fb51a6ebc9f6e53adbb71
+  metadata.gz: bb31b09e921a1222111ae2a5ce992ef12e76ac9c776039ebb7f408deaf6255a026f7f25ee820bddc055bbbb9ad84c3e24b493a9e489d6082ceba16fdd9037115
+  data.tar.gz: 0041f03e782e284867e46d744bf0d9360c6ff0f24bda8af74ae39dc396e0700bdd3b6fd85a22a618e9f9a3590f8632c7ba81c8f20d2848a365bea1105565acbb

data/.idea/saro-dat.iml

@@ -14,9 +14,11 @@
     <orderEntry type="library" scope="PROVIDED" name="base64 (v0.3.0, rbenv: 4.0.5) [gem]" level="application" />
     <orderEntry type="library" scope="PROVIDED" name="benchmark (v0.5.0, rbenv: 4.0.5) [gem]" level="application" />
     <orderEntry type="library" scope="PROVIDED" name="bundler (v4.0.12, rbenv: 4.0.5) [gem]" level="application" />
+    <orderEntry type="library" scope="PROVIDED" name="drb (v2.2.3, rbenv: 4.0.5) [gem]" level="application" />
     <orderEntry type="library" scope="PROVIDED" name="logger (v1.7.0, rbenv: 4.0.5) [gem]" level="application" />
-    <orderEntry type="library" scope="PROVIDED" name="minitest (v5.27.0, rbenv: 4.0.5) [gem]" level="application" />
+    <orderEntry type="library" scope="PROVIDED" name="minitest (v6.0.6, rbenv: 4.0.5) [gem]" level="application" />
     <orderEntry type="library" scope="PROVIDED" name="openssl (v4.0.2, rbenv: 4.0.5) [gem]" level="application" />
     <orderEntry type="library" scope="PROVIDED" name="parallel (v2.1.0, rbenv: 4.0.5) [gem]" level="application" />
+    <orderEntry type="library" scope="PROVIDED" name="prism (v1.9.0, rbenv: 4.0.5) [gem]" level="application" />
   </component>
 </module>

data/.idea/vcs.xml

@@ -3,5 +3,6 @@
   <component name="VcsDirectoryMappings">
     <mapping directory="" vcs="Git" />
     <mapping directory="$PROJECT_DIR$/../.." vcs="Git" />
+    <mapping directory="$PROJECT_DIR$/.." vcs="Git" />
   </component>
 </project>

data/PUBLISH.md

@@ -9,7 +9,9 @@ bundle install
 ```
 gem build saro-dat.gemspec
 gem signin
-gem push saro-dat-4.3.4.gem
+# glob, not a pinned filename: a hardcoded version silently pushes a stale
+# package after a version bump
+gem push saro-dat-*.gem
 ```
 
 ## install
@@ -36,3 +38,9 @@ ruby -v
 bundle add saro-dat
 bundle install
 ```
+
+## version up
+```
+bundle outdated
+bundle update --all
+```

data/README.md

@@ -6,14 +6,14 @@
 - [Example](https://dat.saro.me/libs/gems-saro-dat)
 
 ### Support Platform
-- [Rust](https://github.com/saro-lab/dat/tree/master/clients/dat-rust)
-- [Java, Kotlin](https://github.com/saro-lab/dat/tree/master/clients/dat-maven)
-- [Javascript, Typescript](https://github.com/saro-lab/dat/tree/master/clients/dat-npm)
-- [C#](https://github.com/saro-lab/dat/tree/master/clients/dat-nuget)
-- [Python](https://github.com/saro-lab/dat/tree/master/clients/dat-pypi)
-- [Go](https://github.com/saro-lab/dat/tree/master/clients/dat-go)
-- [Ruby](https://github.com/saro-lab/dat/tree/master/clients/dat-ruby)
-- [C/C++ (Vcpkg)](https://github.com/saro-lab/dat/tree/master/clients/dat-vcpkg)
+- [Rust](https://github.com/saro-lab/dat/tree/master/dat-rust)
+- [Java, Kotlin](https://github.com/saro-lab/dat/tree/master/dat-maven)
+- [Javascript, Typescript](https://github.com/saro-lab/dat/tree/master/dat-npm)
+- [C#](https://github.com/saro-lab/dat/tree/master/dat-nuget)
+- [Python](https://github.com/saro-lab/dat/tree/master/dat-pypi)
+- [Go](https://github.com/saro-lab/dat/tree/master/dat-go)
+- [Ruby](https://github.com/saro-lab/dat/tree/master/dat-ruby)
+- [C/C++ (Vcpkg)](https://github.com/saro-lab/dat/tree/master/dat-vcpkg)
 - [Cert(Key) Server (Docker)](https://github.com/saro-lab/dat)
 
 ## Support algorithm

data/lib/saro/dat/crypto.rb

@@ -2,6 +2,7 @@
 
 require 'openssl'
 require 'securerandom'
+require_relative 'error'
 require_relative 'util'
 
 module Saro
@@ -23,7 +24,7 @@ module Saro
     def self.get_crypto_config(algorithm)
       config = CRYPTO_CONFIG[algorithm]
       return config if config
-      raise ArgumentError, "Unsupported DAT Crypto Algorithm: #{algorithm}"
+      raise Saro::Dat::Error.new(Saro::Dat::ErrorCode::CONFIG_ALG_UNSUPPORTED, "unknown crypto algorithm: #{algorithm}")
     end
 
     class DatCrypto
@@ -31,6 +32,12 @@ module Saro
 
       def initialize(algorithm, key_bytes, config = nil)
         @config = config || Saro::Dat.get_crypto_config(algorithm)
+        if key_bytes.bytesize != @config[:length]
+          raise Saro::Dat::Error.new(
+            Saro::Dat::ErrorCode::KEY_INVALID,
+            "#{algorithm} key must be #{@config[:length]} bytes, got #{key_bytes.bytesize}"
+          )
+        end
         @algorithm = algorithm
         @key_bytes = key_bytes
       end
@@ -63,20 +70,27 @@ module Saro
         cipher.iv_len = 12
         cipher.iv = nonce
         
-        ciphertext = cipher.update(data) + cipher.final
-        tag = cipher.auth_tag
+        begin
+          ciphertext = cipher.update(data) + cipher.final
+          tag = cipher.auth_tag
+        rescue OpenSSL::Cipher::CipherError => e
+          raise Saro::Dat::Error.new(Saro::Dat::ErrorCode::CRYPTO_BACKEND, "aes-gcm encrypt failed", cause: e)
+        end
 
         nonce + ciphertext + tag
       end
 
+      def decrypt_base64(base64_str)
+        decrypt(Saro::Dat::Util.decode_base64_url(base64_str))
+      end
+
       def decrypt(data)
-        if data.is_a?(String) && data.encoding != Encoding::BINARY
-          data = Saro::Dat::Util.decode_base64_url(data)
-        end
         return "".b if data.nil? || data.empty?
 
-        if data.length <= 12 + 16 # nonce(12) + tag(16)
-          raise ArgumentError, "Invalid data length"
+        data = data.b if data.is_a?(String) && data.encoding != Encoding::BINARY
+
+        if data.bytesize <= 12 + 16
+          raise Saro::Dat::Error.new(Saro::Dat::ErrorCode::CRYPTO_DATA_INVALID, "ciphertext is shorter than iv(12) + tag(16)")
         end
 
         nonce = data[0, 12]
@@ -90,7 +104,11 @@ module Saro
         cipher.iv = nonce
         cipher.auth_tag = tag
 
-        res = cipher.update(ciphertext) + cipher.final
+        begin
+          res = cipher.update(ciphertext) + cipher.final
+        rescue OpenSSL::Cipher::CipherError => e
+          raise Saro::Dat::Error.new(Saro::Dat::ErrorCode::CRYPTO_TAG_MISMATCH, "gcm authentication tag mismatch", cause: e)
+        end
         res.force_encoding('BINARY')
         res
       end

data/lib/saro/dat/dat.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require_relative 'error'
 require_relative 'util'
 
 module Saro
@@ -7,6 +8,8 @@ module Saro
     class Dat
       attr_reader :dat, :expire, :cid, :plain, :secure, :signature, :format
 
+      attr_reader :error
+
       def initialize(dat_str)
         @dat = dat_str || ''
         @format = false
@@ -15,22 +18,70 @@ module Saro
         @plain = "".b
         @secure = "".b
         @signature = "".b
+        @error = nil
+
+        if @dat.empty?
+          @error = Saro::Dat::Error.new(Saro::Dat::ErrorCode::TOKEN_MALFORMED, "token is empty")
+          return
+        end
+
+        parts = @dat.split('.', -1)
+        if parts.length != 5
+          @error = Saro::Dat::Error.new(Saro::Dat::ErrorCode::TOKEN_MALFORMED, "expected exactly 5 dot-separated fields")
+          return
+        end
+
+        begin
+          @expire = Saro::Dat::Util.parse_u64(parts[0])
+        rescue Saro::Dat::Error => e
+          @error = Saro::Dat::Error.new(Saro::Dat::ErrorCode::TOKEN_MALFORMED, "expire field is not a plain decimal u64", cause: e)
+          return
+        end
+
+        begin
+          @cid = Saro::Dat::Util.parse_u64_hex(parts[1])
+        rescue Saro::Dat::Error => e
+          @error = Saro::Dat::Error.new(Saro::Dat::ErrorCode::TOKEN_MALFORMED, "cid field is not a plain hex u64", cause: e)
+          return
+        end
+
+        begin
+          @plain = Saro::Dat::Util.decode_base64_url(parts[2])
+        rescue Saro::Dat::Error => e
+          @error = Saro::Dat::Error.new(Saro::Dat::ErrorCode::TOKEN_MALFORMED, "plain field is not base64url", cause: e)
+          return
+        end
+
+        begin
+          @secure = Saro::Dat::Util.decode_base64_url(parts[3])
+        rescue Saro::Dat::Error => e
+          @error = Saro::Dat::Error.new(Saro::Dat::ErrorCode::TOKEN_MALFORMED, "secure field is not base64url", cause: e)
+          return
+        end
+
+        if parts[4].empty?
+          @error = Saro::Dat::Error.new(Saro::Dat::ErrorCode::SIG_MALFORMED, "signature field is empty")
+          return
+        end
 
-        if !@dat.empty?
-          parts = @dat.split('.')
-          if parts.length == 5
-            begin
-              @expire = parts[0].to_i
-              @cid = parts[1].to_i(16)
-              @plain = Saro::Dat::Util.decode_base64_url(parts[2])
-              @secure = Saro::Dat::Util.decode_base64_url(parts[3])
-              @signature = Saro::Dat::Util.decode_base64_url(parts[4])
-              @format = (!@signature.empty? && @expire >= 0)
-            rescue StandardError
-              @format = false
-            end
-          end
+        begin
+          @signature = Saro::Dat::Util.decode_base64_url(parts[4])
+        rescue Saro::Dat::Error => e
+          @error = Saro::Dat::Error.new(Saro::Dat::ErrorCode::SIG_MALFORMED, "signature field is not base64url", cause: e)
+          return
         end
+
+        if @signature.empty?
+          @error = Saro::Dat::Error.new(Saro::Dat::ErrorCode::SIG_MALFORMED, "signature field is empty")
+          return
+        end
+
+        @format = true
+      end
+
+      def raise_if_invalid!
+        raise @error if @error
+        nil
       end
 
       def self.from_value(value)
@@ -40,7 +91,7 @@ module Saro
 
       def expired
         return true unless @format
-        Time.now.to_i > @expire
+        Time.now.to_i >= @expire
       end
 
       alias_method :expired?, :expired

data/lib/saro/dat/dat_certificate.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require_relative 'error'
 require_relative 'crypto'
 require_relative 'signature'
 require_relative 'util'
@@ -10,10 +11,18 @@ module Saro
       attr_reader :cid, :signature_key, :crypto_key, :dat_issuance_start_seconds, :dat_issuance_end_seconds, :dat_ttl_seconds
 
       def initialize(cid, dat_issuance_start_seconds, dat_issuance_duration_seconds, dat_ttl_seconds, signature_key, crypto_key)
-        @cid = cid
-        @dat_issuance_start_seconds = dat_issuance_start_seconds
-        @dat_issuance_end_seconds = dat_issuance_start_seconds + dat_issuance_duration_seconds
-        @dat_ttl_seconds = dat_ttl_seconds
+        @cid = u64!("cid", cid)
+        @dat_issuance_start_seconds = u64!("dat_issuance_start_seconds", dat_issuance_start_seconds)
+        duration = u64!("dat_issuance_duration_seconds", dat_issuance_duration_seconds)
+        @dat_ttl_seconds = u64!("dat_ttl_seconds", dat_ttl_seconds)
+        @dat_issuance_end_seconds = u64!(
+          "dat_issuance_start_seconds + dat_issuance_duration_seconds",
+          @dat_issuance_start_seconds + duration
+        )
+        u64!(
+          "dat_issuance_start_seconds + dat_issuance_duration_seconds + dat_ttl_seconds",
+          @dat_issuance_end_seconds + @dat_ttl_seconds
+        )
         @signature_key = signature_key
         @crypto_key = crypto_key
       end
@@ -41,12 +50,14 @@ module Saro
 
       def self.imports(format_str)
         parts = format_str.split(".")
-        raise ArgumentError, "Invalid Certificate format" if parts.length != 8
+        if parts.length != 8
+          raise Saro::Dat::Error.new(Saro::Dat::ErrorCode::CERT_MALFORMED, "expected exactly 8 dot-separated fields")
+        end
 
-        cid = parts[0].to_i(16)
-        dat_issuance_start_seconds = parts[1].to_i
-        dat_issuance_duration_seconds = parts[2].to_i
-        dat_ttl_seconds = parts[3].to_i
+        cid = _field("cid") { Saro::Dat::Util.parse_u64_hex(parts[0]) }
+        dat_issuance_start_seconds = _field("issuance_start_seconds") { Saro::Dat::Util.parse_u64(parts[1]) }
+        dat_issuance_duration_seconds = _field("issuance_duration_seconds") { Saro::Dat::Util.parse_u64(parts[2]) }
+        dat_ttl_seconds = _field("dat_ttl_seconds") { Saro::Dat::Util.parse_u64(parts[3]) }
         signature_algorithm = parts[4]
         crypto_algorithm = parts[5]
         signature_key = Saro::Dat::DatSignature.imports(signature_algorithm, parts[6])
@@ -76,7 +87,23 @@ module Saro
         @signature_key.support_verify_only
       end
 
-      # For Ruby conventions
+      U64_MAX = 0xFFFFFFFFFFFFFFFF
+      private_constant :U64_MAX
+
+      private def u64!(name, value)
+        unless value.is_a?(Integer) && !value.is_a?(TrueClass) && value >= 0 && value <= U64_MAX
+          raise Saro::Dat::Error.new(Saro::Dat::ErrorCode::CERT_MALFORMED, "#{name} must fit in u64: #{value}")
+        end
+        value
+      end
+
+      def self._field(name)
+        yield
+      rescue Saro::Dat::Error => e
+        raise Saro::Dat::Error.new(Saro::Dat::ErrorCode::CERT_MALFORMED, "#{name} field is not a plain number", cause: e)
+      end
+      private_class_method :_field
+
       alias_method :issuable?, :issuable
       alias_method :expired?, :expired
       alias_method :signable?, :signable

data/lib/saro/dat/dat_cms_manager.rb

@@ -4,6 +4,7 @@ require 'net/http'
 require 'uri'
 require 'logger'
 require 'thread'
+require_relative 'error'
 require_relative 'dat_manager'
 require_relative 'dat'
 
@@ -12,6 +13,8 @@ module Saro
     class DatCmsManager
       DAT_CMS_API_VERSION = "v1"
 
+      STOP_JOIN_TIMEOUT_SECONDS = 1.0
+
       def initialize(uri:, token:, interval_seconds: 60, verify_only: false, dat_manager: nil)
         @uri = uri
         @token = token
@@ -20,9 +23,12 @@ module Saro
         @manager = dat_manager || DatManager.new
         @version = 0
         @lock = Mutex.new
+        @lifecycle = Mutex.new
+        @stop_cond = ConditionVariable.new
         @stopped = false
         @logger = Logger.new($stdout)
         @logger.level = Logger::DEBUG
+        @last_error = Saro::Dat::Error.new(Saro::Dat::ErrorCode::CMS_NOT_SYNCED)
 
         sync
 
@@ -32,17 +38,47 @@ module Saro
       end
 
       def stop
-        @lock.synchronize do
+        thread = nil
+        @lifecycle.synchronize do
+          return if @stopped
           @stopped = true
-          @thread&.kill # 혹은 다른 방식으로 스레드 중지
+          @stop_cond.broadcast
+          thread = @thread
         end
+        thread&.join(STOP_JOIN_TIMEOUT_SECONDS)
+        nil
+      end
+
+      def stopped?
+        @lifecycle.synchronize { @stopped }
+      end
+
+      attr_reader :last_error
+
+      def version
+        @version
       end
 
       def sync
-        # non-blocking lock
+        err = sync_or_raise
+        @last_error = nil
+        err
+      rescue Saro::Dat::Error => e
+        unless e.retry == :state
+          @last_error = e
+          @logger.error("[CRITICAL] DAT CMS SYNC #{@uri}: #{e.code} #{e.detail}")
+        end
+        nil
+      rescue StandardError => e
+        @last_error = Saro::Dat::Error.new(Saro::Dat::ErrorCode::CMS_UNKNOWN, "unclassified cms failure", cause: e)
+        @logger.error("[CRITICAL] DAT CMS SYNC #{@uri}: #{e.message}")
+        nil
+      end
+
+      private def sync_or_raise
         unless @lock.try_lock
-          @logger.warn("Last request ignored (Duplicate request)")
-          return
+          @logger.debug("cms sync skipped, previous sync still running: #{@uri}")
+          raise Saro::Dat::Error.new(Saro::Dat::ErrorCode::CMS_SYNC_IN_PROGRESS)
         end
 
         begin
@@ -50,55 +86,70 @@ module Saro
           request = Net::HTTP::Get.new(url)
           request["Authorization"] = @token
 
-          response = Net::HTTP.start(url.host, url.port, use_ssl: url.scheme == 'https', open_timeout: 10, read_timeout: 10) do |http|
-            http.request(request)
-          end
+          response =
+            begin
+              Net::HTTP.start(url.host, url.port, use_ssl: url.scheme == 'https', open_timeout: 10, read_timeout: 10) do |http|
+                http.request(request)
+              end
+            rescue StandardError => e
+              raise Saro::Dat::Error.new(Saro::Dat::ErrorCode::CMS_UNREACHABLE, "cannot reach #{@uri}", cause: e)
+            end
 
-          if response.code != "200"
-            @logger.error("Response status error, status:#{response.code} in #{url}")
-            return
-          end
+          status = response.code.to_i
+          raise self.class.http_status_error(status) unless status.between?(200, 299)
 
           body = response.body
           if body.nil? || body.empty?
             @logger.debug("No new certificate: #{url}")
-            return
+            return nil
           end
 
           lines = body.split("\n", 2)
           if lines.length < 2
             if body.start_with?("\n")
-              @logger.error("Invalid response: #{url}")
-              return
+              raise Saro::Dat::Error.new(Saro::Dat::ErrorCode::CMS_MALFORMED, "response has no version line")
             end
             @logger.debug("No new certificate: #{url}")
-            return
+            return nil
           end
 
           new_version_str = lines[0].strip
           new_certificates = lines[1].strip
 
-          if new_version_str.empty?
-            @logger.error("Invalid version in response: #{url}")
-            return
+          unless new_version_str.match?(/\A[0-9]+\z/)
+            raise Saro::Dat::Error.new(Saro::Dat::ErrorCode::CMS_MALFORMED, "version line is not a plain decimal integer")
           end
+          new_version = new_version_str.to_i
 
-          begin
-            new_version = Integer(new_version_str)
-            renew_count = @manager.imports(new_certificates, clear: false)
-            @version = new_version
-            @logger.debug("Renewed #{renew_count} certificates for version #{new_version}: #{url}")
-          rescue ArgumentError => e
-            @logger.error("Failed to parse version or certificates: #{e.message}")
+          if new_version < @version
+            @logger.warn("#{Saro::Dat::ErrorCode::CMS_VERSION_RESET}: #{@version} -> #{new_version}")
           end
 
-        rescue StandardError => e
-          @logger.error("[Exception] DAT CMS Sync #{@uri}: #{e.message}")
+          renew_count =
+            begin
+              @manager.imports(new_certificates, clear: false)
+            rescue Saro::Dat::Error => e
+              raise Saro::Dat::Error.new(Saro::Dat::ErrorCode::CMS_IMPORT_FAILED, "cannot apply received certificates", cause: e)
+            end
+
+          @version = new_version
+          @logger.debug("Renewed #{renew_count} certificates for version #{new_version}: #{url}")
+          nil
         ensure
           @lock.unlock
         end
       end
 
+      def self.http_status_error(status)
+        case status
+        when 401 then Saro::Dat::Error.new(Saro::Dat::ErrorCode::CMS_UNAUTHORIZED, "http 401")
+        when 403 then Saro::Dat::Error.new(Saro::Dat::ErrorCode::CMS_FORBIDDEN, "http 403")
+        when 404 then Saro::Dat::Error.new(Saro::Dat::ErrorCode::CMS_ENDPOINT_NOT_FOUND, "http 404")
+        when 500..599 then Saro::Dat::Error.new(Saro::Dat::ErrorCode::CMS_SERVER_ERROR, "http #{status}")
+        else Saro::Dat::Error.new(Saro::Dat::ErrorCode::CMS_HTTP_STATUS, "http #{status}")
+        end
+      end
+
       def get_manager
         @manager
       end
@@ -120,13 +171,20 @@ module Saro
       def schedule_sync
         @thread = Thread.new do
           loop do
-            sleep(@interval_seconds)
-            break if @stopped
+            break unless wait_interval
             run_sync_task
           end
         end
       end
 
+      def wait_interval
+        @lifecycle.synchronize do
+          return false if @stopped
+          @stop_cond.wait(@lifecycle, @interval_seconds)
+          !@stopped
+        end
+      end
+
       def run_sync_task
         sync
       rescue StandardError => e
@@ -168,13 +226,21 @@ module Saro
       end
 
       def build
-        parsed = URI.parse(@uri)
-        
+        parsed =
+          begin
+            URI.parse(@uri)
+          rescue URI::InvalidURIError => e
+            raise Saro::Dat::Error.new(Saro::Dat::ErrorCode::CONFIG_URI_INVALID, "cannot be parsed as a uri", cause: e)
+          end
+
+        unless %w[http https].include?(parsed.scheme)
+          raise Saro::Dat::Error.new(Saro::Dat::ErrorCode::CONFIG_URI_INVALID, "scheme must be http or https")
+        end
         if parsed.path && parsed.path != '' && parsed.path != '/'
-          raise ArgumentError, "uri must be path-less: #{@uri}"
+          raise Saro::Dat::Error.new(Saro::Dat::ErrorCode::CONFIG_URI_INVALID, "must be path-less: #{@uri}")
         end
         if parsed.query
-          raise ArgumentError, "uri must be query-less: #{@uri}"
+          raise Saro::Dat::Error.new(Saro::Dat::ErrorCode::CONFIG_URI_INVALID, "must be query-less: #{@uri}")
         end
 
         path = @verify_only ? "/v1/certs/verify-only" : "/v1/certs"

data/lib/saro/dat/dat_manager.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'set'
+require_relative 'error'
 require_relative 'dat_certificate'
 require_relative 'dat'
 require_relative 'signature'
@@ -9,9 +10,6 @@ require_relative 'util'
 module Saro
   module Dat
     class DatManager
-      # Immutable snapshot of the manager state.
-      # Readers access it lock-free via a single ivar read (atomic reference swap);
-      # writers rebuild a new frozen snapshot under @write_lock.
       State = Struct.new(:issuer, :certificates, :by_cid)
 
       EMPTY_STATE = State.new(nil, [].freeze, {}.freeze).freeze
@@ -23,26 +21,33 @@ module Saro
       end
 
       def import_certificates(input_certs, clear: false)
+        return 0 if input_certs.nil? || input_certs.empty?
+
+        seen_cids = Set.new
+        input_certs.each do |cert|
+          if seen_cids.include?(cert.cid)
+            raise Saro::Dat::Error.new(Saro::Dat::ErrorCode::CERT_DUPLICATE_CID, "duplicate cid #{cert.cid.to_s(16)}")
+          end
+          seen_cids.add(cert.cid)
+        end
+
         renew_count = 0
         @write_lock.synchronize do
           certificates = clear ? [] : @state.certificates.dup
 
-          before_cids = Set.new(certificates.map(&:cid))
-          seen_cids = Set.new
+          cids = Set.new(certificates.map(&:cid))
 
           input_certs.each do |cert|
-            raise ArgumentError, "Duplicate CID: #{cert.cid}" if seen_cids.include?(cert.cid)
-            seen_cids.add(cert.cid)
-            next if cert.expired
-            next if before_cids.include?(cert.cid)
+            next if cids.include?(cert.cid)
 
+            cids.add(cert.cid)
             certificates << cert
             renew_count += 1
           end
 
+          certificates.reject!(&:expired)
           certificates.sort_by!(&:dat_issuance_end_seconds)
 
-          # Find latest issuable certificate as issuer
           issuer = certificates.reverse_each.find(&:issuable)
 
           by_cid = {}
@@ -68,24 +73,61 @@ module Saro
       end
 
       def issue(plain, secure)
-        issuer = @state.issuer
-        raise RuntimeError, "Invalid DAT: Signing Key Does Not Exist" unless issuer
+        state = @state
+        issuer = state.issuer
+        unless issuer
+          raise Saro::Dat::Error.new(Saro::Dat::ErrorCode::MANAGER_NO_CERTIFICATE) if state.certificates.empty?
+          raise Saro::Dat::Error.new(
+            Saro::Dat::ErrorCode::MANAGER_NO_ISSUABLE_CERTIFICATE,
+            cause: no_issuable_cause(state.certificates)
+          )
+        end
 
         self.class._issue(issuer, plain, secure)
       end
 
       def parse(dat_input)
         dat = Saro::Dat::Dat.from_value(dat_input)
-        raise ArgumentError, "Invalid DAT: Format" unless dat.format
+        dat.raise_if_invalid!
 
-        certificate = @state.by_cid[dat.cid]
+        raise Saro::Dat::Error.new(Saro::Dat::ErrorCode::TOKEN_EXPIRED) if dat.expired?
 
-        raise ArgumentError, "Invalid DAT: CID(Certificate ID) Not Found" unless certificate
+        certificate = @state.by_cid[dat.cid]
+        unless certificate
+          raise Saro::Dat::Error.new(Saro::Dat::ErrorCode::CERT_NOT_FOUND, "cid #{dat.cid.to_s(16)}")
+        end
 
         self.class._parse(certificate, dat)
       end
 
-      private
+      private def no_issuable_cause(certificates)
+        now = Time.now.to_i
+        signable_seen = false
+        not_yet = false
+        ended = false
+
+        certificates.each do |cert|
+          next unless cert.signable
+          signable_seen = true
+          if now < cert.dat_issuance_start_seconds
+            not_yet = true
+          elsif now > cert.dat_issuance_end_seconds
+            ended = true
+          end
+        end
+
+        code =
+          if !signable_seen
+            Saro::Dat::ErrorCode::CERT_VERIFY_ONLY
+          elsif not_yet
+            Saro::Dat::ErrorCode::CERT_NOT_YET_ISSUABLE
+          elsif ended
+            Saro::Dat::ErrorCode::CERT_ISSUANCE_ENDED
+          else
+            Saro::Dat::ErrorCode::CERT_EXPIRED
+          end
+        Saro::Dat::Error.new(code)
+      end
 
       def self._issue(cert, plain, secure)
         now = Time.now.to_i
@@ -105,11 +147,11 @@ module Saro
 
       def self._parse(cert, dat_input)
         dat = Saro::Dat::Dat.from_value(dat_input)
-        raise RuntimeError, "Invalid DAT: Format" unless dat.format
-        raise RuntimeError, "Invalid DAT: Expired" if dat.expired?
+        dat.raise_if_invalid!
+        raise Saro::Dat::Error.new(Saro::Dat::ErrorCode::TOKEN_EXPIRED) if dat.expired?
 
         unless cert.signature_key.verify(dat.body_string, dat.signature)
-          raise RuntimeError, "Invalid DAT: Signature"
+          raise Saro::Dat::Error.new(Saro::Dat::ErrorCode::SIG_MISMATCH)
         end
 
         decrypted_secure = cert.crypto_key.decrypt(dat.secure)

data/lib/saro/dat/error.rb

@@ -0,0 +1,118 @@
+# frozen_string_literal: true
+
+module Saro
+  module Dat
+    module ErrorCode
+      TOKEN_MALFORMED = "DAT_TOKEN_MALFORMED"
+      TOKEN_EXPIRED   = "DAT_TOKEN_EXPIRED"
+      TOKEN_UNKNOWN   = "DAT_TOKEN_UNKNOWN"
+
+      CERT_MALFORMED        = "DAT_CERT_MALFORMED"
+      CERT_EXPIRED          = "DAT_CERT_EXPIRED"
+      CERT_NOT_YET_ISSUABLE = "DAT_CERT_NOT_YET_ISSUABLE"
+      CERT_ISSUANCE_ENDED   = "DAT_CERT_ISSUANCE_ENDED"
+      CERT_VERIFY_ONLY      = "DAT_CERT_VERIFY_ONLY"
+      CERT_NOT_FOUND        = "DAT_CERT_NOT_FOUND"
+      CERT_NOT_SYNCED       = "DAT_CERT_NOT_SYNCED"
+      CERT_DUPLICATE_CID    = "DAT_CERT_DUPLICATE_CID"
+      CERT_UNKNOWN          = "DAT_CERT_UNKNOWN"
+
+      SIG_MISMATCH   = "DAT_SIG_MISMATCH"
+      SIG_MALFORMED  = "DAT_SIG_MALFORMED"
+      SIG_KEY_MISSING = "DAT_SIG_KEY_MISSING"
+      SIG_BACKEND    = "DAT_SIG_BACKEND"
+      SIG_UNKNOWN    = "DAT_SIG_UNKNOWN"
+
+      CRYPTO_TAG_MISMATCH = "DAT_CRYPTO_TAG_MISMATCH"
+      CRYPTO_DATA_INVALID = "DAT_CRYPTO_DATA_INVALID"
+      CRYPTO_BACKEND      = "DAT_CRYPTO_BACKEND"
+      CRYPTO_UNKNOWN      = "DAT_CRYPTO_UNKNOWN"
+
+      KEY_INVALID                 = "DAT_KEY_INVALID"
+      KEY_VERIFY_ONLY_UNSUPPORTED = "DAT_KEY_VERIFY_ONLY_UNSUPPORTED"
+      KEY_UNKNOWN                 = "DAT_KEY_UNKNOWN"
+
+      MANAGER_NO_CERTIFICATE          = "DAT_MANAGER_NO_CERTIFICATE"
+      MANAGER_NO_ISSUABLE_CERTIFICATE = "DAT_MANAGER_NO_ISSUABLE_CERTIFICATE"
+      MANAGER_DISPOSED                = "DAT_MANAGER_DISPOSED"
+      MANAGER_UNKNOWN                 = "DAT_MANAGER_UNKNOWN"
+
+      CMS_UNREACHABLE      = "DAT_CMS_UNREACHABLE"
+      CMS_UNAUTHORIZED     = "DAT_CMS_UNAUTHORIZED"
+      CMS_FORBIDDEN        = "DAT_CMS_FORBIDDEN"
+      CMS_ENDPOINT_NOT_FOUND = "DAT_CMS_ENDPOINT_NOT_FOUND"
+      CMS_SERVER_ERROR     = "DAT_CMS_SERVER_ERROR"
+      CMS_HTTP_STATUS      = "DAT_CMS_HTTP_STATUS"
+      CMS_MALFORMED        = "DAT_CMS_MALFORMED"
+      CMS_IMPORT_FAILED    = "DAT_CMS_IMPORT_FAILED"
+      CMS_VERSION_RESET    = "DAT_CMS_VERSION_RESET"
+      CMS_NOT_SYNCED       = "DAT_CMS_NOT_SYNCED"
+      CMS_SYNC_IN_PROGRESS = "DAT_CMS_SYNC_IN_PROGRESS"
+      CMS_NOT_SUPPORTED    = "DAT_CMS_NOT_SUPPORTED"
+      CMS_UNKNOWN          = "DAT_CMS_UNKNOWN"
+
+      CONFIG_ALG_UNSUPPORTED   = "DAT_CONFIG_ALG_UNSUPPORTED"
+      CONFIG_URI_INVALID       = "DAT_CONFIG_URI_INVALID"
+      CONFIG_ARGUMENT_INVALID  = "DAT_CONFIG_ARGUMENT_INVALID"
+      CONFIG_UNKNOWN           = "DAT_CONFIG_UNKNOWN"
+
+      INTERNAL_UNAVAILABLE = "DAT_INTERNAL_UNAVAILABLE"
+      INTERNAL_UNKNOWN     = "DAT_INTERNAL_UNKNOWN"
+
+      TRANSIENT = [
+        CERT_NOT_YET_ISSUABLE, CERT_NOT_SYNCED, MANAGER_NO_CERTIFICATE,
+        CMS_UNREACHABLE, CMS_SERVER_ERROR, CMS_NOT_SYNCED
+      ].freeze
+
+      STATE = [CMS_VERSION_RESET, CMS_SYNC_IN_PROGRESS].freeze
+
+      SECURITY = [SIG_MISMATCH, CRYPTO_TAG_MISMATCH].freeze
+    end
+
+    class Error < StandardError
+      attr_reader :code
+      attr_reader :detail
+
+      def initialize(code, detail = nil, cause: nil)
+        @code = code
+        @detail = detail
+        @explicit_cause = cause
+        super(detail ? "#{code}: #{detail}" : code)
+      end
+
+      def cause
+        @explicit_cause || super
+      end
+
+      def retry
+        if @code == ErrorCode::MANAGER_NO_ISSUABLE_CERTIFICATE
+          c = cause
+          return :transient if c.is_a?(Error) && c.code == ErrorCode::CERT_NOT_YET_ISSUABLE
+          return :permanent
+        end
+        return :transient if ErrorCode::TRANSIENT.include?(@code)
+        return :state if ErrorCode::STATE.include?(@code)
+        :permanent
+      end
+
+      def security_event?
+        ErrorCode::SECURITY.include?(@code)
+      end
+
+      def inspect
+        "#<Saro::Dat::Error #{@code}#{@detail ? " #{@detail.inspect}" : ''}>"
+      end
+
+      class << self
+        def code_of(e)
+          e.is_a?(Error) ? e.code : nil
+        end
+
+        def wrap(code, detail, e)
+          return e if e.is_a?(Error)
+          new(code, detail, cause: e)
+        end
+      end
+    end
+  end
+end

data/lib/saro/dat/signature.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'openssl'
+require_relative 'error'
 require_relative 'util'
 
 module Saro
@@ -30,7 +31,7 @@ module Saro
     def self.get_signature_config(algorithm)
       config = SIGNATURE_CONFIG[algorithm]
       return config if config
-      raise ArgumentError, "Unsupported DAT Crypto Algorithm: #{algorithm}"
+      raise Saro::Dat::Error.new(Saro::Dat::ErrorCode::CONFIG_ALG_UNSUPPORTED, "unknown signature algorithm: #{algorithm}")
     end
 
     class DatSignature
@@ -46,15 +47,28 @@ module Saro
       private_class_method def self.create_ec_key(curve_name, priv_bn = nil, pub_octet = nil)
         if priv_bn
           group = OpenSSL::PKey::EC::Group.new(curve_name)
+
+          if priv_bn <= 0 || priv_bn >= group.order
+            raise Saro::Dat::Error.new(Saro::Dat::ErrorCode::KEY_INVALID, "ecdsa private scalar out of range [1, n-1]")
+          end
+
           pub_octet ||= group.generator.mul(priv_bn).to_octet_string(:uncompressed)
-          
+
           asn1 = OpenSSL::ASN1::Sequence.new([
             OpenSSL::ASN1::Integer.new(1),
             OpenSSL::ASN1::OctetString.new(priv_bn.to_s(2).rjust((group.degree + 7) / 8, "\x00".b)),
             OpenSSL::ASN1::ASN1Data.new([OpenSSL::ASN1::ObjectId.new(curve_name)], 0, :CONTEXT_SPECIFIC),
             OpenSSL::ASN1::ASN1Data.new([OpenSSL::ASN1::BitString.new(pub_octet)], 1, :CONTEXT_SPECIFIC)
           ])
-          OpenSSL::PKey::EC.new(asn1.to_der)
+          key = OpenSSL::PKey::EC.new(asn1.to_der)
+
+          begin
+            key.check_key
+          rescue OpenSSL::PKey::PKeyError, OpenSSL::PKey::ECError => e
+            raise Saro::Dat::Error.new(Saro::Dat::ErrorCode::KEY_INVALID, "ecdsa key pair rejected: #{e.message}", cause: e)
+          end
+
+          key
         elsif pub_octet
           spki = OpenSSL::ASN1::Sequence.new([
             OpenSSL::ASN1::Sequence.new([
@@ -63,9 +77,15 @@ module Saro
             ]),
             OpenSSL::ASN1::BitString.new(pub_octet)
           ])
-          OpenSSL::PKey::EC.new(spki.to_der)
+          key = OpenSSL::PKey::EC.new(spki.to_der)
+          begin
+            key.check_key
+          rescue OpenSSL::PKey::PKeyError, OpenSSL::PKey::ECError => e
+            raise Saro::Dat::Error.new(Saro::Dat::ErrorCode::KEY_INVALID, "ecdsa public key rejected: #{e.message}", cause: e)
+          end
+          key
         else
-          raise ArgumentError, "Either private key or public key must be provided"
+          raise Saro::Dat::Error.new(Saro::Dat::ErrorCode::CONFIG_ARGUMENT_INVALID, "either private key or public key must be provided")
         end
       end
 
@@ -76,6 +96,11 @@ module Saro
           new(algorithm, key, key, config)
         else
           key = OpenSSL::PKey::EC.generate(config[:curve])
+          begin
+            key.check_key
+          rescue OpenSSL::PKey::PKeyError, OpenSSL::PKey::ECError => e
+            raise Saro::Dat::Error.new(Saro::Dat::ErrorCode::INTERNAL_UNKNOWN, "generated ecdsa key pair is invalid: #{e.message}", cause: e)
+          end
           new(algorithm, key, key, config)
         end
       end
@@ -86,7 +111,7 @@ module Saro
 
         if config[:name] == "HMAC"
           if bytes_data.bytesize != config[:hmac_len]
-            raise ArgumentError, "Invalid HMAC key length: expected #{config[:hmac_len]}, got #{bytes_data.bytesize}"
+            raise Saro::Dat::Error.new(Saro::Dat::ErrorCode::KEY_INVALID, "hmac key must be #{config[:hmac_len]} bytes, got #{bytes_data.bytesize}")
           end
           new(algorithm, bytes_data, bytes_data, config)
         else
@@ -106,7 +131,7 @@ module Saro
           elsif bytes_data.bytesize == public_len
             verifying_key = create_ec_key(config[:curve], nil, bytes_data)
           else
-            raise ArgumentError, "Invalid ECDSA key length"
+            raise Saro::Dat::Error.new(Saro::Dat::ErrorCode::KEY_INVALID, "ecdsa key length matches neither private+public nor public")
           end
 
           new(algorithm, signing_key, verifying_key, config)
@@ -115,7 +140,7 @@ module Saro
 
       def exports(verify_only = false)
         if verify_only && !support_verify_only
-          raise ArgumentError, "#{config[:name]} does not supported verifying only key"
+          raise Saro::Dat::Error.new(Saro::Dat::ErrorCode::KEY_VERIFY_ONLY_UNSUPPORTED, @algorithm.to_s)
         end
 
         if @config[:name] == "HMAC"
@@ -136,9 +161,9 @@ module Saro
       end
 
       def sign(body)
-        raise ArgumentError, "Signature key is not supported - verifying only key" unless @signing_key
+        raise Saro::Dat::Error.new(Saro::Dat::ErrorCode::SIG_KEY_MISSING, "this key is verify-only") unless @signing_key
         body = normalize_body(body)
-        raise ArgumentError, "Sign Error - body is empty" if body.nil? || body.empty?
+        raise Saro::Dat::Error.new(Saro::Dat::ErrorCode::CONFIG_ARGUMENT_INVALID, "body to sign is empty") if body.nil? || body.empty?
 
         if @config[:name] == "HMAC"
           OpenSSL::HMAC.digest(@config[:hash], @signing_key, body)
@@ -149,29 +174,44 @@ module Saro
       end
 
       def verify(body, signature)
+        verify_bytes(body, signature)
+      end
+
+      def verify_base64(body, signature_base64)
+        sig_bytes = begin
+          Saro::Dat::Util.decode_base64_url(signature_base64)
+        rescue Saro::Dat::Error => e
+          raise Saro::Dat::Error.new(Saro::Dat::ErrorCode::SIG_MALFORMED, "signature is not base64url", cause: e)
+        end
+        verify_bytes(body, sig_bytes)
+      end
+
+      private def verify_bytes(body, sig_bytes)
         body = normalize_body(body)
         return false if body.nil? || body.empty?
 
-        sig_bytes = if signature.is_a?(String) && signature.encoding != Encoding::BINARY
-                      Saro::Dat::Util.decode_base64_url(signature)
-                    else
-                      signature
-                    end
+        sig_bytes = sig_bytes.b if sig_bytes.is_a?(String) && sig_bytes.encoding != Encoding::BINARY
 
         if @config[:name] == "HMAC"
           begin
             actual_sig = OpenSSL::HMAC.digest(@config[:hash], @verifying_key, body)
-            # Use fixed-time comparison if possible
-            return actual_sig == sig_bytes
-          rescue StandardError
-            return false
+          rescue StandardError => e
+            raise Saro::Dat::Error.new(Saro::Dat::ErrorCode::SIG_BACKEND, "hmac computation failed", cause: e)
           end
+          return false unless sig_bytes.is_a?(String) && actual_sig.bytesize == sig_bytes.bytesize
+          OpenSSL.fixed_length_secure_compare(actual_sig, sig_bytes)
         else
+          der_sig = begin
+            raw_to_der_signature(sig_bytes)
+          rescue StandardError
+            raise Saro::Dat::Error.new(Saro::Dat::ErrorCode::SIG_MALFORMED, "ecdsa signature is not a valid r||s pair")
+          end
           begin
-            der_sig = raw_to_der_signature(sig_bytes)
             @verifying_key.dsa_verify_asn1(OpenSSL::Digest.digest(@config[:hash], body), der_sig)
-          rescue StandardError
+          rescue OpenSSL::PKey::PKeyError, OpenSSL::PKey::ECError
             false
+          rescue StandardError => e
+            raise Saro::Dat::Error.new(Saro::Dat::ErrorCode::SIG_BACKEND, "ecdsa verification failed to run", cause: e)
           end
         end
       end
@@ -190,7 +230,6 @@ module Saro
 
       private
 
-      # Avoid a needless copy when the body is already UTF-8 encoded bytes.
       def normalize_body(body)
         return body unless body.is_a?(String)
         enc = body.encoding
@@ -203,7 +242,7 @@ module Saro
         r = asn1.value[0].value
         s = asn1.value[1].value
 
-        size = @config[:private_len] # curve byte size: (group.degree + 7) / 8
+        size = @config[:private_len]
         r_bytes = r.to_s(2).rjust(size, "\x00".b)
         s_bytes = s.to_s(2).rjust(size, "\x00".b)
 

data/lib/saro/dat/util.rb

@@ -1,12 +1,37 @@
 # frozen_string_literal: true
 
 require 'base64'
+require_relative 'error'
 
 module Saro
   module Dat
     module Util
       module_function
 
+      U64_MAX = 0xFFFFFFFFFFFFFFFF
+
+      def parse_u64(s)
+        unless s.is_a?(String) && s.match?(/\A[0-9]+\z/)
+          raise Saro::Dat::Error.new(Saro::Dat::ErrorCode::CONFIG_ARGUMENT_INVALID, "not an unsigned decimal integer: #{s.inspect}")
+        end
+        v = s.to_i
+        if v > U64_MAX
+          raise Saro::Dat::Error.new(Saro::Dat::ErrorCode::CONFIG_ARGUMENT_INVALID, "exceeds u64: #{s.inspect}")
+        end
+        v
+      end
+
+      def parse_u64_hex(s)
+        unless s.is_a?(String) && s.match?(/\A[0-9a-fA-F]+\z/)
+          raise Saro::Dat::Error.new(Saro::Dat::ErrorCode::CONFIG_ARGUMENT_INVALID, "not an unsigned hex integer: #{s.inspect}")
+        end
+        v = s.to_i(16)
+        if v > U64_MAX
+          raise Saro::Dat::Error.new(Saro::Dat::ErrorCode::CONFIG_ARGUMENT_INVALID, "exceeds u64: #{s.inspect}")
+        end
+        v
+      end
+
       def encode_base64_url(s)
         return "".b if s.nil?
         if s.is_a?(String)
@@ -27,12 +52,15 @@ module Saro
           return "".b if s.empty?
         end
         
-        # More robust way for older Ruby
-        s = s.to_s.tr('-_', '+/')
+        s = s.to_s
         rem = s.bytesize % 4
         s += ("=" * (4 - rem)) if rem > 0
 
-        Base64.decode64(s).b
+        begin
+          Base64.urlsafe_decode64(s).b
+        rescue ArgumentError => e
+          raise Saro::Dat::Error.new(Saro::Dat::ErrorCode::CONFIG_ARGUMENT_INVALID, "not a valid base64url string", cause: e)
+        end
       end
 
       def decode_base64_url_str(s)

data/lib/saro-dat.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require_relative 'saro/dat/error'
 require_relative 'saro/dat/util'
 require_relative 'saro/dat/crypto'
 require_relative 'saro/dat/signature'
@@ -7,9 +8,3 @@ require_relative 'saro/dat/dat_certificate'
 require_relative 'saro/dat/dat'
 require_relative 'saro/dat/dat_manager'
 require_relative 'saro/dat/dat_cms_manager'
-
-module Saro
-  module Dat
-    class Error < StandardError; end
-  end
-end

data/saro-dat.gemspec

@@ -2,7 +2,7 @@
 
 Gem::Specification.new do |spec|
   spec.name          = "saro-dat"
-  spec.version       = "4.3.4"
+  spec.version       = "4.6.1"
   spec.authors       = ["marker"]
   spec.email         = ["j@saro.me"]
 
@@ -17,8 +17,6 @@ Gem::Specification.new do |spec|
 
   spec.metadata["keywords"] = "dat, distributed, access, token, web, session, security, authentication"
 
-  # Specify which files should be added to the gem when it is released.
-  # The `git ls-files -z` loads the files in the RubyGem that have been added into git.
   spec.files = Dir.chdir(File.expand_path(__dir__)) do
     `git ls-files -z`.split("\x0").reject { |f| f.match(%r{\A(?:test|spec|features|_pypi)/}) }
   end
@@ -30,7 +28,7 @@ Gem::Specification.new do |spec|
   spec.add_dependency "base64"
   spec.add_dependency "logger"
 
-  spec.add_development_dependency "minitest", "~> 5.0"
+  spec.add_development_dependency "minitest", "~> 6.0"
   spec.add_development_dependency "benchmark"
   spec.add_development_dependency "parallel"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: saro-dat
 version: !ruby/object:Gem::Version
-  version: 4.3.4
+  version: 4.6.1
 platform: ruby
 authors:
 - marker
@@ -57,14 +57,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '5.0'
+        version: '6.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '5.0'
+        version: '6.0'
 - !ruby/object:Gem::Dependency
   name: benchmark
   requirement: !ruby/object:Gem::Requirement
@@ -116,6 +116,7 @@ files:
 - lib/saro/dat/dat_certificate.rb
 - lib/saro/dat/dat_cms_manager.rb
 - lib/saro/dat/dat_manager.rb
+- lib/saro/dat/error.rb
 - lib/saro/dat/signature.rb
 - lib/saro/dat/util.rb
 - saro-dat.gemspec