For contributors

Help build Confium

Confium is developed in the open. Code, documentation, design feedback, plugin authorship, and security research all welcome. This page covers where to start and what each contribution path looks like.

Where to start

Pick a path that matches your skills and time:

  • Code — Rust workspace, Ruby gem, or WASM package. good first issue is the entry point.
  • Documentation — these very pages. Every page has a "Edit this page" link.
  • Design — SVG diagrams, UX patterns, accessibility review.
  • Plugin authorship — write a Confium plugin for an algorithm or backend we don't ship.
  • Security research — review the cryptography, the protocol implementations, the audit trail.
  • Translation / localization — the site and the docs are English-first today.

Architecture overview

Before contributing code, you'll want a mental model of the layered architecture. The diagram below shows how consumers, adapters, the engine, plugins, and hardware stack.

Confium layered architecture: consumers, adapters, engine, plugins, hardware. CONSUMERS TLS terminators · Code signers · KMS · Web apps · Wallets MODE 2 ADAPTERS PKCS#11 v3.0 · OpenSSL 3.0 provider · JCE · TLS 1.3 signer CONFIUM ENGINE Plugin loader · Registry · Coordinator · FFI (cfm_*) 10 versioned interfaces: hash · cipher · aead · kdf · rng · signature · kem · key_fmt PLUGINS FROST · CMP20 Botan · OpenSSL CONFIDENCE Transparency log OTS · ERS archival ATTRIBUTES Predicate DSL Quorum policy HARDWARE / OS HSM · TPM 2.0 · OpenPGP card · Cloud KMS · CPU standards-only · no vendor SDK · BSD-2-Clause

Development workflow

The Rust workspace uses Nix flakes for reproducibility: 

git clone https://github.com/confium/confium.git
cd confium
nix develop              # reproducible dev shell
cargo build --workspace  # build all 43 crates
cargo test --workspace   # full test suite
cargo clippy --workspace --all-targets -- -D warnings

Without Nix, install Rust stable 1.85+ via rustup and run the cargo commands directly.

Coding standards

Every crate in the workspace follows:

  • #![forbid(unsafe_code)] — no unsafe Rust, period.
  • #![warn(missing_docs)] — every public item documented.
  • thiserror for typed errors (or snafu 0.8 in legacy crates).
  • Conventional commits (feat:, fix:, docs:, etc.) driving release-plz.
  • Tests use real instances; no double()-style mocks.

See the architecture page and the per-crate READMEs for the specific trait / error patterns.

Plugin authoring

Writing a Confium plugin lets you expose a new cryptographic algorithm, key format, or backend to every consumer that uses the engine. The plugin contract is a small set of bootstrap symbols (cfmp_interface_version, cfmp_initialize, cfmp_query_interfaces, etc.) plus per-interface implementation functions. 

cargo new --lib my-plugin
cd my-plugin

# Cargo.toml: crate-type = ["cdylib"]
# Add deps: confium-api, confium-macros

# Then implement via #[confium_plugin] and #[confium_interface]

The full walkthrough is in the plugin author guide in the Rust workspace docs.

Documentation contributions

The website source lives at confium/confium.github.io. Content is plain Markdown (.md) or Astro (.astro) — MDX was considered but removed due to Astro 7 / rolldown-vite interop issues.

Content rules:

  • No mention of the international metrology organization (CI gate).
  • No time-bound or in-progress language — every page reads as describing shipped functionality (CI gate enforces a deny-list of such words).
  • CNML is allowed as one example among many; never the sole reference.
  • Every page should explain how things work, not just what they are.

Design contributions

The site uses RNP's design language (sister project at rnpgp.org): blue/teal/gold palette, IBM Plex typography, dual-token CSS variables for light/dark mode, generous SVG diagrams.

SVG diagram components live in src/components/brand/. They're Astro components that emit inline SVG with consistent color palette and typography. New diagrams welcome.

Security research

Cryptographic code review is one of the highest-value contributions you can make. We're especially interested in:

  • Constant-time analysis of the threshold protocols.
  • Side-channel analysis (timing, memory, power).
  • Protocol-level analysis of FROST, CMP20, GG18 implementations.
  • Transparency log analysis (split-view, gossip, OTS).
  • Plugin sandbox analysis (untrusted plugin isolation).

For responsible disclosure of vulnerabilities, see the security page. Do not open public issues for security problems.

Code of conduct

The project follows the Contributor Covenant 2.1. Reports go to conduct@confium.org.

Where to go next