Four bindings, one engine

Rust

Native Rust workspace — 43 crates spanning the engine, threshold protocols, PKI, storage, Mode 2 adapters, and transparency.

Docs source: github.com/confium/confium/tree/main/docs

Ruby

Native Ruby extension (magnus + rb-sys) wrapping the Confium engine. Composite sign + verify, transparency log, PKI + CMS, threshold sessions, attributes DSL. Hard-bundles rnp-rs for OpenPGP armor encode/decode.

Docs source: github.com/confium/confium-ruby/tree/main/docs

Python

Native Python extension (PyO3) wrapping the Confium engine. Composite sign + verify, transparency log, PKI + CMS build, attributes DSL, OTS anchor, ERS archival, XMLDSig, deployment manifest.

Docs source: github.com/confium/confium/tree/main/docs/bindings

WASM

Browser / Node.js verifier (wasm-bindgen). Composite signatures, transparency, attributes, X.509, CMS. Verifier-only — cannot sign.

CLI

The confium command-line tool — install plugins, manage trust, configure the local store.

Node.js

Server-side Node.js bindings for Confium. Composite sign + verify, transparency, PKI + CMS, threshold sessions. Uses NAPI — no CGo, no Python, no separate runtime. The signing surface that WASM (verifier-only) deliberately omits.

Docs source: github.com/confium/confium/tree/main/docs/bindings

Daemon

The confiumd long-running service — JSON-RPC over Unix socket or TCP for composite verification, attribute evaluation, signing sessions, and PKI operations.

Go

Go bindings for Confium. Cloud-native threshold cryptography for Kubernetes operators, Terraform providers, Docker plugins, and every CNCF project. Currently a scaffold — API surface stable, C bridge in progress.

Docs source: github.com/confium/confium/tree/main/docs/bindings

PKCS#11 server

PKCS#11 v3.0 server — exposes Confium as a virtual HSM to existing PKCS#11 consumers.