cloud.google.com/go/kms v1.35.0: kmspb.CryptoKeyVersionTemplate

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify cloud.google.com/go/kms/apiv1/kmspb.CryptoKeyVersionTemplate in pkg:golang/cloud.google.com/go/kms@v1.35.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/cloud.google.com/go/kms@v1.35.0
Demonstrate these symbols/APIs:
  - cloud.google.com/go/kms/apiv1/kmspb.CryptoKeyVersionTemplate

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:af56a9bc24ea2fa2212ae5671712215e7c66904b684602fd9fba54d7ebbddaf2","contract":["CryptoKeyVersionTemplate default initialization produces unspecified ProtectionLevel and Algorithm.","CryptoKeyVersionTemplate getters return configured ProtectionLevel and Algorithm.","CryptoKeyVersionTemplate serializes to protobuf binary wire format and deserializes faithfully.","CryptoKeyVersionTemplate Reset clears fields to default zero values.","CryptoKeyVersionTemplate integrates into CryptoKey VersionTemplate matching original configuration."],"goal":"verify cloud.google.com/go/kms/apiv1/kmspb.CryptoKeyVersionTemplate in pkg:golang/cloud.google.com/go/kms@v1.35.0","kind":"HOW","packages":["pkg:golang/cloud.google.com/go/kms@v1.35.0"],"schemaVersion":1,"symbols":["cloud.google.com/go/kms/apiv1/kmspb.CryptoKeyVersionTemplate"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/cloud.google.com/go/kms@v1.35.0"],"schemaVersion":1,"subject":"pkg:golang/cloud.google.com/go/kms@v1.35.0","symbols":["cloud.google.com/go/kms/apiv1/kmspb.CryptoKeyVersionTemplate"],"verifierAdapter":"golang@1"}

module sample

go 1.26.6

require (
	cloud.google.com/go/kms v1.35.0
	google.golang.org/protobuf v1.36.12
)

require (
	cloud.google.com/go/longrunning v1.2.0 // indirect
	golang.org/x/net v0.58.0 // indirect
	golang.org/x/sys v0.47.0 // indirect
	golang.org/x/text v0.41.0 // indirect
	google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7 // indirect
	google.golang.org/genproto/googleapis/rpc v0.0.0-20260630182238-925bb5da69e7 // indirect
	google.golang.org/grpc v1.83.2 // indirect
)

cloud.google.com/go/kms v1.35.0 h1:nJ/ktaqspx1nPM9vIcO0SHbhqCAm8nvAxL1siuVgKm0=
cloud.google.com/go/kms v1.35.0/go.mod h1:0++71pIHvJL+GmMa8K4jOWFq7gNOX3jm2PRMSJwTKJw=
cloud.google.com/go/longrunning v1.2.0 h1:WjYH3YHBGCxGJP9M4dWGHBfXr/cFIjMkNgWcJj7/iMM=
cloud.google.com/go/longrunning v1.2.0/go.mod h1:5KMQALFGOCtFoi2xSOA1u3H7WKlhmckgiyFw7+LGQp0=
github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU=
go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc=
go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc=
go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo=
go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58=
go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0=
go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI=
go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA=
go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk=
go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE=
golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7 h1:jQ9p21COKWjP3VwuFrNRiiOTMh3mPpN45R7SLrH/HUU=
google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7/go.mod h1:KqHwBx2upmfa1XSi1WuRvC+2VGCLtooKkfmyvRbUmqA=
google.golang.org/genproto/googleapis/rpc v0.0.0-20260630182238-925bb5da69e7 h1:eM/YSd5bBFagF51o1E745Ta7RwzpW0h+z+QDNZOgmQ8=
google.golang.org/genproto/googleapis/rpc v0.0.0-20260630182238-925bb5da69e7/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU=
google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8=
google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=

package main

import (
	"fmt"

	"cloud.google.com/go/kms/apiv1/kmspb"
)

func main() {
	// Construct a CryptoKeyVersionTemplate specifying protection level and algorithm
	tmpl := &kmspb.CryptoKeyVersionTemplate{
		ProtectionLevel: kmspb.ProtectionLevel_SOFTWARE,
		Algorithm:       kmspb.CryptoKeyVersion_GOOGLE_SYMMETRIC_ENCRYPTION,
	}

	fmt.Printf("Protection Level: %s (%d)\n", tmpl.GetProtectionLevel(), tmpl.GetProtectionLevel())
	fmt.Printf("Algorithm: %s (%d)\n", tmpl.GetAlgorithm(), tmpl.GetAlgorithm())

	// Embed in a CryptoKey configuration
	key := &kmspb.CryptoKey{
		Purpose:         kmspb.CryptoKey_ENCRYPT_DECRYPT,
		VersionTemplate: tmpl,
	}

	fmt.Printf("CryptoKey Purpose: %s\n", key.GetPurpose())
	fmt.Printf("Key VersionTemplate Algorithm: %s\n", key.GetVersionTemplate().GetAlgorithm())
}

{
  "schemaVersion": 1,
  "goal": "verify cloud.google.com/go/kms/apiv1/kmspb.CryptoKeyVersionTemplate in pkg:golang/cloud.google.com/go/kms@v1.35.0",
  "kind": "HOW",
  "packages": [
    "pkg:golang/cloud.google.com/go/kms@v1.35.0"
  ],
  "symbols": [
    "cloud.google.com/go/kms/apiv1/kmspb.CryptoKeyVersionTemplate"
  ]
}

package main

import (
	"fmt"
	"os"

	"cloud.google.com/go/kms/apiv1/kmspb"
	"google.golang.org/protobuf/proto"
)

func main() {
	// Assertion 1: CryptoKeyVersionTemplate default initialization produces unspecified ProtectionLevel and Algorithm.
	defaultTmpl := &kmspb.CryptoKeyVersionTemplate{}
	if defaultTmpl.GetProtectionLevel() != kmspb.ProtectionLevel_PROTECTION_LEVEL_UNSPECIFIED {
		fmt.Fprintf(os.Stderr, "FAIL: expected unspecified protection level, got %v\n", defaultTmpl.GetProtectionLevel())
		os.Exit(1)
	}
	if defaultTmpl.GetAlgorithm() != kmspb.CryptoKeyVersion_CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIED {
		fmt.Fprintf(os.Stderr, "FAIL: expected unspecified algorithm, got %v\n", defaultTmpl.GetAlgorithm())
		os.Exit(1)
	}

	// Assertion 2: CryptoKeyVersionTemplate getters return configured ProtectionLevel and Algorithm.
	tmpl := &kmspb.CryptoKeyVersionTemplate{
		ProtectionLevel: kmspb.ProtectionLevel_HSM,
		Algorithm:       kmspb.CryptoKeyVersion_RSA_SIGN_PSS_2048_SHA256,
	}
	if tmpl.GetProtectionLevel() != kmspb.ProtectionLevel_HSM {
		fmt.Fprintf(os.Stderr, "FAIL: expected HSM protection level, got %v\n", tmpl.GetProtectionLevel())
		os.Exit(1)
	}
	if tmpl.GetAlgorithm() != kmspb.CryptoKeyVersion_RSA_SIGN_PSS_2048_SHA256 {
		fmt.Fprintf(os.Stderr, "FAIL: expected RSA_SIGN_PSS_2048_SHA256 algorithm, got %v\n", tmpl.GetAlgorithm())
		os.Exit(1)
	}

	// Assertion 3: CryptoKeyVersionTemplate serializes to protobuf binary wire format and deserializes faithfully.
	data, err := proto.Marshal(tmpl)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: failed to marshal CryptoKeyVersionTemplate: %v\n", err)
		os.Exit(1)
	}
	var unmarshaled kmspb.CryptoKeyVersionTemplate
	if err := proto.Unmarshal(data, &unmarshaled); err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: failed to unmarshal CryptoKeyVersionTemplate: %v\n", err)
		os.Exit(1)
	}
	if !proto.Equal(tmpl, &unmarshaled) {
		fmt.Fprintf(os.Stderr, "FAIL: unmarshaled CryptoKeyVersionTemplate does not match original\n")
		os.Exit(1)
	}

	// Assertion 4: CryptoKeyVersionTemplate Reset clears fields to default zero values.
	tmplReset := &kmspb.CryptoKeyVersionTemplate{
		ProtectionLevel: kmspb.ProtectionLevel_SOFTWARE,
		Algorithm:       kmspb.CryptoKeyVersion_GOOGLE_SYMMETRIC_ENCRYPTION,
	}
	tmplReset.Reset()
	if tmplReset.GetProtectionLevel() != kmspb.ProtectionLevel_PROTECTION_LEVEL_UNSPECIFIED ||
		tmplReset.GetAlgorithm() != kmspb.CryptoKeyVersion_CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIED {
		fmt.Fprintf(os.Stderr, "FAIL: expected fields to be zeroed after Reset\n")
		os.Exit(1)
	}

	// Assertion 5: CryptoKeyVersionTemplate integrates into CryptoKey VersionTemplate matching original configuration.
	key := &kmspb.CryptoKey{
		Purpose:         kmspb.CryptoKey_ASYMMETRIC_SIGN,
		VersionTemplate: tmpl,
	}
	if key.GetVersionTemplate() == nil {
		fmt.Fprintf(os.Stderr, "FAIL: expected key.GetVersionTemplate() to be non-nil\n")
		os.Exit(1)
	}
	if key.GetVersionTemplate().GetProtectionLevel() != kmspb.ProtectionLevel_HSM {
		fmt.Fprintf(os.Stderr, "FAIL: expected HSM in key.VersionTemplate, got %v\n", key.GetVersionTemplate().GetProtectionLevel())
		os.Exit(1)
	}
	if key.GetVersionTemplate().GetAlgorithm() != kmspb.CryptoKeyVersion_RSA_SIGN_PSS_2048_SHA256 {
		fmt.Fprintf(os.Stderr, "FAIL: expected RSA_SIGN_PSS_2048_SHA256 in key.VersionTemplate, got %v\n", key.GetVersionTemplate().GetAlgorithm())
		os.Exit(1)
	}

	fmt.Println("PASS: all CryptoKeyVersionTemplate contract assertions passed.")
}