github.com/caddyserver/certmagic v0.23.0: SubjectIsInternal

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify github.com/caddyserver/certmagic.SubjectIsInternal in pkg:golang/github.com/caddyserver/certmagic@v0.23.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/github.com/caddyserver/certmagic@v0.23.0
Demonstrate these symbols/APIs:
  - github.com/caddyserver/certmagic.SubjectIsInternal

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:2515a4b144e55d4de97ae0291708ca2f6fabd698f96dbb0afb6f525a2edeba54","contract":["certmagic.SubjectIsInternal returns true for localhost, subdomains of .localhost, and case-insensitive/trailing-dot variations with or without ports","certmagic.SubjectIsInternal returns true for internal domain suffixes (.local, .internal, .home.arpa)","certmagic.SubjectIsInternal returns true for private, loopback, and link-local IPv4 addresses (127.0.0.1, 10.0.0.1, 172.16.0.1, 192.168.1.1, 169.254.1.1) including host:port pairs","certmagic.SubjectIsInternal returns true for loopback, link-local, and unique-local IPv6 addresses (::1, fe80::1, fc00::1, fd00::1) including bracketed host:port pairs","certmagic.SubjectIsInternal returns false for public domain names, wildcard domains, and non-internal TLDs","certmagic.SubjectIsInternal returns false for public IPv4/IPv6 addresses and boundary IPs outside private ranges","certmagic.SubjectIsInternal returns false for empty strings and whitespace without panicking"],"goal":"verify github.com/caddyserver/certmagic.SubjectIsInternal in pkg:golang/github.com/caddyserver/certmagic@v0.23.0","kind":"HOW","packages":["pkg:golang/github.com/caddyserver/certmagic@v0.23.0"],"schemaVersion":1,"symbols":["github.com/caddyserver/certmagic.SubjectIsInternal"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/github.com/caddyserver/certmagic@v0.23.0"],"schemaVersion":1,"subject":"pkg:golang/github.com/caddyserver/certmagic@v0.23.0","symbols":["github.com/caddyserver/certmagic.SubjectIsInternal"],"verifierAdapter":"golang@1"}

module example.com/sample

go 1.26.6

require github.com/caddyserver/certmagic v0.23.0

require (
	github.com/caddyserver/zerossl v0.1.3 // indirect
	github.com/klauspost/cpuid/v2 v2.2.10 // indirect
	github.com/libdns/libdns v1.0.0-beta.1 // indirect
	github.com/mholt/acmez/v3 v3.1.2 // indirect
	github.com/miekg/dns v1.1.63 // indirect
	github.com/zeebo/blake3 v0.2.4 // indirect
	go.uber.org/multierr v1.11.0 // indirect
	go.uber.org/zap v1.27.0 // indirect
	go.uber.org/zap/exp v0.3.0 // indirect
	golang.org/x/crypto v0.36.0 // indirect
	golang.org/x/mod v0.24.0 // indirect
	golang.org/x/net v0.37.0 // indirect
	golang.org/x/sync v0.12.0 // indirect
	golang.org/x/sys v0.31.0 // indirect
	golang.org/x/text v0.23.0 // indirect
	golang.org/x/tools v0.31.0 // indirect
)

github.com/caddyserver/certmagic v0.23.0 h1:CfpZ/50jMfG4+1J/u2LV6piJq4HOfO6ppOnOf7DkFEU=
github.com/caddyserver/certmagic v0.23.0/go.mod h1:9mEZIWqqWoI+Gf+4Trh04MOVPD0tGSxtqsxg87hAIH4=
github.com/caddyserver/zerossl v0.1.3 h1:onS+pxp3M8HnHpN5MMbOMyNjmTheJyWRaZYwn+YTAyA=
github.com/caddyserver/zerossl v0.1.3/go.mod h1:CxA0acn7oEGO6//4rtrRjYgEoa4MFw/XofZnrYwGqG4=
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
github.com/klauspost/cpuid/v2 v2.2.10 h1:tBs3QSyvjDyFTq3uoc/9xFpCuOsJQFNPiAhYdw2skhE=
github.com/klauspost/cpuid/v2 v2.2.10/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
github.com/libdns/libdns v1.0.0-beta.1 h1:KIf4wLfsrEpXpZ3vmc/poM8zCATXT2klbdPe6hyOBjQ=
github.com/libdns/libdns v1.0.0-beta.1/go.mod h1:4Bj9+5CQiNMVGf87wjX4CY3HQJypUHRuLvlsfsZqLWQ=
github.com/mholt/acmez/v3 v3.1.2 h1:auob8J/0FhmdClQicvJvuDavgd5ezwLBfKuYmynhYzc=
github.com/mholt/acmez/v3 v3.1.2/go.mod h1:L1wOU06KKvq7tswuMDwKdcHeKpFFgkppZy/y0DFxagQ=
github.com/miekg/dns v1.1.63 h1:8M5aAw6OMZfFXTT7K5V0Eu5YiiL8l7nUAkyN6C9YwaY=
github.com/miekg/dns v1.1.63/go.mod h1:6NGHfjhpmr5lt3XPLuyfDJi5AXbNIPM9PY6H6sF1Nfs=
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk=
github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
github.com/zeebo/assert v1.1.0 h1:hU1L1vLTHsnO8x8c9KAR5GmM5QscxHg5RNU5z5qbUWY=
github.com/zeebo/assert v1.1.0/go.mod h1:Pq9JiuJQpG8JLJdtkwrJESF0Foym2/D9XMU5ciN/wJ0=
github.com/zeebo/blake3 v0.2.4 h1:KYQPkhpRtcqh0ssGYcKLG1JYvddkEA8QwCM/yBqhaZI=
github.com/zeebo/blake3 v0.2.4/go.mod h1:7eeQ6d2iXWRGF6npfaxl2CU+xy2Fjo2gxeyZGCRUjcE=
github.com/zeebo/pcg v1.0.1 h1:lyqfGeWiv4ahac6ttHs+I5hwtH/+1mrhlCtVNQM2kHo=
github.com/zeebo/pcg v1.0.1/go.mod h1:09F0S9iiKrwn9rlI5yjLkmrug154/YRW6KnnXVDM/l4=
go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
go.uber.org/zap/exp v0.3.0 h1:6JYzdifzYkGmTdRR59oYH+Ng7k49H9qVpWwNSsGJj3U=
go.uber.org/zap/exp v0.3.0/go.mod h1:5I384qq7XGxYyByIhHm6jg5CHkGY0nsTfbDLgDDlgJQ=
golang.org/x/crypto v0.36.0 h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34=
golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc=
golang.org/x/mod v0.24.0 h1:ZfthKaKaT4NrhGVZHO1/WDTwGES4De8KtWO0SIbNJMU=
golang.org/x/mod v0.24.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
golang.org/x/net v0.37.0 h1:1zLorHbz+LYj7MQlSf1+2tPIIgibq2eL5xkrGk6f+2c=
golang.org/x/net v0.37.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
golang.org/x/sync v0.12.0 h1:MHc5BpPuC30uJk597Ri8TV3CNZcTLu6B6z4lJy+g6Jw=
golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
golang.org/x/tools v0.31.0 h1:0EedkvKDbh+qistFTd0Bcwe/YLh4vHwWEkiI0toFIBU=
golang.org/x/tools v0.31.0/go.mod h1:naFTU+Cev749tSJRXJlna0T3WxKvb1kWEx15xA4SdmQ=
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

package main

import (
	"fmt"

	"github.com/caddyserver/certmagic"
)

func main() {
	// Demonstrate certmagic.SubjectIsInternal on various subject identifiers
	subjects := []string{
		"localhost",
		"127.0.0.1",
		"::1",
		"10.0.0.1",
		"192.168.1.50",
		"172.16.0.1",
		"169.254.1.1",
		"service.local",
		"app.internal",
		"example.com",
		"8.8.8.8",
	}

	fmt.Println("SubjectIsInternal evaluation:")
	for _, s := range subjects {
		isInternal := certmagic.SubjectIsInternal(s)
		fmt.Printf("  %-16s -> internal: %v\n", s, isInternal)
	}
}

{
  "schemaVersion": 1,
  "goal": "verify github.com/caddyserver/certmagic.SubjectIsInternal in pkg:golang/github.com/caddyserver/certmagic@v0.23.0",
  "kind": "HOW",
  "packages": [
    "pkg:golang/github.com/caddyserver/certmagic@v0.23.0"
  ],
  "symbols": [
    "github.com/caddyserver/certmagic.SubjectIsInternal"
  ]
}

package main

import (
	"fmt"
	"os"

	"github.com/caddyserver/certmagic"
)

func main() {
	// 1. certmagic.SubjectIsInternal returns true for localhost, subdomains of .localhost, and case-insensitive/trailing-dot variations with or without ports
	localhostCases := []string{
		"localhost",
		"LOCALHOST",
		"localhost.",
		"sub.localhost",
		"dev.sub.localhost",
		"localhost:8080",
		"LOCALHOST:443",
		"sub.localhost:8443",
	}
	for _, subject := range localhostCases {
		if !certmagic.SubjectIsInternal(subject) {
			fmt.Fprintf(os.Stderr, "Contract 1 violation: SubjectIsInternal(%q) = false, want true\n", subject)
			os.Exit(1)
		}
	}

	// 2. certmagic.SubjectIsInternal returns true for internal domain suffixes (.local, .internal, .home.arpa)
	internalDomainCases := []string{
		"myhost.local",
		"service.local.",
		"api.sub.local:8000",
		"app.internal",
		"cluster.internal:9090",
		"router.home.arpa",
		"gateway.HOME.ARPA.",
	}
	for _, subject := range internalDomainCases {
		if !certmagic.SubjectIsInternal(subject) {
			fmt.Fprintf(os.Stderr, "Contract 2 violation: SubjectIsInternal(%q) = false, want true\n", subject)
			os.Exit(1)
		}
	}

	// 3. certmagic.SubjectIsInternal returns true for private, loopback, and link-local IPv4 addresses (127.0.0.1, 10.0.0.1, 172.16.0.1, 192.168.1.1, 169.254.1.1) including host:port pairs
	privateIPv4Cases := []string{
		"127.0.0.1",
		"127.0.0.1:80",
		"127.255.255.254",
		"10.0.0.1",
		"10.255.255.255:443",
		"172.16.0.1",
		"172.31.255.255:8443",
		"192.168.0.1",
		"192.168.1.100:3000",
		"169.254.1.1",
		"169.254.254.254:53",
	}
	for _, subject := range privateIPv4Cases {
		if !certmagic.SubjectIsInternal(subject) {
			fmt.Fprintf(os.Stderr, "Contract 3 violation: SubjectIsInternal(%q) = false, want true\n", subject)
			os.Exit(1)
		}
	}

	// 4. certmagic.SubjectIsInternal returns true for loopback, link-local, and unique-local IPv6 addresses (::1, fe80::1, fc00::1, fd00::1) including bracketed host:port pairs
	privateIPv6Cases := []string{
		"::1",
		"[::1]:8080",
		"fe80::1",
		"[fe80::1234]:443",
		"fc00::1",
		"[fc00::abcd]:80",
		"fd00::1",
		"[fd12:3456:789a::1]:9443",
	}
	for _, subject := range privateIPv6Cases {
		if !certmagic.SubjectIsInternal(subject) {
			fmt.Fprintf(os.Stderr, "Contract 4 violation: SubjectIsInternal(%q) = false, want true\n", subject)
			os.Exit(1)
		}
	}

	// 5. certmagic.SubjectIsInternal returns false for public domain names, wildcard domains, and non-internal TLDs
	publicDomainCases := []string{
		"example.com",
		"EXAMPLE.COM",
		"example.com.",
		"api.example.com",
		"sub.domain.co.uk",
		"*.example.com",
		"example.org:443",
		"router.lan",
		"device.test",
	}
	for _, subject := range publicDomainCases {
		if certmagic.SubjectIsInternal(subject) {
			fmt.Fprintf(os.Stderr, "Contract 5 violation: SubjectIsInternal(%q) = true, want false\n", subject)
			os.Exit(1)
		}
	}

	// 6. certmagic.SubjectIsInternal returns false for public IPv4/IPv6 addresses and boundary IPs outside private ranges
	publicIPCases := []string{
		"8.8.8.8",
		"8.8.8.8:53",
		"1.1.1.1",
		"93.184.216.34",
		"11.0.0.1",
		"172.15.255.255",
		"172.32.0.1",
		"192.169.0.1",
		"2001:4860:4860::8888",
		"[2001:4860:4860::8888]:443",
		"2606:4700:4700::1111",
	}
	for _, subject := range publicIPCases {
		if certmagic.SubjectIsInternal(subject) {
			fmt.Fprintf(os.Stderr, "Contract 6 violation: SubjectIsInternal(%q) = true, want false\n", subject)
			os.Exit(1)
		}
	}

	// 7. certmagic.SubjectIsInternal returns false for empty strings and whitespace without panicking
	edgeCases := []string{
		"",
		" ",
		"   ",
	}
	for _, subject := range edgeCases {
		if certmagic.SubjectIsInternal(subject) {
			fmt.Fprintf(os.Stderr, "Contract 7 violation: SubjectIsInternal(%q) = true, want false\n", subject)
			os.Exit(1)
		}
	}

	fmt.Println("All certmagic.SubjectIsInternal contract assertions passed.")
}