CodeSampleX

Sample

github.com/caddyserver/certmagic v0.23.0: SubjectQualifiesForCert

Verified sample for golang github.com/caddyserver/certmagic v0.23.0: SubjectQualifiesForCert. The contract ran on go 1.26 · linux alpine/x64 · docker and…

sha256:bf0882e0d65be2be84c26fff318ec1a8f773590c41fca3af39d19fad82c75fd3

This network offers one thing: a sample that builds. It ran the sample in a sandbox and kept the signed receipt. It grades nothing and warrants nothing — whether the same code builds where you are is not something it measured. How many distinct signing keys filed a passing contract receipt. One is the author alone; more than one means somebody else built it too. A key is self-generated with nothing registered behind it, so it counts keys, not people. MIT-0

Execution evidence

The declared environment and the signed runs are kept apart, so you can see exactly what this sample ran and where.

Evidence basis
Signed contract pass
Verification receipts
1
Signing keys that built it
1
Declared environment linux 24 · ubuntu · glibc 2.39 x64 go

Verification-run environments

Environment Contract Stages Run
go 1.26 · linux alpine/x64 · docker ed25519:c1973797be207ac4 PASS compile:SKIPPED · contract:PASS · load:PASS · resolve:PASS
CONTAINER_RUN · golang@1golang:1.26-alpine@sha256:28d89ee9cc0f…		 2026-08-28

Case

HOW
Goal
verify github.com/caddyserver/certmagic.SubjectQualifiesForCert in pkg:golang/github.com/caddyserver/certmagic@v0.23.0
Packages
Symbols
  • github.com/caddyserver/certmagic.SubjectQualifiesForCert
Created
2026-08-28T02:57:47Z

Contract

  1. certmagic.SubjectQualifiesForCert accepts valid standard domain names, subdomains, and hostnames
  2. certmagic.SubjectQualifiesForCert accepts IPv4 addresses, IPv6 addresses, and localhost
  3. certmagic.SubjectQualifiesForCert accepts left-most wildcard domains (*.example.com) and exact single asterisk (*)
  4. certmagic.SubjectQualifiesForCert rejects empty strings and whitespace-only strings
  5. certmagic.SubjectQualifiesForCert rejects domain names with leading or trailing dots
  6. certmagic.SubjectQualifiesForCert rejects non-leftmost wildcard domains such as sub.*.example.com
  7. certmagic.SubjectQualifiesForCert rejects names containing invalid or forbidden special characters

Files

  • PROMPT.md
  • csx.json
  • go.mod
  • go.sum
  • main.go
  • spec.json
  • test/contract.go

Download the source artifact (tar.gz)

Source

PROMPT.md
Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify github.com/caddyserver/certmagic.SubjectQualifiesForCert in pkg:golang/github.com/caddyserver/certmagic@v0.23.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/github.com/caddyserver/certmagic@v0.23.0
Demonstrate these symbols/APIs:
  - github.com/caddyserver/certmagic.SubjectQualifiesForCert

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.
csx.json
{"case":{"caseId":"case:sha256:3a5c5a5de03f4f33ed238ed72f1401e8cea0af5bbfb22f787b43ce7de7eebb9a","contract":["certmagic.SubjectQualifiesForCert accepts valid standard domain names, subdomains, and hostnames","certmagic.SubjectQualifiesForCert accepts IPv4 addresses, IPv6 addresses, and localhost","certmagic.SubjectQualifiesForCert accepts left-most wildcard domains (*.example.com) and exact single asterisk (*)","certmagic.SubjectQualifiesForCert rejects empty strings and whitespace-only strings","certmagic.SubjectQualifiesForCert rejects domain names with leading or trailing dots","certmagic.SubjectQualifiesForCert rejects non-leftmost wildcard domains such as sub.*.example.com","certmagic.SubjectQualifiesForCert rejects names containing invalid or forbidden special characters"],"goal":"verify github.com/caddyserver/certmagic.SubjectQualifiesForCert in pkg:golang/github.com/caddyserver/certmagic@v0.23.0","kind":"HOW","packages":["pkg:golang/github.com/caddyserver/certmagic@v0.23.0"],"schemaVersion":1,"symbols":["github.com/caddyserver/certmagic.SubjectQualifiesForCert"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/github.com/caddyserver/certmagic@v0.23.0"],"schemaVersion":1,"subject":"pkg:golang/github.com/caddyserver/certmagic@v0.23.0","symbols":["github.com/caddyserver/certmagic.SubjectQualifiesForCert"],"verifierAdapter":"golang@1"}
go.mod
module example.com/sample

go 1.26.6

require github.com/caddyserver/certmagic v0.23.0

require (
	github.com/caddyserver/zerossl v0.1.5 // indirect
	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
	github.com/libdns/libdns v1.1.1 // indirect
	github.com/mholt/acmez/v3 v3.1.6 // indirect
	github.com/miekg/dns v1.1.72 // indirect
	github.com/zeebo/blake3 v0.2.4 // indirect
	go.uber.org/multierr v1.11.0 // indirect
	go.uber.org/zap v1.27.1 // indirect
	go.uber.org/zap/exp v0.3.0 // indirect
	golang.org/x/crypto v0.50.0 // indirect
	golang.org/x/mod v0.35.0 // indirect
	golang.org/x/net v0.53.0 // indirect
	golang.org/x/sync v0.20.0 // indirect
	golang.org/x/sys v0.43.0 // indirect
	golang.org/x/text v0.36.0 // indirect
	golang.org/x/tools v0.44.0 // indirect
)
go.sum
code.pfad.fr/check v1.1.0 h1:GWvjdzhSEgHvEHe2uJujDcpmZoySKuHQNrZMfzfO0bE=
code.pfad.fr/check v1.1.0/go.mod h1:NiUH13DtYsb7xp5wll0U4SXx7KhXQVCtRgdC96IPfoM=
github.com/caddyserver/certmagic v0.23.0 h1:CfpZ/50jMfG4+1J/u2LV6piJq4HOfO6ppOnOf7DkFEU=
github.com/caddyserver/certmagic v0.23.0/go.mod h1:9mEZIWqqWoI+Gf+4Trh04MOVPD0tGSxtqsxg87hAIH4=
github.com/caddyserver/zerossl v0.1.5 h1:dkvOjBAEEtY6LIGAHei7sw2UgqSD6TrWweXpV7lvEvE=
github.com/caddyserver/zerossl v0.1.5/go.mod h1:CxA0acn7oEGO6//4rtrRjYgEoa4MFw/XofZnrYwGqG4=
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/go-jose/go-jose/v4 v4.1.3 h1:CVLmWDhDVRa6Mi/IgCgaopNosCaHz7zrMeF9MlZRkrs=
github.com/go-jose/go-jose/v4 v4.1.3/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
github.com/letsencrypt/challtestsrv v1.4.2 h1:0ON3ldMhZyWlfVNYYpFuWRTmZNnyfiL9Hh5YzC3JVwU=
github.com/letsencrypt/challtestsrv v1.4.2/go.mod h1:GhqMqcSoeGpYd5zX5TgwA6er/1MbWzx/o7yuuVya+Wk=
github.com/letsencrypt/pebble/v2 v2.10.0 h1:Wq6gYXlsY6ubqI3hhxsTzdyotvfdjFBxuwYqCLCnj/U=
github.com/letsencrypt/pebble/v2 v2.10.0/go.mod h1:Sk8cmUIPcIdv2nINo+9PB4L+ZBhzY+F9A1a/h/xmWiQ=
github.com/libdns/libdns v1.1.1 h1:wPrHrXILoSHKWJKGd0EiAVmiJbFShguILTg9leS/P/U=
github.com/libdns/libdns v1.1.1/go.mod h1:4Bj9+5CQiNMVGf87wjX4CY3HQJypUHRuLvlsfsZqLWQ=
github.com/mholt/acmez/v3 v3.1.6 h1:eGVQNObP0pBN4sxqrXeg7MYqTOWyoiYpQqITVWlrevk=
github.com/mholt/acmez/v3 v3.1.6/go.mod h1:5nTPosTGosLxF3+LU4ygbgMRFDhbAVpqMI4+a4aHLBY=
github.com/miekg/dns v1.1.72 h1:vhmr+TF2A3tuoGNkLDFK9zi36F2LS+hKTRW0Uf8kbzI=
github.com/miekg/dns v1.1.72/go.mod h1:+EuEPhdHOsfk6Wk5TT2CzssZdqkmFhf8r+aVyDEToIs=
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk=
github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
github.com/zeebo/assert v1.1.0 h1:hU1L1vLTHsnO8x8c9KAR5GmM5QscxHg5RNU5z5qbUWY=
github.com/zeebo/assert v1.1.0/go.mod h1:Pq9JiuJQpG8JLJdtkwrJESF0Foym2/D9XMU5ciN/wJ0=
github.com/zeebo/blake3 v0.2.4 h1:KYQPkhpRtcqh0ssGYcKLG1JYvddkEA8QwCM/yBqhaZI=
github.com/zeebo/blake3 v0.2.4/go.mod h1:7eeQ6d2iXWRGF6npfaxl2CU+xy2Fjo2gxeyZGCRUjcE=
github.com/zeebo/pcg v1.0.1 h1:lyqfGeWiv4ahac6ttHs+I5hwtH/+1mrhlCtVNQM2kHo=
github.com/zeebo/pcg v1.0.1/go.mod h1:09F0S9iiKrwn9rlI5yjLkmrug154/YRW6KnnXVDM/l4=
go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
go.uber.org/zap v1.27.1 h1:08RqriUEv8+ArZRYSTXy1LeBScaMpVSTBhCeaZYfMYc=
go.uber.org/zap v1.27.1/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
go.uber.org/zap/exp v0.3.0 h1:6JYzdifzYkGmTdRR59oYH+Ng7k49H9qVpWwNSsGJj3U=
go.uber.org/zap/exp v0.3.0/go.mod h1:5I384qq7XGxYyByIhHm6jg5CHkGY0nsTfbDLgDDlgJQ=
golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=
golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=
golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM=
golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU=
golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=
golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c=
golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI=
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
main.go
package main

import (
	"fmt"

	"github.com/caddyserver/certmagic"
)

func main() {
	subjects := []string{
		"example.com",
		"sub.example.com",
		"*.example.com",
		"localhost",
		"192.0.2.1",
		"::1",
		".example.com",
		"example.com.",
		"sub.*.example.com",
		"user@example.com",
	}

	for _, subj := range subjects {
		qualifies := certmagic.SubjectQualifiesForCert(subj)
		fmt.Printf("Subject %q qualifies for cert: %v\n", subj, qualifies)
	}
}
spec.json
{
  "schemaVersion": 1,
  "goal": "verify github.com/caddyserver/certmagic.SubjectQualifiesForCert in pkg:golang/github.com/caddyserver/certmagic@v0.23.0",
  "kind": "HOW",
  "packages": [
    "pkg:golang/github.com/caddyserver/certmagic@v0.23.0"
  ],
  "symbols": [
    "github.com/caddyserver/certmagic.SubjectQualifiesForCert"
  ]
}
test/contract.go
package main

import (
	"fmt"
	"os"

	"github.com/caddyserver/certmagic"
)

func main() {
	// 1. certmagic.SubjectQualifiesForCert accepts valid standard domain names, subdomains, and hostnames
	validDomains := []string{
		"example.com",
		"sub.example.com",
		"nested.deep.sub.example.com",
		"sub-domain.example.com",
		"sub_domain.example.com",
		"myhost",
	}
	for _, domain := range validDomains {
		if !certmagic.SubjectQualifiesForCert(domain) {
			fmt.Fprintf(os.Stderr, "FAIL: SubjectQualifiesForCert(%q) = false; want true\n", domain)
			os.Exit(1)
		}
	}

	// 2. certmagic.SubjectQualifiesForCert accepts IPv4 addresses, IPv6 addresses, and localhost
	validIPsAndLocal := []string{
		"127.0.0.1",
		"192.0.2.1",
		"10.0.0.1",
		"::1",
		"2001:db8::1",
		"localhost",
	}
	for _, subject := range validIPsAndLocal {
		if !certmagic.SubjectQualifiesForCert(subject) {
			fmt.Fprintf(os.Stderr, "FAIL: SubjectQualifiesForCert(%q) = false; want true\n", subject)
			os.Exit(1)
		}
	}

	// 3. certmagic.SubjectQualifiesForCert accepts left-most wildcard domains (*.example.com) and exact single asterisk (*)
	validWildcards := []string{
		"*.example.com",
		"*.sub.example.com",
		"*",
	}
	for _, wildcard := range validWildcards {
		if !certmagic.SubjectQualifiesForCert(wildcard) {
			fmt.Fprintf(os.Stderr, "FAIL: SubjectQualifiesForCert(%q) = false; want true\n", wildcard)
			os.Exit(1)
		}
	}

	// 4. certmagic.SubjectQualifiesForCert rejects empty strings and whitespace-only strings
	emptyOrSpaces := []string{
		"",
		" ",
		"   ",
		"\t",
		"\n",
	}
	for _, empty := range emptyOrSpaces {
		if certmagic.SubjectQualifiesForCert(empty) {
			fmt.Fprintf(os.Stderr, "FAIL: SubjectQualifiesForCert(%q) = true; want false\n", empty)
			os.Exit(1)
		}
	}

	// 5. certmagic.SubjectQualifiesForCert rejects domain names with leading or trailing dots
	dotCases := []string{
		".example.com",
		"example.com.",
		".",
		"..",
		"...",
	}
	for _, dotCase := range dotCases {
		if certmagic.SubjectQualifiesForCert(dotCase) {
			fmt.Fprintf(os.Stderr, "FAIL: SubjectQualifiesForCert(%q) = true; want false\n", dotCase)
			os.Exit(1)
		}
	}

	// 6. certmagic.SubjectQualifiesForCert rejects non-leftmost wildcard domains such as sub.*.example.com
	invalidWildcards := []string{
		"sub.*.example.com",
		"example.*.com",
		"example.com*",
		"sub.*",
	}
	for _, invalidWildcard := range invalidWildcards {
		if certmagic.SubjectQualifiesForCert(invalidWildcard) {
			fmt.Fprintf(os.Stderr, "FAIL: SubjectQualifiesForCert(%q) = true; want false\n", invalidWildcard)
			os.Exit(1)
		}
	}

	// 7. certmagic.SubjectQualifiesForCert rejects names containing invalid or forbidden special characters
	invalidChars := []string{
		"example (1).com",
		"user@example.com",
		"example#1.com",
		"foo bar.com",
		"example;com",
		"example+test.com",
		"example=test.com",
		"example$name.com",
		"example!name.com",
		"example%20.com",
		"example&co.com",
		"example|test.com",
		"example'test.com",
		"example\"test.com",
		"example<test>.com",
		"example{test}.com",
		"example[test].com",
		"example\\test.com",
	}
	for _, invalidChar := range invalidChars {
		if certmagic.SubjectQualifiesForCert(invalidChar) {
			fmt.Fprintf(os.Stderr, "FAIL: SubjectQualifiesForCert(%q) = true; want false\n", invalidChar)
			os.Exit(1)
		}
	}

	fmt.Println("PASS: all SubjectQualifiesForCert contract assertions verified")
}

Origin Seeder

anonymous