github.com/google/uuid v1.6.0: Generate and inspect DCE Security Version 2 UUIDs for Person, Group, and Org domains in google/uuid

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: Generate and inspect DCE Security Version 2 UUIDs for Person, Group, and Org domains in google/uuid
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/github.com/google/uuid@v1.6.0
Demonstrate these symbols/APIs:
  - NewDCEGroup
  - NewDCEPerson
  - NewDCESecurity
Constraints:
  - executionContext: node
Required runtime conditions:
  - ecosystem: npm
  - language: javascript
  - moduleSystem: cjs
  - packageManager: npm@11.8.0
  - runtime: node@22.22.2

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:a408cea86bff0ee89764e6b804c13bba42660cd3511c82b7b4b4492124794ab6","contract":["assert uuid.NewDCESecurity creates a Version 2 UUID with RFC4122 variant for specified domain and local ID","assert uuid.NewDCEPerson creates a Version 2 UUID with Person domain and the caller's POSIX UID","assert uuid.NewDCEGroup creates a Version 2 UUID with Group domain and the caller's POSIX GID","assert UUID.Domain returns the expected Domain constant (Person, Group, Org) and UUID.ID returns the embedded 32-bit local ID","assert UUID.Time extracts timestamp and UUID.NodeID returns valid 6-byte node identifier"],"goal":"Generate and inspect DCE Security Version 2 UUIDs for Person, Group, and Org domains in google/uuid","kind":"HOW","packages":["pkg:golang/github.com/google/uuid@v1.6.0"],"schemaVersion":1,"symbols":["NewDCEGroup","NewDCEPerson","NewDCESecurity"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1,"virtualization":"wsl"},"license":"MIT-0","packages":["pkg:golang/github.com/google/uuid@v1.6.0"],"schemaVersion":1,"symbols":["NewDCEGroup","NewDCEPerson","NewDCESecurity"],"verifierAdapter":"golang@1"}

module sample

go 1.25.13

require github.com/google/uuid v1.6.0

github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=

{
  "schemaVersion": 1,
  "goal": "Generate and inspect DCE Security Version 2 UUIDs for Person, Group, and Org domains in google/uuid",
  "kind": "HOW",
  "packages": [
    "pkg:golang/github.com/google/uuid@v1.6.0"
  ],
  "symbols": [
    "NewDCEGroup",
    "NewDCEPerson",
    "NewDCESecurity"
  ],
  "constraints": {
    "executionContext": "node"
  },
  "runtimeConditions": {
    "ecosystem": "npm",
    "language": "javascript",
    "moduleSystem": "cjs",
    "packageManager": "npm@11.8.0",
    "runtime": "node@22.22.2"
  }
}

package main

import (
	"fmt"
	"os"

	"github.com/google/uuid"
)

func main() {
	// 1. assert uuid.NewDCESecurity creates a Version 2 UUID with RFC4122 variant for specified domain and local ID
	customID := uint32(54321)
	orgUUID, err := uuid.NewDCESecurity(uuid.Org, customID)
	if err != nil {
		panic(fmt.Sprintf("NewDCESecurity failed: %v", err))
	}
	if orgUUID.Version() != 2 {
		panic(fmt.Sprintf("expected Version 2, got %v", orgUUID.Version()))
	}
	if orgUUID.Variant() != uuid.RFC4122 {
		panic(fmt.Sprintf("expected RFC4122 variant, got %v", orgUUID.Variant()))
	}
	if orgUUID.Domain() != uuid.Org {
		panic(fmt.Sprintf("expected Domain Org (%v), got %v", uuid.Org, orgUUID.Domain()))
	}
	if orgUUID.ID() != customID {
		panic(fmt.Sprintf("expected ID %d, got %d", customID, orgUUID.ID()))
	}

	// 2. assert uuid.NewDCEPerson creates a Version 2 UUID with Person domain and the caller's POSIX UID
	personUUID, err := uuid.NewDCEPerson()
	if err != nil {
		panic(fmt.Sprintf("NewDCEPerson failed: %v", err))
	}
	if personUUID.Version() != 2 {
		panic(fmt.Sprintf("expected Version 2, got %v", personUUID.Version()))
	}
	if personUUID.Variant() != uuid.RFC4122 {
		panic(fmt.Sprintf("expected RFC4122 variant, got %v", personUUID.Variant()))
	}
	if personUUID.Domain() != uuid.Person {
		panic(fmt.Sprintf("expected Domain Person (%v), got %v", uuid.Person, personUUID.Domain()))
	}
	expectedUID := uint32(os.Getuid())
	if personUUID.ID() != expectedUID {
		panic(fmt.Sprintf("expected ID %d (uid), got %d", expectedUID, personUUID.ID()))
	}

	// 3. assert uuid.NewDCEGroup creates a Version 2 UUID with Group domain and the caller's POSIX GID
	groupUUID, err := uuid.NewDCEGroup()
	if err != nil {
		panic(fmt.Sprintf("NewDCEGroup failed: %v", err))
	}
	if groupUUID.Version() != 2 {
		panic(fmt.Sprintf("expected Version 2, got %v", groupUUID.Version()))
	}
	if groupUUID.Variant() != uuid.RFC4122 {
		panic(fmt.Sprintf("expected RFC4122 variant, got %v", groupUUID.Variant()))
	}
	if groupUUID.Domain() != uuid.Group {
		panic(fmt.Sprintf("expected Domain Group (%v), got %v", uuid.Group, groupUUID.Domain()))
	}
	expectedGID := uint32(os.Getgid())
	if groupUUID.ID() != expectedGID {
		panic(fmt.Sprintf("expected ID %d (gid), got %d", expectedGID, groupUUID.ID()))
	}

	// 4. assert UUID.Domain returns the expected Domain constant (Person, Group, Org) and UUID.ID returns the embedded 32-bit local ID
	personSecUUID, err := uuid.NewDCESecurity(uuid.Person, 42)
	if err != nil {
		panic(fmt.Sprintf("NewDCESecurity(Person) failed: %v", err))
	}
	if personSecUUID.Domain() != uuid.Person || personSecUUID.ID() != 42 {
		panic(fmt.Sprintf("expected Domain Person and ID 42, got %v and %d", personSecUUID.Domain(), personSecUUID.ID()))
	}

	groupSecUUID, err := uuid.NewDCESecurity(uuid.Group, 100)
	if err != nil {
		panic(fmt.Sprintf("NewDCESecurity(Group) failed: %v", err))
	}
	if groupSecUUID.Domain() != uuid.Group || groupSecUUID.ID() != 100 {
		panic(fmt.Sprintf("expected Domain Group and ID 100, got %v and %d", groupSecUUID.Domain(), groupSecUUID.ID()))
	}

	// 5. assert UUID.Time extracts timestamp and UUID.NodeID returns valid 6-byte node identifier
	t := orgUUID.Time()
	if t <= 0 {
		panic("expected positive Time timestamp from DCE UUID")
	}
	node := orgUUID.NodeID()
	if len(node) != 6 {
		panic(fmt.Sprintf("expected 6-byte node ID, got %d bytes", len(node)))
	}

	fmt.Println("Contract passed")
}