github.com/googleapis/enterprise-certificate-proxy v0.3.11: client.DecryptArgs

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify github.com/googleapis/enterprise-certificate-proxy/client.DecryptArgs in pkg:golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.11
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.11
Demonstrate these symbols/APIs:
  - github.com/googleapis/enterprise-certificate-proxy/client.DecryptArgs

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:8f4393389bbaab283edce7d83473054f59fb78269f7493f0595f6f9987acb3ca","contract":["client.DecryptArgs holds ciphertext bytes and decrypter options for a Decrypt API call","client.DecryptArgs supports nil Opts when no decrypter options are provided","client.DecryptArgs Opts accepts rsa.OAEPOptions satisfying crypto.DecrypterOpts","client.DecryptArgs Opts accepts rsa.PKCS1v15DecryptOptions satisfying crypto.DecrypterOpts","client.DecryptArgs serializes and deserializes correctly via encoding/gob","client.DecryptArgs transmits parameters correctly across a net/rpc connection"],"goal":"verify github.com/googleapis/enterprise-certificate-proxy/client.DecryptArgs in pkg:golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.11","kind":"HOW","packages":["pkg:golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.11"],"schemaVersion":1,"symbols":["github.com/googleapis/enterprise-certificate-proxy/client.DecryptArgs"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.11"],"schemaVersion":1,"subject":"pkg:golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.11","symbols":["github.com/googleapis/enterprise-certificate-proxy/client.DecryptArgs"],"verifierAdapter":"golang@1"}

module sample

go 1.26.6

require github.com/googleapis/enterprise-certificate-proxy v0.3.11

github.com/googleapis/enterprise-certificate-proxy v0.3.11 h1:vAe81Msw+8tKUxi2Dqh/NZMz7475yUvmRIkXr4oN2ao=
github.com/googleapis/enterprise-certificate-proxy v0.3.11/go.mod h1:RFV7MUdlb7AgEq2v7FmMCfeSMCllAzWxFgRdusoGks8=

package main

import (
	"crypto"
	"crypto/rsa"
	"fmt"

	"github.com/googleapis/enterprise-certificate-proxy/client"
)

func main() {
	ciphertext := []byte("sample-encrypted-data")
	opts := &rsa.OAEPOptions{
		Hash:  crypto.SHA256,
		Label: []byte("sample-label"),
	}

	args := client.DecryptArgs{
		Ciphertext: ciphertext,
		Opts:       opts,
	}

	fmt.Printf("Initialized DecryptArgs with %d bytes ciphertext\n", len(args.Ciphertext))
	if oaep, ok := args.Opts.(*rsa.OAEPOptions); ok {
		fmt.Printf("Decryption options: OAEP with Hash %v\n", oaep.Hash)
	}
}

{
  "schemaVersion": 1,
  "goal": "verify github.com/googleapis/enterprise-certificate-proxy/client.DecryptArgs in pkg:golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.11",
  "kind": "HOW",
  "packages": [
    "pkg:golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.11"
  ],
  "symbols": [
    "github.com/googleapis/enterprise-certificate-proxy/client.DecryptArgs"
  ]
}

package main

import (
	"bytes"
	"crypto"
	"crypto/rsa"
	"encoding/gob"
	"fmt"
	"net"
	"net/rpc"
	"os"

	"github.com/googleapis/enterprise-certificate-proxy/client"
)

type mockSigner struct{}

func (s *mockSigner) Decrypt(args client.DecryptArgs, reply *[]byte) error {
	if len(args.Ciphertext) == 0 {
		return fmt.Errorf("empty ciphertext")
	}
	*reply = append([]byte("decrypted:"), args.Ciphertext...)
	return nil
}

func main() {
	if err := runContractTests(); err != nil {
		fmt.Fprintf(os.Stderr, "Contract test failed: %v\n", err)
		os.Exit(1)
	}
	fmt.Println("All contract assertions passed.")
}

func runContractTests() error {
	// 1. client.DecryptArgs holds ciphertext bytes and decrypter options for a Decrypt API call
	{
		payload := []byte("confidential-data")
		oaep := &rsa.OAEPOptions{
			Hash:  crypto.SHA256,
			Label: []byte("label-1"),
		}
		args := client.DecryptArgs{
			Ciphertext: payload,
			Opts:       oaep,
		}
		if !bytes.Equal(args.Ciphertext, payload) {
			return fmt.Errorf("test 1: expected Ciphertext %q, got %q", payload, args.Ciphertext)
		}
		if args.Opts == nil {
			return fmt.Errorf("test 1: expected non-nil Opts")
		}
		optsCast, ok := args.Opts.(*rsa.OAEPOptions)
		if !ok {
			return fmt.Errorf("test 1: expected *rsa.OAEPOptions, got %T", args.Opts)
		}
		if optsCast.Hash != crypto.SHA256 {
			return fmt.Errorf("test 1: expected Hash %v, got %v", crypto.SHA256, optsCast.Hash)
		}
	}

	// 2. client.DecryptArgs supports nil Opts when no decrypter options are provided
	{
		args := client.DecryptArgs{
			Ciphertext: []byte("raw-bytes"),
			Opts:       nil,
		}
		if len(args.Ciphertext) != 9 {
			return fmt.Errorf("test 2: expected 9 bytes of ciphertext, got %d", len(args.Ciphertext))
		}
		if args.Opts != nil {
			return fmt.Errorf("test 2: expected nil Opts, got %v", args.Opts)
		}
	}

	// 3. client.DecryptArgs Opts accepts rsa.OAEPOptions satisfying crypto.DecrypterOpts
	{
		oaepOpts := &rsa.OAEPOptions{
			Hash:  crypto.SHA512,
			Label: []byte("test-oaep-label"),
		}
		var decOpts crypto.DecrypterOpts = oaepOpts
		args := client.DecryptArgs{
			Ciphertext: []byte("oaep-payload"),
			Opts:       decOpts,
		}
		concrete, ok := args.Opts.(*rsa.OAEPOptions)
		if !ok {
			return fmt.Errorf("test 3: expected *rsa.OAEPOptions type assertion to succeed")
		}
		if concrete.Hash != crypto.SHA512 {
			return fmt.Errorf("test 3: expected Hash SHA512, got %v", concrete.Hash)
		}
		if !bytes.Equal(concrete.Label, []byte("test-oaep-label")) {
			return fmt.Errorf("test 3: expected label 'test-oaep-label', got %q", concrete.Label)
		}
	}

	// 4. client.DecryptArgs Opts accepts rsa.PKCS1v15DecryptOptions satisfying crypto.DecrypterOpts
	{
		pkcsOpts := &rsa.PKCS1v15DecryptOptions{
			SessionKeyLen: 16,
		}
		args := client.DecryptArgs{
			Ciphertext: []byte("pkcs-payload"),
			Opts:       pkcsOpts,
		}
		concrete, ok := args.Opts.(*rsa.PKCS1v15DecryptOptions)
		if !ok {
			return fmt.Errorf("test 4: expected *rsa.PKCS1v15DecryptOptions type assertion to succeed")
		}
		if concrete.SessionKeyLen != 16 {
			return fmt.Errorf("test 4: expected SessionKeyLen 16, got %d", concrete.SessionKeyLen)
		}
	}

	// 5. client.DecryptArgs serializes and deserializes correctly via encoding/gob
	{
		origArgs := client.DecryptArgs{
			Ciphertext: []byte("gob-payload"),
			Opts: &rsa.OAEPOptions{
				Hash:  crypto.SHA256,
				Label: []byte("gob-label"),
			},
		}
		var buf bytes.Buffer
		enc := gob.NewEncoder(&buf)
		if err := enc.Encode(&origArgs); err != nil {
			return fmt.Errorf("test 5: gob encoding failed: %w", err)
		}

		var decodedArgs client.DecryptArgs
		dec := gob.NewDecoder(&buf)
		if err := dec.Decode(&decodedArgs); err != nil {
			return fmt.Errorf("test 5: gob decoding failed: %w", err)
		}

		if !bytes.Equal(decodedArgs.Ciphertext, origArgs.Ciphertext) {
			return fmt.Errorf("test 5: decoded ciphertext mismatch: got %q, want %q", decodedArgs.Ciphertext, origArgs.Ciphertext)
		}
		decodedOAEP, ok := decodedArgs.Opts.(*rsa.OAEPOptions)
		if !ok {
			return fmt.Errorf("test 5: expected decoded Opts to be *rsa.OAEPOptions, got %T", decodedArgs.Opts)
		}
		if decodedOAEP.Hash != crypto.SHA256 {
			return fmt.Errorf("test 5: expected decoded hash SHA256, got %v", decodedOAEP.Hash)
		}
		if !bytes.Equal(decodedOAEP.Label, []byte("gob-label")) {
			return fmt.Errorf("test 5: expected decoded label 'gob-label', got %q", decodedOAEP.Label)
		}
	}

	// 6. client.DecryptArgs transmits parameters correctly across a net/rpc connection
	{
		server := rpc.NewServer()
		if err := server.RegisterName("EnterpriseCertSigner", &mockSigner{}); err != nil {
			return fmt.Errorf("test 6: failed to register RPC server: %w", err)
		}

		serverConn, clientConn := net.Pipe()
		defer serverConn.Close()
		defer clientConn.Close()

		go server.ServeConn(serverConn)

		rpcClient := rpc.NewClient(clientConn)
		defer rpcClient.Close()

		callArgs := client.DecryptArgs{
			Ciphertext: []byte("rpc-secret-message"),
			Opts: &rsa.OAEPOptions{
				Hash: crypto.SHA256,
			},
		}

		var reply []byte
		if err := rpcClient.Call("EnterpriseCertSigner.Decrypt", callArgs, &reply); err != nil {
			return fmt.Errorf("test 6: RPC Decrypt call failed: %w", err)
		}

		expectedReply := []byte("decrypted:rpc-secret-message")
		if !bytes.Equal(reply, expectedReply) {
			return fmt.Errorf("test 6: expected reply %q, got %q", expectedReply, reply)
		}
	}

	return nil
}