github.com/googleapis/enterprise-certificate-proxy v0.3.11: client.EncryptArgs

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify github.com/googleapis/enterprise-certificate-proxy/client.EncryptArgs in pkg:golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.11
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.11
Demonstrate these symbols/APIs:
  - github.com/googleapis/enterprise-certificate-proxy/client.EncryptArgs

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:65c7bfba1e67d120c441331408ef5987a99de816dff4f34d3c4f417cc6755345","contract":["client.EncryptArgs holds plaintext byte slice and options","client.EncryptArgs accepts nil options for default encryption behavior","client.EncryptArgs preserves crypto.Hash option specification","client.EncryptArgs preserves rsa.OAEPOptions encryption settings","client.EncryptArgs serializes to JSON with base64 encoded plaintext"],"goal":"verify github.com/googleapis/enterprise-certificate-proxy/client.EncryptArgs in pkg:golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.11","kind":"HOW","packages":["pkg:golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.11"],"schemaVersion":1,"symbols":["github.com/googleapis/enterprise-certificate-proxy/client.EncryptArgs"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.11"],"schemaVersion":1,"subject":"pkg:golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.11","symbols":["github.com/googleapis/enterprise-certificate-proxy/client.EncryptArgs"],"verifierAdapter":"golang@1"}

module sample

go 1.26.6

require github.com/googleapis/enterprise-certificate-proxy v0.3.11

github.com/googleapis/enterprise-certificate-proxy v0.3.11 h1:vAe81Msw+8tKUxi2Dqh/NZMz7475yUvmRIkXr4oN2ao=
github.com/googleapis/enterprise-certificate-proxy v0.3.11/go.mod h1:RFV7MUdlb7AgEq2v7FmMCfeSMCllAzWxFgRdusoGks8=

package main

import (
	"crypto"
	"crypto/rsa"
	"fmt"

	"github.com/googleapis/enterprise-certificate-proxy/client"
)

func main() {
	plaintext := []byte("example data to encrypt")
	opts := &rsa.OAEPOptions{Hash: crypto.SHA256}

	args := client.EncryptArgs{
		Plaintext: plaintext,
		Opts:      opts,
	}

	fmt.Printf("EncryptArgs initialized with %d bytes of plaintext\n", len(args.Plaintext))
	fmt.Printf("Options: %v\n", args.Opts)
}

{
  "schemaVersion": 1,
  "goal": "verify github.com/googleapis/enterprise-certificate-proxy/client.EncryptArgs in pkg:golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.11",
  "kind": "HOW",
  "packages": [
    "pkg:golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.11"
  ],
  "symbols": [
    "github.com/googleapis/enterprise-certificate-proxy/client.EncryptArgs"
  ]
}

package main

import (
	"bytes"
	"crypto"
	"crypto/rsa"
	"encoding/json"
	"fmt"
	"os"

	"github.com/googleapis/enterprise-certificate-proxy/client"
)

func main() {
	if err := runContract(); err != nil {
		fmt.Fprintf(os.Stderr, "Contract verification failed: %v\n", err)
		os.Exit(1)
	}
	fmt.Println("All EncryptArgs contract assertions passed successfully.")
}

func runContract() error {
	// 1. client.EncryptArgs holds plaintext byte slice and options
	sampleData := []byte("confidential enterprise payload")
	testOpts := "custom-crypto-options"
	args := client.EncryptArgs{
		Plaintext: sampleData,
		Opts:      testOpts,
	}
	if !bytes.Equal(args.Plaintext, sampleData) {
		return fmt.Errorf("assertion 1 failed: expected plaintext %q, got %q", sampleData, args.Plaintext)
	}
	if args.Opts != testOpts {
		return fmt.Errorf("assertion 1 failed: expected opts %v, got %v", testOpts, args.Opts)
	}

	// 2. client.EncryptArgs accepts nil options for default encryption behavior
	nilOptsArgs := client.EncryptArgs{
		Plaintext: []byte("payload with default opts"),
		Opts:      nil,
	}
	if nilOptsArgs.Opts != nil {
		return fmt.Errorf("assertion 2 failed: expected nil opts, got %v", nilOptsArgs.Opts)
	}
	if len(nilOptsArgs.Plaintext) == 0 {
		return fmt.Errorf("assertion 2 failed: expected non-empty plaintext")
	}

	// 3. client.EncryptArgs preserves crypto.Hash option specification
	hashArgs := client.EncryptArgs{
		Plaintext: []byte("data to encrypt with SHA256"),
		Opts:      crypto.SHA256,
	}
	h, ok := hashArgs.Opts.(crypto.Hash)
	if !ok || h != crypto.SHA256 {
		return fmt.Errorf("assertion 3 failed: expected crypto.SHA256, got %v", hashArgs.Opts)
	}
	if h.Size() != 32 {
		return fmt.Errorf("assertion 3 failed: expected hash size 32, got %d", h.Size())
	}

	// 4. client.EncryptArgs preserves rsa.OAEPOptions encryption settings
	oaep := &rsa.OAEPOptions{
		Hash:  crypto.SHA256,
		Label: []byte("enterprise-test-label"),
	}
	oaepArgs := client.EncryptArgs{
		Plaintext: []byte("data to encrypt with OAEP"),
		Opts:      oaep,
	}
	retrievedOAEP, ok := oaepArgs.Opts.(*rsa.OAEPOptions)
	if !ok || retrievedOAEP == nil {
		return fmt.Errorf("assertion 4 failed: expected *rsa.OAEPOptions, got %v", oaepArgs.Opts)
	}
	if retrievedOAEP.Hash != crypto.SHA256 || !bytes.Equal(retrievedOAEP.Label, []byte("enterprise-test-label")) {
		return fmt.Errorf("assertion 4 failed: OAEP options fields do not match")
	}

	// 5. client.EncryptArgs serializes to JSON with base64 encoded plaintext
	rawPayload := []byte("hello-ecp-encrypt")
	jsonArgs := client.EncryptArgs{
		Plaintext: rawPayload,
		Opts:      "oaep-sha256",
	}
	marshaled, err := json.Marshal(jsonArgs)
	if err != nil {
		return fmt.Errorf("assertion 5 failed: json.Marshal error: %w", err)
	}
	var unmarshaled client.EncryptArgs
	if err := json.Unmarshal(marshaled, &unmarshaled); err != nil {
		return fmt.Errorf("assertion 5 failed: json.Unmarshal error: %w", err)
	}
	if !bytes.Equal(unmarshaled.Plaintext, rawPayload) {
		return fmt.Errorf("assertion 5 failed: expected unmarshaled plaintext %q, got %q", rawPayload, unmarshaled.Plaintext)
	}
	if unmarshaled.Opts != "oaep-sha256" {
		return fmt.Errorf("assertion 5 failed: expected unmarshaled opts 'oaep-sha256', got %v", unmarshaled.Opts)
	}

	return nil
}