github.com/googleapis/enterprise-certificate-proxy v0.3.11

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify pkg:golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.11
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.11

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:e3ced2c2fc3b6280a4c3a1c487179d02c369f224bdafec7a9f0391cc7f758550","contract":["util.LoadSignerBinaryPath extracts the signer binary path from valid JSON config","util.LoadSignerBinaryPath expands ~ and $HOME placeholders using the home directory","util.LoadSignerBinaryPath returns ErrConfigUnavailable when the configuration file does not exist","util.LoadSignerBinaryPath returns ErrConfigUnavailable when the signer path is empty","util.GetConfigFilePathFromEnv retrieves the configuration path from GOOGLE_API_CERTIFICATE_CONFIG","util.GetDefaultConfigFilePath returns the platform-specific default enterprise certificate config path","util.EnterpriseCertificateConfig parses JSON configuration with nested Libs specification","client.Cred returns ErrCredUnavailable when the configuration file does not exist","client.Cred returns ErrCredUnavailable when the configuration specifies an empty signer binary path","client.Cred returns an error attempting to execute a non-existent signer binary","client argument types SignArgs, EncryptArgs, and DecryptArgs hold valid parameter values"],"goal":"verify pkg:golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.11","kind":"HOW","packages":["pkg:golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.11"],"schemaVersion":1},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.11"],"schemaVersion":1,"subject":"pkg:golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.11","verifierAdapter":"golang@1"}

module sample

go 1.26.6

require github.com/googleapis/enterprise-certificate-proxy v0.3.11

github.com/googleapis/enterprise-certificate-proxy v0.3.11 h1:vAe81Msw+8tKUxi2Dqh/NZMz7475yUvmRIkXr4oN2ao=
github.com/googleapis/enterprise-certificate-proxy v0.3.11/go.mod h1:RFV7MUdlb7AgEq2v7FmMCfeSMCllAzWxFgRdusoGks8=

package main

import (
	"fmt"
	"os"

	"github.com/googleapis/enterprise-certificate-proxy/client"
	"github.com/googleapis/enterprise-certificate-proxy/client/util"
)

func main() {
	defaultPath := util.GetDefaultConfigFilePath()
	fmt.Printf("Default enterprise cert config path: %s\n", defaultPath)

	envPath := util.GetConfigFilePathFromEnv()
	if envPath != "" {
		fmt.Printf("Config path from env: %s\n", envPath)
	}

	_, err := client.Cred(defaultPath)
	if err != nil {
		fmt.Fprintf(os.Stderr, "Expected error with default path: %v\n", err)
	}
}

{
  "schemaVersion": 1,
  "goal": "verify pkg:golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.11",
  "kind": "HOW",
  "packages": [
    "pkg:golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.11"
  ]
}

package main

import (
	"bytes"
	"crypto"
	"crypto/rsa"
	"encoding/json"
	"errors"
	"fmt"
	"os"
	"path/filepath"
	"strings"

	"github.com/googleapis/enterprise-certificate-proxy/client"
	"github.com/googleapis/enterprise-certificate-proxy/client/util"
)

func main() {
	if err := runContract(); err != nil {
		fmt.Fprintf(os.Stderr, "Contract verification failed: %v\n", err)
		os.Exit(1)
	}
	fmt.Println("All enterprise-certificate-proxy contract assertions passed successfully.")
}

func runContract() error {
	tempDir, err := os.MkdirTemp("", "ecp-contract-*")
	if err != nil {
		return fmt.Errorf("failed to create temp directory: %w", err)
	}
	defer os.RemoveAll(tempDir)

	// 1. util.LoadSignerBinaryPath extracts the signer binary path from valid JSON config
	mockSignerRelPath := filepath.Join("relative", "bin", "signer")
	validConfigPath := filepath.Join(tempDir, "valid_config.json")
	validJSON := []byte(fmt.Sprintf(`{"libs":{"ecp":%q}}`, mockSignerRelPath))
	if err := os.WriteFile(validConfigPath, validJSON, 0600); err != nil {
		return fmt.Errorf("failed to write valid config: %w", err)
	}
	binaryPath, err := util.LoadSignerBinaryPath(validConfigPath)
	if err != nil {
		return fmt.Errorf("assertion 1 failed: expected nil error, got %v", err)
	}
	if binaryPath != mockSignerRelPath {
		return fmt.Errorf("assertion 1 failed: expected %q, got %q", mockSignerRelPath, binaryPath)
	}

	// 2. util.LoadSignerBinaryPath expands ~ and $HOME placeholders using the home directory
	homeDir := os.Getenv("HOME")
	if homeDir == "" {
		homeDir = tempDir
		os.Setenv("HOME", homeDir)
	}

	tildeConfigPath := filepath.Join(tempDir, "tilde_config.json")
	tildeJSON := []byte(`{"libs":{"ecp":"~/bin/signer"}}`)
	if err := os.WriteFile(tildeConfigPath, tildeJSON, 0600); err != nil {
		return fmt.Errorf("failed to write tilde config: %w", err)
	}
	tildePath, err := util.LoadSignerBinaryPath(tildeConfigPath)
	if err != nil {
		return fmt.Errorf("assertion 2 failed (tilde): expected nil error, got %v", err)
	}
	expectedTilde := filepath.Join(homeDir, "bin", "signer")
	if tildePath != expectedTilde {
		return fmt.Errorf("assertion 2 failed (tilde): expected %q, got %q", expectedTilde, tildePath)
	}

	envVarConfigPath := filepath.Join(tempDir, "envvar_config.json")
	envVarJSON := []byte(`{"libs":{"ecp":"$HOME/bin/signer"}}`)
	if err := os.WriteFile(envVarConfigPath, envVarJSON, 0600); err != nil {
		return fmt.Errorf("failed to write envvar config: %w", err)
	}
	envVarResolved, err := util.LoadSignerBinaryPath(envVarConfigPath)
	if err != nil {
		return fmt.Errorf("assertion 2 failed ($HOME): expected nil error, got %v", err)
	}
	if envVarResolved != expectedTilde {
		return fmt.Errorf("assertion 2 failed ($HOME): expected %q, got %q", expectedTilde, envVarResolved)
	}

	// 3. util.LoadSignerBinaryPath returns ErrConfigUnavailable when the configuration file does not exist
	nonExistentPath := filepath.Join(tempDir, "does_not_exist.json")
	_, err = util.LoadSignerBinaryPath(nonExistentPath)
	if !errors.Is(err, util.ErrConfigUnavailable) {
		return fmt.Errorf("assertion 3 failed: expected ErrConfigUnavailable, got %v", err)
	}

	// 4. util.LoadSignerBinaryPath returns ErrConfigUnavailable when the signer path is empty
	emptyECPConfigPath := filepath.Join(tempDir, "empty_ecp.json")
	emptyECPJSON := []byte(`{"libs":{"ecp":""}}`)
	if err := os.WriteFile(emptyECPConfigPath, emptyECPJSON, 0600); err != nil {
		return fmt.Errorf("failed to write empty ecp config: %w", err)
	}
	_, err = util.LoadSignerBinaryPath(emptyECPConfigPath)
	if !errors.Is(err, util.ErrConfigUnavailable) {
		return fmt.Errorf("assertion 4 failed: expected ErrConfigUnavailable, got %v", err)
	}

	// 5. util.GetConfigFilePathFromEnv retrieves the configuration path from GOOGLE_API_CERTIFICATE_CONFIG
	origEnv := os.Getenv("GOOGLE_API_CERTIFICATE_CONFIG")
	customEnvPath := filepath.Join(tempDir, "custom_cert_config.json")
	os.Setenv("GOOGLE_API_CERTIFICATE_CONFIG", customEnvPath)
	if got := util.GetConfigFilePathFromEnv(); got != customEnvPath {
		os.Setenv("GOOGLE_API_CERTIFICATE_CONFIG", origEnv)
		return fmt.Errorf("assertion 5 failed: expected %q, got %q", customEnvPath, got)
	}
	os.Setenv("GOOGLE_API_CERTIFICATE_CONFIG", origEnv)

	// 6. util.GetDefaultConfigFilePath returns the platform-specific default enterprise certificate config path
	defaultPath := util.GetDefaultConfigFilePath()
	if !strings.HasSuffix(defaultPath, filepath.Join(".config", "gcloud", "certificate_config.json")) {
		return fmt.Errorf("assertion 6 failed: unexpected default config path %q", defaultPath)
	}

	// 7. util.EnterpriseCertificateConfig parses JSON configuration with nested Libs specification
	var parsedConfig util.EnterpriseCertificateConfig
	rawJSON := `{"libs":{"ecp":"mock/signer/path"}}`
	if err := json.Unmarshal([]byte(rawJSON), &parsedConfig); err != nil {
		return fmt.Errorf("assertion 7 failed: json unmarshal error: %w", err)
	}
	if parsedConfig.Libs.ECP != "mock/signer/path" {
		return fmt.Errorf("assertion 7 failed: expected 'mock/signer/path', got %q", parsedConfig.Libs.ECP)
	}

	// 8. client.Cred returns ErrCredUnavailable when the configuration file does not exist
	_, err = client.Cred(nonExistentPath)
	if !errors.Is(err, client.ErrCredUnavailable) {
		return fmt.Errorf("assertion 8 failed: expected ErrCredUnavailable, got %v", err)
	}

	// 9. client.Cred returns ErrCredUnavailable when the configuration specifies an empty signer binary path
	_, err = client.Cred(emptyECPConfigPath)
	if !errors.Is(err, client.ErrCredUnavailable) {
		return fmt.Errorf("assertion 9 failed: expected ErrCredUnavailable, got %v", err)
	}

	// 10. client.Cred returns an error attempting to execute a non-existent signer binary
	badBinaryConfigPath := filepath.Join(tempDir, "bad_binary_config.json")
	badBinaryJSON := []byte(fmt.Sprintf(`{"libs":{"ecp":%q}}`, filepath.Join(tempDir, "nonexistent_binary_exec")))
	if err := os.WriteFile(badBinaryConfigPath, badBinaryJSON, 0600); err != nil {
		return fmt.Errorf("failed to write bad binary config: %w", err)
	}
	_, err = client.Cred(badBinaryConfigPath)
	if err == nil {
		return fmt.Errorf("assertion 10 failed: expected execution error, got nil")
	}
	if errors.Is(err, client.ErrCredUnavailable) {
		return fmt.Errorf("assertion 10 failed: expected process execution failure, not ErrCredUnavailable: %v", err)
	}

	// 11. client argument types SignArgs, EncryptArgs, and DecryptArgs hold valid parameter values
	testDigest := []byte("sha256-sample-digest-bytes-32byt")
	signArgs := client.SignArgs{
		Digest: testDigest,
		Opts:   crypto.SHA256,
	}
	if !bytes.Equal(signArgs.Digest, testDigest) || signArgs.Opts.HashFunc() != crypto.SHA256 {
		return fmt.Errorf("assertion 11 failed: invalid SignArgs values")
	}

	testPlaintext := []byte("test secret plaintext")
	encryptArgs := client.EncryptArgs{
		Plaintext: testPlaintext,
		Opts:      crypto.SHA256,
	}
	if !bytes.Equal(encryptArgs.Plaintext, testPlaintext) {
		return fmt.Errorf("assertion 11 failed: invalid EncryptArgs values")
	}

	testCiphertext := []byte("test encrypted ciphertext")
	oaepOpts := &rsa.OAEPOptions{Hash: crypto.SHA256}
	decryptArgs := client.DecryptArgs{
		Ciphertext: testCiphertext,
		Opts:       oaepOpts,
	}
	if !bytes.Equal(decryptArgs.Ciphertext, testCiphertext) || decryptArgs.Opts != oaepOpts {
		return fmt.Errorf("assertion 11 failed: invalid DecryptArgs values")
	}

	return nil
}