github.com/mholt/acmez/v3 v3.1.2

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify pkg:golang/github.com/mholt/acmez/v3@v3.1.2
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/github.com/mholt/acmez/v3@v3.1.2
Constraints:
  - executionContext: node
Required runtime conditions:
  - ecosystem: npm
  - language: javascript
  - moduleSystem: cjs
  - packageManager: npm@10.9.8
  - runtime: node@22.23.2

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:75946c9027abcb953bb2b8c3930e68035b03f675671d514cf24deae2342f0c52","contract":["acmez.NewCSR creates a signed x509 CertificateRequest from subject alternative names including DNS, IP, and email addresses","acmez.OrderParametersFromCSR maps CertificateRequest SANs into matching ACME Identifiers with DNS and IP types","acmez.StaticCSR wraps a pre-constructed CertificateRequest as a CSRSource interface","acmez.TLSALPN01ChallengeCert creates a self-signed TLS certificate with critical id-pe-acmeIdentifier extension for TLS-ALPN-01 challenges","acme.Challenge computes standard HTTP-01 resource paths and DNS-01 TXT record names and digest authorization","acme.ARIUniqueIdentifier constructs RFC draft ARI unique identifiers from certificate AuthorityKeyId and SerialNumber","acme.Problem formats RFC 7807 problem details with HTTP status and detail text"],"goal":"verify pkg:golang/github.com/mholt/acmez/v3@v3.1.2","kind":"HOW","packages":["pkg:golang/github.com/mholt/acmez/v3@v3.1.2"],"schemaVersion":1},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/github.com/mholt/acmez/v3@v3.1.2"],"schemaVersion":1,"subject":"pkg:golang/github.com/mholt/acmez/v3@v3.1.2","verifierAdapter":"golang@1"}

module sample-acmez

go 1.22

require github.com/mholt/acmez/v3 v3.1.2

require (
	golang.org/x/crypto v0.27.0 // indirect
	golang.org/x/net v0.29.0 // indirect
	golang.org/x/text v0.18.0 // indirect
)

github.com/mholt/acmez/v3 v3.1.2 h1:auob8J/0FhmdClQicvJvuDavgd5ezwLBfKuYmynhYzc=
github.com/mholt/acmez/v3 v3.1.2/go.mod h1:L1wOU06KKvq7tswuMDwKdcHeKpFFgkppZy/y0DFxagQ=
golang.org/x/crypto v0.27.0 h1:GXm2NjJrPaiv/h1tb2UH8QfgC/hOf/+z0p6PT8o1w7A=
golang.org/x/crypto v0.27.0/go.mod h1:1Xngt8kV6Dvbssa53Ziq6Eqn0HqbZi5Z6R0ZpwQzt70=
golang.org/x/net v0.29.0 h1:5ORfpBpCs4HzDYoodCDBbwHzdR5UrLBZ3sOnUJmFoHo=
golang.org/x/net v0.29.0/go.mod h1:gLkgy8jTGERgjzMic6DS9+SP0ajcu6Xu3Orq/SpETg0=
golang.org/x/text v0.18.0 h1:XvMDiNzPAl0jr17s6W9lcaIhGUfUORdGCNsuLmPG224=
golang.org/x/text v0.18.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=

package main

import (
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"fmt"

	"github.com/mholt/acmez/v3"
	"github.com/mholt/acmez/v3/acme"
)

func main() {
	privKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		fmt.Printf("failed to generate key: %v\n", err)
		return
	}

	csr, err := acmez.NewCSR(privKey, []string{"example.com", "192.0.2.1"})
	if err != nil {
		fmt.Printf("failed to create CSR: %v\n", err)
		return
	}

	account := acme.Account{
		PrivateKey: privKey,
		Location:   "https://example.com/acme/acct/1",
		Status:     acme.StatusValid,
	}

	params, err := acmez.OrderParametersFromCSR(account, csr)
	if err != nil {
		fmt.Printf("failed to derive order params: %v\n", err)
		return
	}

	fmt.Printf("Order identifiers: %d\n", len(params.Identifiers))
}

{
  "schemaVersion": 1,
  "goal": "verify pkg:golang/github.com/mholt/acmez/v3@v3.1.2",
  "kind": "HOW",
  "packages": [
    "pkg:golang/github.com/mholt/acmez/v3@v3.1.2"
  ],
  "constraints": {
    "executionContext": "node"
  },
  "runtimeConditions": {
    "ecosystem": "npm",
    "language": "javascript",
    "moduleSystem": "cjs",
    "packageManager": "npm@10.9.8",
    "runtime": "node@22.23.2"
  }
}

package main

import (
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"crypto/x509"
	"crypto/x509/pkix"
	"encoding/asn1"
	"fmt"
	"math/big"
	"os"
	"strings"
	"time"

	"github.com/mholt/acmez/v3"
	"github.com/mholt/acmez/v3/acme"
)

func main() {
	// Assertion 1: acmez.NewCSR creates a signed x509 CertificateRequest from subject alternative names including DNS, IP, and email addresses
	privKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: key generation error: %v\n", err)
		os.Exit(1)
	}

	sans := []string{"example.com", "sub.example.com", "192.0.2.1", "admin@example.com"}
	csr, err := acmez.NewCSR(privKey, sans)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: NewCSR failed: %v\n", err)
		os.Exit(1)
	}
	if len(csr.DNSNames) != 2 || csr.DNSNames[0] != "example.com" || csr.DNSNames[1] != "sub.example.com" {
		fmt.Fprintf(os.Stderr, "FAIL: DNSNames mismatch: %v\n", csr.DNSNames)
		os.Exit(1)
	}
	if len(csr.IPAddresses) != 1 || csr.IPAddresses[0].String() != "192.0.2.1" {
		fmt.Fprintf(os.Stderr, "FAIL: IPAddresses mismatch: %v\n", csr.IPAddresses)
		os.Exit(1)
	}
	if len(csr.EmailAddresses) != 1 || csr.EmailAddresses[0] != "admin@example.com" {
		fmt.Fprintf(os.Stderr, "FAIL: EmailAddresses mismatch: %v\n", csr.EmailAddresses)
		os.Exit(1)
	}
	if err := csr.CheckSignature(); err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: CSR CheckSignature failed: %v\n", err)
		os.Exit(1)
	}

	// Assertion 2: acmez.OrderParametersFromCSR maps CertificateRequest SANs into matching ACME Identifiers with DNS and IP types
	account := acme.Account{
		PrivateKey: privKey,
		Location:   "https://example.com/acme/acct/1",
		Status:     acme.StatusValid,
	}
	orderParams, err := acmez.OrderParametersFromCSR(account, csr)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: OrderParametersFromCSR failed: %v\n", err)
		os.Exit(1)
	}
	if len(orderParams.Identifiers) != 4 {
		fmt.Fprintf(os.Stderr, "FAIL: expected 4 identifiers, got %d\n", len(orderParams.Identifiers))
		os.Exit(1)
	}
	if orderParams.Identifiers[0].Type != "dns" || orderParams.Identifiers[0].Value != "example.com" {
		fmt.Fprintf(os.Stderr, "FAIL: identifier[0] mismatch: %+v\n", orderParams.Identifiers[0])
		os.Exit(1)
	}
	if orderParams.Identifiers[2].Type != "ip" || orderParams.Identifiers[2].Value != "192.0.2.1" {
		fmt.Fprintf(os.Stderr, "FAIL: identifier[2] mismatch: %+v\n", orderParams.Identifiers[2])
		os.Exit(1)
	}

	// Assertion 3: acmez.StaticCSR wraps a pre-constructed CertificateRequest as a CSRSource interface
	staticSource := acmez.StaticCSR(csr)
	returnedCSR, err := staticSource.CSR(nil, orderParams.Identifiers)
	if err != nil || returnedCSR != csr {
		fmt.Fprintf(os.Stderr, "FAIL: StaticCSR mismatch or error: %v\n", err)
		os.Exit(1)
	}

	// Assertion 4: acmez.TLSALPN01ChallengeCert creates a self-signed TLS certificate with critical id-pe-acmeIdentifier extension for TLS-ALPN-01 challenges
	chal := acme.Challenge{
		Type:             acme.ChallengeTypeTLSALPN01,
		Token:            "test-token-12345",
		KeyAuthorization: "test-token-12345.thumbprint-abcde",
		Identifier: acme.Identifier{
			Type:  "dns",
			Value: "example.com",
		},
	}
	tlsCert, err := acmez.TLSALPN01ChallengeCert(chal)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: TLSALPN01ChallengeCert failed: %v\n", err)
		os.Exit(1)
	}
	if len(tlsCert.Certificate) == 0 {
		fmt.Fprintf(os.Stderr, "FAIL: TLSALPN01ChallengeCert empty certificate\n")
		os.Exit(1)
	}
	parsedCert, err := x509.ParseCertificate(tlsCert.Certificate[0])
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: ParseCertificate failed: %v\n", err)
		os.Exit(1)
	}
	var foundOID bool
	for _, ext := range parsedCert.Extensions {
		if ext.Id.Equal(asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 1, 31}) {
			foundOID = true
			if !ext.Critical {
				fmt.Fprintf(os.Stderr, "FAIL: id-pe-acmeIdentifier extension must be critical\n")
				os.Exit(1)
			}
			break
		}
	}
	if !foundOID {
		fmt.Fprintf(os.Stderr, "FAIL: id-pe-acmeIdentifier extension not found\n")
		os.Exit(1)
	}

	// Assertion 5: acme.Challenge computes standard HTTP-01 resource paths and DNS-01 TXT record names and digest authorization
	httpChal := acme.Challenge{
		Type:             acme.ChallengeTypeHTTP01,
		Token:            "token_xyz",
		KeyAuthorization: "token_xyz.thumbprint123",
	}
	if httpChal.HTTP01ResourcePath() != "/.well-known/acme-challenge/token_xyz" {
		fmt.Fprintf(os.Stderr, "FAIL: HTTP01ResourcePath mismatch: %s\n", httpChal.HTTP01ResourcePath())
		os.Exit(1)
	}

	dnsChal := acme.Challenge{
		Type:             acme.ChallengeTypeDNS01,
		Token:            "token_dns",
		KeyAuthorization: "token_dns.thumbprint456",
		Identifier: acme.Identifier{
			Type:  "dns",
			Value: "sub.example.com",
		},
	}
	if dnsChal.DNS01TXTRecordName() != "_acme-challenge.sub.example.com" {
		fmt.Fprintf(os.Stderr, "FAIL: DNS01TXTRecordName mismatch: %s\n", dnsChal.DNS01TXTRecordName())
		os.Exit(1)
	}
	if len(dnsChal.DNS01KeyAuthorization()) == 0 {
		fmt.Fprintf(os.Stderr, "FAIL: DNS01KeyAuthorization is empty\n")
		os.Exit(1)
	}

	// Assertion 6: acme.ARIUniqueIdentifier constructs RFC draft ARI unique identifiers from certificate AuthorityKeyId and SerialNumber
	templateCert := &x509.Certificate{
		SerialNumber:   big.NewInt(1337),
		Subject:        pkix.Name{CommonName: "example.com"},
		NotBefore:      time.Now().Add(-1 * time.Hour),
		NotAfter:       time.Now().Add(24 * time.Hour),
		AuthorityKeyId: []byte{0x01, 0x02, 0x03, 0x04},
	}
	certDER, err := x509.CreateCertificate(rand.Reader, templateCert, templateCert, &privKey.PublicKey, privKey)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: CreateCertificate failed: %v\n", err)
		os.Exit(1)
	}
	leafCert, err := x509.ParseCertificate(certDER)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: ParseCertificate leaf failed: %v\n", err)
		os.Exit(1)
	}
	ariID, err := acme.ARIUniqueIdentifier(leafCert)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: ARIUniqueIdentifier failed: %v\n", err)
		os.Exit(1)
	}
	if !strings.Contains(ariID, ".") {
		fmt.Fprintf(os.Stderr, "FAIL: ARI identifier must contain period: %s\n", ariID)
		os.Exit(1)
	}

	// Assertion 7: acme.Problem formats RFC 7807 problem details with HTTP status and detail text
	prob := acme.Problem{
		Type:   "urn:ietf:params:acme:error:unauthorized",
		Status: 403,
		Detail: "Account is not authorized",
	}
	errStr := prob.Error()
	if !strings.Contains(errStr, "403") || !strings.Contains(errStr, "unauthorized") || !strings.Contains(errStr, "Account is not authorized") {
		fmt.Fprintf(os.Stderr, "FAIL: Problem.Error() format unexpected: %s\n", errStr)
		os.Exit(1)
	}

	fmt.Println("PASS: pkg:golang/github.com/mholt/acmez/v3@v3.1.2 contract passed")
}