github.com/mholt/acmez/v3 v3.1.2: acme.Account

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify github.com/mholt/acmez/v3/acme.Account in pkg:golang/github.com/mholt/acmez/v3@v3.1.2
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/github.com/mholt/acmez/v3@v3.1.2
Demonstrate these symbols/APIs:
  - github.com/mholt/acmez/v3/acme.Account

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:2898d62342ba2a9549dc679f3559b682d3e0e2a9cc072dc76257c12fd78c2093","contract":["acme.Account holds registration metadata with PrivateKey excluded from JSON serialization","acme.Account.SetExternalAccountBinding signs EAB MAC key with account public key against directory endpoint","acme.Client NewAccount registers account with simulated ACME server and sets Location header","acme.Client UpdateAccount sends account modifications to existing account Location","acmez.OrderParametersFromCSR accepts acme.Account to associate CSR identifiers for certificate orders"],"goal":"verify github.com/mholt/acmez/v3/acme.Account in pkg:golang/github.com/mholt/acmez/v3@v3.1.2","kind":"HOW","packages":["pkg:golang/github.com/mholt/acmez/v3@v3.1.2"],"schemaVersion":1,"symbols":["github.com/mholt/acmez/v3/acme.Account"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/github.com/mholt/acmez/v3@v3.1.2"],"schemaVersion":1,"subject":"pkg:golang/github.com/mholt/acmez/v3@v3.1.2","symbols":["github.com/mholt/acmez/v3/acme.Account"],"verifierAdapter":"golang@1"}

module sample-acmez-account

go 1.22

require github.com/mholt/acmez/v3 v3.1.2

require (
	golang.org/x/crypto v0.27.0 // indirect
	golang.org/x/net v0.29.0 // indirect
	golang.org/x/text v0.18.0 // indirect
)

github.com/mholt/acmez/v3 v3.1.2 h1:auob8J/0FhmdClQicvJvuDavgd5ezwLBfKuYmynhYzc=
github.com/mholt/acmez/v3 v3.1.2/go.mod h1:L1wOU06KKvq7tswuMDwKdcHeKpFFgkppZy/y0DFxagQ=
golang.org/x/crypto v0.27.0 h1:GXm2NjJrPaiv/h1tb2UH8QfgC/hOf/+z0p6PT8o1w7A=
golang.org/x/crypto v0.27.0/go.mod h1:1Xngt8kV6Dvbssa53Ziq6Eqn0HqbZi5Z6R0ZpwQzt70=
golang.org/x/net v0.29.0 h1:5ORfpBpCs4HzDYoodCDBbwHzdR5UrLBZ3sOnUJmFoHo=
golang.org/x/net v0.29.0/go.mod h1:gLkgy8jTGERgjzMic6DS9+SP0ajcu6Xu3Orq/SpETg0=
golang.org/x/text v0.18.0 h1:XvMDiNzPAl0jr17s6W9lcaIhGUfUORdGCNsuLmPG224=
golang.org/x/text v0.18.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=

package main

import (
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"fmt"

	"github.com/mholt/acmez/v3"
	"github.com/mholt/acmez/v3/acme"
)

func main() {
	// Generate a private key for the ACME account
	privKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		fmt.Printf("failed to generate key: %v\n", err)
		return
	}

	// Construct an ACME Account object
	account := acme.Account{
		Contact:              []string{"mailto:admin@example.com"},
		TermsOfServiceAgreed: true,
		Status:               acme.StatusValid,
		Location:             "https://example.com/acme/acct/12345",
		Orders:               "https://example.com/acme/acct/12345/orders",
		PrivateKey:           privKey,
	}

	// Create CSR for certificate identifiers
	csr, err := acmez.NewCSR(privKey, []string{"example.com", "sub.example.com"})
	if err != nil {
		fmt.Printf("failed to create CSR: %v\n", err)
		return
	}

	// Derive order parameters associating the account and CSR
	orderParams, err := acmez.OrderParametersFromCSR(account, csr)
	if err != nil {
		fmt.Printf("failed to derive order params: %v\n", err)
		return
	}

	fmt.Printf("ACME Account configured for %s with %d identifiers\n", account.Contact[0], len(orderParams.Identifiers))
}

{
  "schemaVersion": 1,
  "goal": "verify github.com/mholt/acmez/v3/acme.Account in pkg:golang/github.com/mholt/acmez/v3@v3.1.2",
  "kind": "HOW",
  "packages": [
    "pkg:golang/github.com/mholt/acmez/v3@v3.1.2"
  ],
  "symbols": [
    "github.com/mholt/acmez/v3/acme.Account"
  ]
}

package main

import (
	"context"
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"encoding/base64"
	"encoding/json"
	"fmt"
	"net/http"
	"net/http/httptest"
	"os"
	"strings"
	"sync/atomic"

	"github.com/mholt/acmez/v3"
	"github.com/mholt/acmez/v3/acme"
)

func main() {
	// Generate key for testing
	privKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: key generation failed: %v\n", err)
		os.Exit(1)
	}

	// Assertion 1: acme.Account holds registration metadata with PrivateKey excluded from JSON serialization
	acct := acme.Account{
		Status:               acme.StatusValid,
		Contact:              []string{"mailto:admin@example.com"},
		TermsOfServiceAgreed: true,
		Location:             "https://example.com/acme/acct/100",
		Orders:               "https://example.com/acme/acct/100/orders",
		PrivateKey:           privKey,
	}

	rawJSON, err := json.Marshal(acct)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: json.Marshal failed: %v\n", err)
		os.Exit(1)
	}
	jsonStr := string(rawJSON)
	if strings.Contains(jsonStr, "PrivateKey") || strings.Contains(jsonStr, "privateKey") {
		fmt.Fprintf(os.Stderr, "FAIL: PrivateKey must not be serialized in JSON: %s\n", jsonStr)
		os.Exit(1)
	}
	if !strings.Contains(jsonStr, "mailto:admin@example.com") || !strings.Contains(jsonStr, `"status":"valid"`) {
		fmt.Fprintf(os.Stderr, "FAIL: missing expected fields in JSON: %s\n", jsonStr)
		os.Exit(1)
	}

	var unmarshaled acme.Account
	if err := json.Unmarshal(rawJSON, &unmarshaled); err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: json.Unmarshal failed: %v\n", err)
		os.Exit(1)
	}
	if unmarshaled.Status != acme.StatusValid || len(unmarshaled.Contact) != 1 || unmarshaled.Contact[0] != "mailto:admin@example.com" {
		fmt.Fprintf(os.Stderr, "FAIL: unmarshaled Account mismatch: %+v\n", unmarshaled)
		os.Exit(1)
	}
	if unmarshaled.PrivateKey != nil {
		fmt.Fprintf(os.Stderr, "FAIL: unmarshaled PrivateKey must be nil\n")
		os.Exit(1)
	}

	// Set up mock ACME directory and server
	var nonceCounter int64
	var serverURL string
	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		count := atomic.AddInt64(&nonceCounter, 1)
		w.Header().Set("Replay-Nonce", fmt.Sprintf("nonce-%d", count))

		switch r.URL.Path {
		case "/dir":
			w.Header().Set("Content-Type", "application/json")
			fmt.Fprintf(w, `{"newNonce":"%s/new-nonce","newAccount":"%s/new-account","newOrder":"%s/new-order"}`, serverURL, serverURL, serverURL)
		case "/new-nonce":
			w.WriteHeader(http.StatusOK)
		case "/new-account":
			w.Header().Set("Content-Type", "application/json")
			w.Header().Set("Location", serverURL+"/acct/100")
			w.WriteHeader(http.StatusCreated)
			fmt.Fprintf(w, `{"status":"valid","contact":["mailto:admin@example.com"],"orders":"%s/acct/100/orders"}`, serverURL)
		case "/acct/100":
			w.Header().Set("Content-Type", "application/json")
			w.Header().Set("Location", serverURL+"/acct/100")
			w.WriteHeader(http.StatusOK)
			fmt.Fprintf(w, `{"status":"valid","contact":["mailto:updated@example.com"]}`)
		default:
			http.NotFound(w, r)
		}
	}))
	defer ts.Close()
	serverURL = ts.URL

	client := &acme.Client{
		Directory:  serverURL + "/dir",
		HTTPClient: ts.Client(),
	}

	ctx := context.Background()

	// Assertion 2: acme.Account.SetExternalAccountBinding signs EAB MAC key with account public key against directory endpoint
	acctWithEAB := acme.Account{
		PrivateKey: privKey,
	}
	eab := acme.EAB{
		KeyID:  "test-key-id-123",
		MACKey: base64.RawURLEncoding.EncodeToString([]byte("sample-mac-key-32-bytes-long!!!")),
	}
	if err := acctWithEAB.SetExternalAccountBinding(ctx, client, eab); err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: SetExternalAccountBinding failed: %v\n", err)
		os.Exit(1)
	}
	if len(acctWithEAB.ExternalAccountBinding) == 0 {
		fmt.Fprintf(os.Stderr, "FAIL: ExternalAccountBinding was not set\n")
		os.Exit(1)
	}
	if !strings.Contains(string(acctWithEAB.ExternalAccountBinding), "payload") || !strings.Contains(string(acctWithEAB.ExternalAccountBinding), "protected") {
		fmt.Fprintf(os.Stderr, "FAIL: ExternalAccountBinding must be JWS format: %s\n", string(acctWithEAB.ExternalAccountBinding))
		os.Exit(1)
	}

	// Invalid MACKey should fail
	invalidEAB := acme.EAB{
		KeyID:  "test-key-id",
		MACKey: "invalid%%%base64",
	}
	if err := acctWithEAB.SetExternalAccountBinding(ctx, client, invalidEAB); err == nil {
		fmt.Fprintf(os.Stderr, "FAIL: SetExternalAccountBinding should have failed on invalid base64 MACKey\n")
		os.Exit(1)
	}

	// Assertion 3: acme.Client NewAccount registers account with simulated ACME server and sets Location header
	newAcct := acme.Account{
		PrivateKey:           privKey,
		Contact:              []string{"mailto:admin@example.com"},
		TermsOfServiceAgreed: true,
	}
	createdAcct, err := client.NewAccount(ctx, newAcct)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: client.NewAccount failed: %v\n", err)
		os.Exit(1)
	}
	if createdAcct.Location != serverURL+"/acct/100" {
		fmt.Fprintf(os.Stderr, "FAIL: createdAcct Location mismatch: %s\n", createdAcct.Location)
		os.Exit(1)
	}
	if createdAcct.Status != acme.StatusValid {
		fmt.Fprintf(os.Stderr, "FAIL: createdAcct Status mismatch: %s\n", createdAcct.Status)
		os.Exit(1)
	}

	// Assertion 4: acme.Client UpdateAccount sends account modifications to existing account Location
	createdAcct.Contact = []string{"mailto:updated@example.com"}
	updatedAcct, err := client.UpdateAccount(ctx, createdAcct)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: client.UpdateAccount failed: %v\n", err)
		os.Exit(1)
	}
	if len(updatedAcct.Contact) != 1 || updatedAcct.Contact[0] != "mailto:updated@example.com" {
		fmt.Fprintf(os.Stderr, "FAIL: updatedAcct Contact mismatch: %+v\n", updatedAcct.Contact)
		os.Exit(1)
	}

	// Assertion 5: acmez.OrderParametersFromCSR accepts acme.Account to associate CSR identifiers for certificate orders
	csr, err := acmez.NewCSR(privKey, []string{"example.com", "sub.example.com"})
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: acmez.NewCSR failed: %v\n", err)
		os.Exit(1)
	}
	orderParams, err := acmez.OrderParametersFromCSR(createdAcct, csr)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: OrderParametersFromCSR failed: %v\n", err)
		os.Exit(1)
	}
	if orderParams.Account.Location != createdAcct.Location {
		fmt.Fprintf(os.Stderr, "FAIL: orderParams.Account mismatch: %+v\n", orderParams.Account)
		os.Exit(1)
	}
	if len(orderParams.Identifiers) != 2 {
		fmt.Fprintf(os.Stderr, "FAIL: expected 2 identifiers, got %d\n", len(orderParams.Identifiers))
		os.Exit(1)
	}
	if orderParams.Identifiers[0].Value != "example.com" || orderParams.Identifiers[1].Value != "sub.example.com" {
		fmt.Fprintf(os.Stderr, "FAIL: orderParams identifiers mismatch: %+v\n", orderParams.Identifiers)
		os.Exit(1)
	}

	fmt.Println("PASS: github.com/mholt/acmez/v3/acme.Account contract passed")
}