github.com/mholt/acmez/v3 v3.1.2: acme.Challenge

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify github.com/mholt/acmez/v3/acme.Challenge in pkg:golang/github.com/mholt/acmez/v3@v3.1.2
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/github.com/mholt/acmez/v3@v3.1.2
Demonstrate these symbols/APIs:
  - github.com/mholt/acmez/v3/acme.Challenge

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

package sample

import (
	"github.com/mholt/acmez/v3/acme"
)

// NewHTTP01Challenge constructs an HTTP-01 acme.Challenge with the given URL and token.
func NewHTTP01Challenge(challengeURL, token string) acme.Challenge {
	return acme.Challenge{
		Type:   "http-01",
		Status: "pending",
		URL:    challengeURL,
		Token:  token,
	}
}

// NewDNS01Challenge constructs a DNS-01 acme.Challenge with domain identifier and key authorization.
func NewDNS01Challenge(challengeURL, token, keyAuth, domain string) acme.Challenge {
	return acme.Challenge{
		Type:             "dns-01",
		Status:           "pending",
		URL:              challengeURL,
		Token:            token,
		KeyAuthorization: keyAuth,
		Identifier: acme.Identifier{
			Type:  "dns",
			Value: domain,
		},
	}
}

// HTTP01Path returns the well-known HTTP path required to solve the HTTP-01 challenge.
func HTTP01Path(chal acme.Challenge) string {
	return chal.HTTP01ResourcePath()
}

// DNS01RecordDetails returns the TXT record name and the SHA-256 base64url digest of the key authorization.
func DNS01RecordDetails(chal acme.Challenge) (recordName, recordValue string) {
	return chal.DNS01TXTRecordName(), chal.DNS01KeyAuthorization()
}

{"case":{"caseId":"case:sha256:5917f4e3fd1794d5916a14f61669b805eb7ea47947fcca0d2864d7173f16248c","contract":["Challenge represents an ACME challenge with type, URL, status, and token fields","Challenge.HTTP01ResourcePath returns the well-known HTTP path constructed from the challenge token","Challenge.DNS01TXTRecordName prepends _acme-challenge to the domain identifier","Challenge.DNS01KeyAuthorization returns the base64url SHA-256 digest of keyAuthorization","Challenge correctly serializes to and deserializes from JSON"],"goal":"verify github.com/mholt/acmez/v3/acme.Challenge in pkg:golang/github.com/mholt/acmez/v3@v3.1.2","kind":"HOW","packages":["pkg:golang/github.com/mholt/acmez/v3@v3.1.2"],"schemaVersion":1,"symbols":["github.com/mholt/acmez/v3/acme.Challenge"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/github.com/mholt/acmez/v3@v3.1.2"],"schemaVersion":1,"subject":"pkg:golang/github.com/mholt/acmez/v3@v3.1.2","symbols":["github.com/mholt/acmez/v3/acme.Challenge"],"verifierAdapter":"golang@1"}

module sample

go 1.26.6

require github.com/mholt/acmez/v3 v3.1.2

github.com/mholt/acmez/v3 v3.1.2 h1:auob8J/0FhmdClQicvJvuDavgd5ezwLBfKuYmynhYzc=
github.com/mholt/acmez/v3 v3.1.2/go.mod h1:L1wOU06KKvq7tswuMDwKdcHeKpFFgkppZy/y0DFxagQ=

{
  "schemaVersion": 1,
  "goal": "verify github.com/mholt/acmez/v3/acme.Challenge in pkg:golang/github.com/mholt/acmez/v3@v3.1.2",
  "kind": "HOW",
  "packages": [
    "pkg:golang/github.com/mholt/acmez/v3@v3.1.2"
  ],
  "symbols": [
    "github.com/mholt/acmez/v3/acme.Challenge"
  ]
}

package main

import (
	"crypto/sha256"
	"encoding/base64"
	"encoding/json"
	"fmt"
	"os"

	"github.com/mholt/acmez/v3/acme"
	"sample"
)

func main() {
	// Assertion 1: Construct HTTP-01 challenge and verify fields
	httpChal := sample.NewHTTP01Challenge("http://localhost:14000/challenge/1", "token12345")
	if httpChal.Type != "http-01" {
		fmt.Fprintf(os.Stderr, "expected Type to be 'http-01', got %q\n", httpChal.Type)
		os.Exit(1)
	}
	if httpChal.Status != "pending" {
		fmt.Fprintf(os.Stderr, "expected Status to be 'pending', got %q\n", httpChal.Status)
		os.Exit(1)
	}
	if httpChal.Token != "token12345" {
		fmt.Fprintf(os.Stderr, "expected Token to be 'token12345', got %q\n", httpChal.Token)
		os.Exit(1)
	}

	// Assertion 2: HTTP01ResourcePath returns expected well-known path
	expectedHTTPPath := "/.well-known/acme-challenge/token12345"
	if got := sample.HTTP01Path(httpChal); got != expectedHTTPPath {
		fmt.Fprintf(os.Stderr, "expected HTTP01Path %q, got %q\n", expectedHTTPPath, got)
		os.Exit(1)
	}
	if got := httpChal.HTTP01ResourcePath(); got != expectedHTTPPath {
		fmt.Fprintf(os.Stderr, "expected HTTP01ResourcePath %q, got %q\n", expectedHTTPPath, got)
		os.Exit(1)
	}

	// Assertion 3: Construct DNS-01 challenge and verify fields
	keyAuth := "token12345.accountKeyThumbprint67890"
	dnsChal := sample.NewDNS01Challenge("http://localhost:14000/challenge/2", "token12345", keyAuth, "example.com")
	if dnsChal.Type != "dns-01" {
		fmt.Fprintf(os.Stderr, "expected Type to be 'dns-01', got %q\n", dnsChal.Type)
		os.Exit(1)
	}
	if dnsChal.Identifier.Type != "dns" || dnsChal.Identifier.Value != "example.com" {
		fmt.Fprintf(os.Stderr, "expected Identifier dns:example.com, got %v\n", dnsChal.Identifier)
		os.Exit(1)
	}

	// Assertion 4: DNS01TXTRecordName prepends _acme-challenge
	expectedRecordName := "_acme-challenge.example.com"
	if got := dnsChal.DNS01TXTRecordName(); got != expectedRecordName {
		fmt.Fprintf(os.Stderr, "expected DNS01TXTRecordName %q, got %q\n", expectedRecordName, got)
		os.Exit(1)
	}

	// Assertion 5: DNS01KeyAuthorization returns base64url-encoded sha256 digest of KeyAuthorization
	hasher := sha256.New()
	hasher.Write([]byte(keyAuth))
	expectedDigest := base64.RawURLEncoding.EncodeToString(hasher.Sum(nil))
	if got := dnsChal.DNS01KeyAuthorization(); got != expectedDigest {
		fmt.Fprintf(os.Stderr, "expected DNS01KeyAuthorization %q, got %q\n", expectedDigest, got)
		os.Exit(1)
	}

	recName, recVal := sample.DNS01RecordDetails(dnsChal)
	if recName != expectedRecordName || recVal != expectedDigest {
		fmt.Fprintf(os.Stderr, "DNS01RecordDetails mismatch: got (%q, %q), expected (%q, %q)\n", recName, recVal, expectedRecordName, expectedDigest)
		os.Exit(1)
	}

	// Assertion 6: JSON serialization and deserialization of Challenge
	jsonData, err := json.Marshal(httpChal)
	if err != nil {
		fmt.Fprintf(os.Stderr, "json.Marshal failed: %v\n", err)
		os.Exit(1)
	}

	var decoded acme.Challenge
	if err := json.Unmarshal(jsonData, &decoded); err != nil {
		fmt.Fprintf(os.Stderr, "json.Unmarshal failed: %v\n", err)
		os.Exit(1)
	}
	if decoded.Type != httpChal.Type || decoded.URL != httpChal.URL || decoded.Token != httpChal.Token || decoded.Status != httpChal.Status {
		fmt.Fprintf(os.Stderr, "decoded Challenge mismatch: got %+v, expected %+v\n", decoded, httpChal)
		os.Exit(1)
	}

	fmt.Println("All acme.Challenge contract assertions passed.")
}