github.com/mholt/acmez/v3 v3.1.2: acme.ChallengeTypeDNS01

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify github.com/mholt/acmez/v3/acme.ChallengeTypeDNS01 in pkg:golang/github.com/mholt/acmez/v3@v3.1.2
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/github.com/mholt/acmez/v3@v3.1.2
Demonstrate these symbols/APIs:
  - github.com/mholt/acmez/v3/acme.ChallengeTypeDNS01

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:e508f29c2f1adb36709f13202cc320d701a63f149fc3d1c432f7d776243789c5","contract":["acme.ChallengeTypeDNS01 constant is defined as \"dns-01\" according to RFC 8555","acme.Challenge.DNS01TXTRecordName prepends \"_acme-challenge.\" to root domains and subdomains","acme.Challenge.DNS01KeyAuthorization computes the raw base64url SHA-256 digest of KeyAuthorization without padding","acmez.Solver implementation handles DNS-01 Present and CleanUp lifecycle to provision and remove DNS TXT records","acmez.Solver rejects unsupported non-DNS01 challenge types such as ChallengeTypeHTTP01"],"goal":"verify github.com/mholt/acmez/v3/acme.ChallengeTypeDNS01 in pkg:golang/github.com/mholt/acmez/v3@v3.1.2","kind":"HOW","packages":["pkg:golang/github.com/mholt/acmez/v3@v3.1.2"],"schemaVersion":1,"symbols":["github.com/mholt/acmez/v3/acme.ChallengeTypeDNS01"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/github.com/mholt/acmez/v3@v3.1.2"],"schemaVersion":1,"subject":"pkg:golang/github.com/mholt/acmez/v3@v3.1.2","symbols":["github.com/mholt/acmez/v3/acme.ChallengeTypeDNS01"],"verifierAdapter":"golang@1"}

module sample-acmez-dns01

go 1.22

require github.com/mholt/acmez/v3 v3.1.2

require (
	golang.org/x/crypto v0.27.0 // indirect
	golang.org/x/net v0.29.0 // indirect
	golang.org/x/text v0.18.0 // indirect
)

github.com/mholt/acmez/v3 v3.1.2 h1:auob8J/0FhmdClQicvJvuDavgd5ezwLBfKuYmynhYzc=
github.com/mholt/acmez/v3 v3.1.2/go.mod h1:L1wOU06KKvq7tswuMDwKdcHeKpFFgkppZy/y0DFxagQ=
golang.org/x/crypto v0.27.0 h1:GXm2NjJrPaiv/h1tb2UH8QfgC/hOf/+z0p6PT8o1w7A=
golang.org/x/crypto v0.27.0/go.mod h1:1Xngt8kV6Dvbssa53Ziq6Eqn0HqbZi5Z6R0ZpwQzt70=
golang.org/x/net v0.29.0 h1:5ORfpBpCs4HzDYoodCDBbwHzdR5UrLBZ3sOnUJmFoHo=
golang.org/x/net v0.29.0/go.mod h1:gLkgy8jTGERgjzMic6DS9+SP0ajcu6Xu3Orq/SpETg0=
golang.org/x/text v0.18.0 h1:XvMDiNzPAl0jr17s6W9lcaIhGUfUORdGCNsuLmPG224=
golang.org/x/text v0.18.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=

package main

import (
	"context"
	"crypto/sha256"
	"encoding/base64"
	"fmt"

	"github.com/mholt/acmez/v3"
	"github.com/mholt/acmez/v3/acme"
)

// MemoryDNS01Solver is a simple in-memory solver implementing acmez.Solver.
type MemoryDNS01Solver struct {
	Records map[string]string
}

func NewMemoryDNS01Solver() *MemoryDNS01Solver {
	return &MemoryDNS01Solver{
		Records: make(map[string]string),
	}
}

func (s *MemoryDNS01Solver) Present(_ context.Context, chal acme.Challenge) error {
	if chal.Type != acme.ChallengeTypeDNS01 {
		return fmt.Errorf("unsupported challenge type: %s", chal.Type)
	}
	txtRecordName := chal.DNS01TXTRecordName()
	keyAuthDigest := chal.DNS01KeyAuthorization()
	s.Records[txtRecordName] = keyAuthDigest
	return nil
}

func (s *MemoryDNS01Solver) CleanUp(_ context.Context, chal acme.Challenge) error {
	if chal.Type != acme.ChallengeTypeDNS01 {
		return fmt.Errorf("unsupported challenge type: %s", chal.Type)
	}
	delete(s.Records, chal.DNS01TXTRecordName())
	return nil
}

var _ acmez.Solver = (*MemoryDNS01Solver)(nil)

func main() {
	// Setup a sample DNS-01 challenge
	domain := "example.com"
	token := "evaGxfADs6pSRb2LAv9IZf17Dt3juxGJ-PCt92wr-oA"
	thumbprint := "k5H_9k_f7s0lT2_yD3rG5hQ8j7e9xW_0aB1c2D3e4F5"
	keyAuth := token + "." + thumbprint

	chal := acme.Challenge{
		Type:             acme.ChallengeTypeDNS01,
		Token:            token,
		KeyAuthorization: keyAuth,
		Identifier: acme.Identifier{
			Type:  "dns",
			Value: domain,
		},
	}

	fmt.Printf("Challenge Type: %s\n", chal.Type)
	fmt.Printf("TXT Record Name: %s\n", chal.DNS01TXTRecordName())
	fmt.Printf("TXT Record Value (Digest): %s\n", chal.DNS01KeyAuthorization())

	// Verify standard SHA-256 digest computation matches
	h := sha256.Sum256([]byte(keyAuth))
	expectedDigest := base64.RawURLEncoding.EncodeToString(h[:])
	fmt.Printf("Matches expected digest: %t\n", chal.DNS01KeyAuthorization() == expectedDigest)

	// Simulate solving via Solver interface
	solver := NewMemoryDNS01Solver()
	ctx := context.Background()
	if err := solver.Present(ctx, chal); err != nil {
		fmt.Printf("solver present failed: %v\n", err)
		return
	}
	fmt.Printf("Provisioned record in solver: %s -> %s\n", chal.DNS01TXTRecordName(), solver.Records[chal.DNS01TXTRecordName()])

	if err := solver.CleanUp(ctx, chal); err != nil {
		fmt.Printf("solver cleanup failed: %v\n", err)
		return
	}
	fmt.Printf("Records after cleanup: %d\n", len(solver.Records))
}

{
  "schemaVersion": 1,
  "goal": "verify github.com/mholt/acmez/v3/acme.ChallengeTypeDNS01 in pkg:golang/github.com/mholt/acmez/v3@v3.1.2",
  "kind": "HOW",
  "packages": [
    "pkg:golang/github.com/mholt/acmez/v3@v3.1.2"
  ],
  "symbols": [
    "github.com/mholt/acmez/v3/acme.ChallengeTypeDNS01"
  ]
}

package main

import (
	"context"
	"crypto/sha256"
	"encoding/base64"
	"fmt"
	"os"

	"github.com/mholt/acmez/v3"
	"github.com/mholt/acmez/v3/acme"
)

// memoryDNS01Solver demonstrates and tests the acmez.Solver contract for DNS-01 challenges.
type memoryDNS01Solver struct {
	records map[string]string
}

func newMemoryDNS01Solver() *memoryDNS01Solver {
	return &memoryDNS01Solver{
		records: make(map[string]string),
	}
}

func (s *memoryDNS01Solver) Present(_ context.Context, chal acme.Challenge) error {
	if chal.Type != acme.ChallengeTypeDNS01 {
		return fmt.Errorf("unexpected challenge type: got %q, want %q", chal.Type, acme.ChallengeTypeDNS01)
	}
	s.records[chal.DNS01TXTRecordName()] = chal.DNS01KeyAuthorization()
	return nil
}

func (s *memoryDNS01Solver) CleanUp(_ context.Context, chal acme.Challenge) error {
	if chal.Type != acme.ChallengeTypeDNS01 {
		return fmt.Errorf("unexpected challenge type: got %q, want %q", chal.Type, acme.ChallengeTypeDNS01)
	}
	delete(s.records, chal.DNS01TXTRecordName())
	return nil
}

var _ acmez.Solver = (*memoryDNS01Solver)(nil)

func main() {
	// Assertion 1: acme.ChallengeTypeDNS01 constant is defined as "dns-01" in compliance with RFC 8555
	if acme.ChallengeTypeDNS01 != "dns-01" {
		fmt.Fprintf(os.Stderr, "FAIL: acme.ChallengeTypeDNS01 mismatch: got %q, want %q\n", acme.ChallengeTypeDNS01, "dns-01")
		os.Exit(1)
	}

	// Assertion 2: acme.Challenge.DNS01TXTRecordName prepends "_acme-challenge." to root domains and subdomains
	testCases := []struct {
		domain   string
		expected string
	}{
		{"example.com", "_acme-challenge.example.com"},
		{"api.example.com", "_acme-challenge.api.example.com"},
		{"nested.deep.sub.example.org", "_acme-challenge.nested.deep.sub.example.org"},
	}

	for _, tc := range testCases {
		chal := acme.Challenge{
			Type: acme.ChallengeTypeDNS01,
			Identifier: acme.Identifier{
				Type:  "dns",
				Value: tc.domain,
			},
		}
		actual := chal.DNS01TXTRecordName()
		if actual != tc.expected {
			fmt.Fprintf(os.Stderr, "FAIL: DNS01TXTRecordName(%q) = %q, want %q\n", tc.domain, actual, tc.expected)
			os.Exit(1)
		}
	}

	// Assertion 3: acme.Challenge.DNS01KeyAuthorization computes base64url-encoded SHA-256 digest of KeyAuthorization without padding
	keyAuthStrings := []string{
		"evaGxfADs6pSRb2LAv9IZf17Dt3juxGJ-PCt92wr-oA.k5H_9k_f7s0lT2_yD3rG5hQ8j7e9xW_0aB1c2D3e4F5",
		"token-xyz-123.account-thumbprint-456",
		"custom_token_sample.random_thumbprint_key_789",
	}

	for _, keyAuth := range keyAuthStrings {
		chal := acme.Challenge{
			Type:             acme.ChallengeTypeDNS01,
			KeyAuthorization: keyAuth,
		}
		computed := chal.DNS01KeyAuthorization()

		h := sha256.Sum256([]byte(keyAuth))
		expected := base64.RawURLEncoding.EncodeToString(h[:])

		if computed != expected {
			fmt.Fprintf(os.Stderr, "FAIL: DNS01KeyAuthorization mismatch for %q: got %q, want %q\n", keyAuth, computed, expected)
			os.Exit(1)
		}
	}

	// Assertion 4: acmez.Solver implementations properly handle DNS-01 Present and CleanUp lifecycle
	solver := newMemoryDNS01Solver()
	ctx := context.Background()

	chal1 := acme.Challenge{
		Type:             acme.ChallengeTypeDNS01,
		KeyAuthorization: "token1.thumbprint1",
		Identifier: acme.Identifier{
			Type:  "dns",
			Value: "app.example.com",
		},
	}
	chal2 := acme.Challenge{
		Type:             acme.ChallengeTypeDNS01,
		KeyAuthorization: "token2.thumbprint2",
		Identifier: acme.Identifier{
			Type:  "dns",
			Value: "auth.example.com",
		},
	}

	if err := solver.Present(ctx, chal1); err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: Present chal1: %v\n", err)
		os.Exit(1)
	}
	if err := solver.Present(ctx, chal2); err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: Present chal2: %v\n", err)
		os.Exit(1)
	}

	if len(solver.records) != 2 {
		fmt.Fprintf(os.Stderr, "FAIL: expected 2 records in solver, got %d\n", len(solver.records))
		os.Exit(1)
	}
	if solver.records["_acme-challenge.app.example.com"] != chal1.DNS01KeyAuthorization() {
		fmt.Fprintf(os.Stderr, "FAIL: solver record content mismatch for chal1\n")
		os.Exit(1)
	}
	if solver.records["_acme-challenge.auth.example.com"] != chal2.DNS01KeyAuthorization() {
		fmt.Fprintf(os.Stderr, "FAIL: solver record content mismatch for chal2\n")
		os.Exit(1)
	}

	if err := solver.CleanUp(ctx, chal1); err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: CleanUp chal1: %v\n", err)
		os.Exit(1)
	}
	if len(solver.records) != 1 {
		fmt.Fprintf(os.Stderr, "FAIL: expected 1 record remaining, got %d\n", len(solver.records))
		os.Exit(1)
	}
	if _, exists := solver.records["_acme-challenge.app.example.com"]; exists {
		fmt.Fprintf(os.Stderr, "FAIL: chal1 record should have been removed\n")
		os.Exit(1)
	}

	// Assertion 5: Solver returns error when invoked with a non-DNS01 challenge type
	httpChal := acme.Challenge{
		Type:             acme.ChallengeTypeHTTP01,
		KeyAuthorization: "token.thumb",
		Identifier: acme.Identifier{
			Type:  "dns",
			Value: "example.com",
		},
	}
	if err := solver.Present(ctx, httpChal); err == nil {
		fmt.Fprintf(os.Stderr, "FAIL: expected Present to return error for HTTP-01 challenge, got nil\n")
		os.Exit(1)
	}

	fmt.Println("PASS: github.com/mholt/acmez/v3/acme.ChallengeTypeDNS01 contract passed")
}