github.com/mholt/acmez/v3 v3.1.2: acme.Identifier

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify github.com/mholt/acmez/v3/acme.Identifier in pkg:golang/github.com/mholt/acmez/v3@v3.1.2
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/github.com/mholt/acmez/v3@v3.1.2
Demonstrate these symbols/APIs:
  - github.com/mholt/acmez/v3/acme.Identifier

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:522c2fb90e419d376f33a3637bdce2d850e88adf1a0f46af95bb87f903ced7b3","contract":["acme.Identifier stores Type and Value fields for ACME order and authorization targets","acme.Identifier serializes to and deserializes from JSON with type and value keys","acme.Authorization.IdentifierValue returns the raw identifier value or prepends wildcard prefix when wildcard is true","acme.Challenge associates with an Identifier and computes DNS01TXTRecordName with the identifier value","acme.Order encapsulates a slice of Identifiers representing certificate domain and IP targets","acme.Subproblem formats identifier type and value in error details","acmez.OrderParametersFromCSR extracts DNS and IP Identifiers from x509 CertificateRequest SANs"],"goal":"verify github.com/mholt/acmez/v3/acme.Identifier in pkg:golang/github.com/mholt/acmez/v3@v3.1.2","kind":"HOW","packages":["pkg:golang/github.com/mholt/acmez/v3@v3.1.2"],"schemaVersion":1,"symbols":["github.com/mholt/acmez/v3/acme.Identifier"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/github.com/mholt/acmez/v3@v3.1.2"],"schemaVersion":1,"subject":"pkg:golang/github.com/mholt/acmez/v3@v3.1.2","symbols":["github.com/mholt/acmez/v3/acme.Identifier"],"verifierAdapter":"golang@1"}

module sample-acmez-identifier

go 1.22

require github.com/mholt/acmez/v3 v3.1.2

require (
	golang.org/x/crypto v0.27.0 // indirect
	golang.org/x/net v0.29.0 // indirect
	golang.org/x/text v0.18.0 // indirect
)

github.com/mholt/acmez/v3 v3.1.2 h1:auob8J/0FhmdClQicvJvuDavgd5ezwLBfKuYmynhYzc=
github.com/mholt/acmez/v3 v3.1.2/go.mod h1:L1wOU06KKvq7tswuMDwKdcHeKpFFgkppZy/y0DFxagQ=
golang.org/x/crypto v0.27.0 h1:GXm2NjJrPaiv/h1tb2UH8QfgC/hOf/+z0p6PT8o1w7A=
golang.org/x/crypto v0.27.0/go.mod h1:1Xngt8kV6Dvbssa53Ziq6Eqn0HqbZi5Z6R0ZpwQzt70=
golang.org/x/net v0.29.0 h1:5ORfpBpCs4HzDYoodCDBbwHzdR5UrLBZ3sOnUJmFoHo=
golang.org/x/net v0.29.0/go.mod h1:gLkgy8jTGERgjzMic6DS9+SP0ajcu6Xu3Orq/SpETg0=
golang.org/x/text v0.18.0 h1:XvMDiNzPAl0jr17s6W9lcaIhGUfUORdGCNsuLmPG224=
golang.org/x/text v0.18.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=

package main

import (
	"encoding/json"
	"fmt"

	"github.com/mholt/acmez/v3/acme"
)

func main() {
	// Construct ACME DNS identifier
	dnsID := acme.Identifier{
		Type:  "dns",
		Value: "example.com",
	}

	// Marshal identifier to JSON
	data, err := json.Marshal(dnsID)
	if err != nil {
		fmt.Printf("marshal error: %v\n", err)
		return
	}
	fmt.Printf("ACME Identifier JSON: %s\n", string(data))

	// Construct Order with multiple identifiers
	order := acme.Order{
		Status: acme.StatusPending,
		Identifiers: []acme.Identifier{
			dnsID,
			{Type: "ip", Value: "192.0.2.1"},
		},
	}
	fmt.Printf("Order identifiers count: %d\n", len(order.Identifiers))
}

{
  "schemaVersion": 1,
  "goal": "verify github.com/mholt/acmez/v3/acme.Identifier in pkg:golang/github.com/mholt/acmez/v3@v3.1.2",
  "kind": "HOW",
  "packages": [
    "pkg:golang/github.com/mholt/acmez/v3@v3.1.2"
  ],
  "symbols": [
    "github.com/mholt/acmez/v3/acme.Identifier"
  ]
}

package main

import (
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"encoding/json"
	"fmt"
	"os"
	"strings"

	"github.com/mholt/acmez/v3"
	"github.com/mholt/acmez/v3/acme"
)

func main() {
	// Assertion 1: acme.Identifier stores Type and Value fields for ACME order and authorization targets
	id := acme.Identifier{
		Type:  "dns",
		Value: "sub.example.com",
	}
	if id.Type != "dns" || id.Value != "sub.example.com" {
		fmt.Fprintf(os.Stderr, "FAIL: acme.Identifier field mismatch: %+v\n", id)
		os.Exit(1)
	}

	ipID := acme.Identifier{
		Type:  "ip",
		Value: "192.0.2.1",
	}
	if ipID.Type != "ip" || ipID.Value != "192.0.2.1" {
		fmt.Fprintf(os.Stderr, "FAIL: IP Identifier field mismatch: %+v\n", ipID)
		os.Exit(1)
	}

	// Assertion 2: acme.Identifier serializes to and deserializes from JSON with type and value keys
	jsonData, err := json.Marshal(id)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: json.Marshal failed: %v\n", err)
		os.Exit(1)
	}
	expectedJSON := `{"type":"dns","value":"sub.example.com"}`
	if string(jsonData) != expectedJSON {
		fmt.Fprintf(os.Stderr, "FAIL: JSON output mismatch: got %s, want %s\n", string(jsonData), expectedJSON)
		os.Exit(1)
	}

	var parsedID acme.Identifier
	if err := json.Unmarshal([]byte(`{"type":"ip","value":"2001:db8::1"}`), &parsedID); err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: json.Unmarshal failed: %v\n", err)
		os.Exit(1)
	}
	if parsedID.Type != "ip" || parsedID.Value != "2001:db8::1" {
		fmt.Fprintf(os.Stderr, "FAIL: Unmarshaled identifier mismatch: %+v\n", parsedID)
		os.Exit(1)
	}

	// Assertion 3: acme.Authorization.IdentifierValue returns the raw identifier value or prepends wildcard prefix when wildcard is true
	standardAuthz := acme.Authorization{
		Identifier: acme.Identifier{
			Type:  "dns",
			Value: "example.com",
		},
		Wildcard: false,
	}
	if standardAuthz.IdentifierValue() != "example.com" {
		fmt.Fprintf(os.Stderr, "FAIL: standard IdentifierValue mismatch: %s\n", standardAuthz.IdentifierValue())
		os.Exit(1)
	}

	wildcardAuthz := acme.Authorization{
		Identifier: acme.Identifier{
			Type:  "dns",
			Value: "example.com",
		},
		Wildcard: true,
	}
	if wildcardAuthz.IdentifierValue() != "*.example.com" {
		fmt.Fprintf(os.Stderr, "FAIL: wildcard IdentifierValue mismatch: %s\n", wildcardAuthz.IdentifierValue())
		os.Exit(1)
	}

	// Assertion 4: acme.Challenge associates with an Identifier and computes DNS01TXTRecordName with the identifier value
	chal := acme.Challenge{
		Type:             acme.ChallengeTypeDNS01,
		Token:            "random-token-value",
		KeyAuthorization: "random-token-value.thumbprint",
		Identifier: acme.Identifier{
			Type:  "dns",
			Value: "app.example.com",
		},
	}
	if chal.Identifier.Value != "app.example.com" {
		fmt.Fprintf(os.Stderr, "FAIL: challenge Identifier mismatch: %+v\n", chal.Identifier)
		os.Exit(1)
	}
	expectedTXT := "_acme-challenge.app.example.com"
	if chal.DNS01TXTRecordName() != expectedTXT {
		fmt.Fprintf(os.Stderr, "FAIL: DNS01TXTRecordName mismatch: got %s, want %s\n", chal.DNS01TXTRecordName(), expectedTXT)
		os.Exit(1)
	}

	// Assertion 5: acme.Order encapsulates a slice of Identifiers representing certificate domain and IP targets
	order := acme.Order{
		Status: acme.StatusPending,
		Identifiers: []acme.Identifier{
			{Type: "dns", Value: "example.com"},
			{Type: "dns", Value: "www.example.com"},
			{Type: "ip", Value: "192.0.2.1"},
		},
	}
	if len(order.Identifiers) != 3 {
		fmt.Fprintf(os.Stderr, "FAIL: Order Identifiers length mismatch: %d\n", len(order.Identifiers))
		os.Exit(1)
	}
	if order.Identifiers[1].Value != "www.example.com" || order.Identifiers[2].Type != "ip" {
		fmt.Fprintf(os.Stderr, "FAIL: Order Identifiers element mismatch: %+v\n", order.Identifiers)
		os.Exit(1)
	}

	// Assertion 6: acme.Subproblem formats identifier type and value in error details
	subprob := acme.Subproblem{
		Problem: acme.Problem{
			Status: 400,
			Type:   acme.ProblemTypeRejectedIdentifier,
			Detail: "Domain name is forbidden",
		},
		Identifier: acme.Identifier{
			Type:  "dns",
			Value: "forbidden.example.com",
		},
	}
	prob := acme.Problem{
		Status:      400,
		Type:        acme.ProblemTypeRejectedIdentifier,
		Detail:      "Order validation failed",
		Subproblems: []acme.Subproblem{subprob},
	}
	probErr := prob.Error()
	if !strings.Contains(probErr, "dns_identifier=forbidden.example.com") {
		fmt.Fprintf(os.Stderr, "FAIL: Problem error string missing identifier info: %s\n", probErr)
		os.Exit(1)
	}

	// Assertion 7: acmez.OrderParametersFromCSR extracts DNS and IP Identifiers from x509 CertificateRequest SANs
	privKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: key generation error: %v\n", err)
		os.Exit(1)
	}

	sans := []string{"site.example.com", "198.51.100.1"}
	csr, err := acmez.NewCSR(privKey, sans)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: NewCSR error: %v\n", err)
		os.Exit(1)
	}

	account := acme.Account{
		PrivateKey: privKey,
		Location:   "https://example.com/acme/acct/1",
		Status:     acme.StatusValid,
	}

	orderParams, err := acmez.OrderParametersFromCSR(account, csr)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: OrderParametersFromCSR error: %v\n", err)
		os.Exit(1)
	}
	if len(orderParams.Identifiers) != 2 {
		fmt.Fprintf(os.Stderr, "FAIL: extracted Identifiers length mismatch: %d\n", len(orderParams.Identifiers))
		os.Exit(1)
	}
	if orderParams.Identifiers[0].Type != "dns" || orderParams.Identifiers[0].Value != "site.example.com" {
		fmt.Fprintf(os.Stderr, "FAIL: extracted DNS identifier mismatch: %+v\n", orderParams.Identifiers[0])
		os.Exit(1)
	}
	if orderParams.Identifiers[1].Type != "ip" || orderParams.Identifiers[1].Value != "198.51.100.1" {
		fmt.Fprintf(os.Stderr, "FAIL: extracted IP identifier mismatch: %+v\n", orderParams.Identifiers[1])
		os.Exit(1)
	}

	fmt.Println("PASS: github.com/mholt/acmez/v3/acme.Identifier contract passed")
}