github.com/mholt/acmez/v3 v3.1.2: NewCSR

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify github.com/mholt/acmez/v3.NewCSR in pkg:golang/github.com/mholt/acmez/v3@v3.1.2
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/github.com/mholt/acmez/v3@v3.1.2
Demonstrate these symbols/APIs:
  - github.com/mholt/acmez/v3.NewCSR

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:be2ddae38d7bef16652ef6c105ee76a5ce230bd60165150f7a92e085ec721aca","contract":["NewCSR creates and signs a valid CertificateRequest for given DNS SANs","NewCSR correctly categorizes IPv4 and IPv6 addresses into IPAddresses","NewCSR correctly categorizes email addresses into EmailAddresses","NewCSR correctly categorizes URI identifiers into URIs","NewCSR normalizes internationalized domain names (IDN) to ASCII punycode in DNSNames","NewCSR creates a CSR that passes cryptographic signature verification","NewCSR returns an error when the SANs list is empty"],"goal":"verify github.com/mholt/acmez/v3.NewCSR in pkg:golang/github.com/mholt/acmez/v3@v3.1.2","kind":"HOW","packages":["pkg:golang/github.com/mholt/acmez/v3@v3.1.2"],"schemaVersion":1,"symbols":["github.com/mholt/acmez/v3.NewCSR"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/github.com/mholt/acmez/v3@v3.1.2"],"schemaVersion":1,"subject":"pkg:golang/github.com/mholt/acmez/v3@v3.1.2","symbols":["github.com/mholt/acmez/v3.NewCSR"],"verifierAdapter":"golang@1"}

module sample

go 1.25.0

require github.com/mholt/acmez/v3 v3.1.2

require (
	golang.org/x/crypto v0.27.0 // indirect
	golang.org/x/net v0.29.0 // indirect
	golang.org/x/text v0.18.0 // indirect
)

github.com/mholt/acmez/v3 v3.1.2 h1:auob8J/0FhmdClQicvJvuDavgd5ezwLBfKuYmynhYzc=
github.com/mholt/acmez/v3 v3.1.2/go.mod h1:L1wOU06KKvq7tswuMDwKdcHeKpFFgkppZy/y0DFxagQ=
golang.org/x/crypto v0.27.0 h1:GXm2NjJrPaiv/h1tb2UH8QfgC/hOf/+z0p6PT8o1w7A=
golang.org/x/crypto v0.27.0/go.mod h1:1Xngt8kV6Dvbssa53Ziq6Eqn0HqbZi5Z6R0ZpwQzt70=
golang.org/x/net v0.29.0 h1:5ORfpBpCs4HzDYoodCDBbwHzdR5UrLBZ3sOnUJmFoHo=
golang.org/x/net v0.29.0/go.mod h1:gLkgy8jTGERgjzMic6DS9+SP0ajcu6Xu3Orq/SpETg0=
golang.org/x/text v0.18.0 h1:XvMDiNzPAl0jr17s6W9lcaIhGUfUORdGCNsuLmPG224=
golang.org/x/text v0.18.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=

package main

import (
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"fmt"

	"github.com/mholt/acmez/v3"
)

func main() {
	privateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		panic(err)
	}

	sans := []string{"example.com", "127.0.0.1"}
	csr, err := acmez.NewCSR(privateKey, sans)
	if err != nil {
		panic(err)
	}

	fmt.Printf("Created CSR for DNS: %v, IP: %v\n", csr.DNSNames, csr.IPAddresses)
}

{
  "schemaVersion": 1,
  "goal": "verify github.com/mholt/acmez/v3.NewCSR in pkg:golang/github.com/mholt/acmez/v3@v3.1.2",
  "kind": "HOW",
  "packages": [
    "pkg:golang/github.com/mholt/acmez/v3@v3.1.2"
  ],
  "symbols": [
    "github.com/mholt/acmez/v3.NewCSR"
  ]
}

package main

import (
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"crypto/rsa"
	"fmt"
	"net"

	"github.com/mholt/acmez/v3"
)

func assert(cond bool, msg string) {
	if !cond {
		panic("assertion failed: " + msg)
	}
}

func main() {
	privKeyECDSA, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	assert(err == nil, "failed to generate ECDSA private key")

	privKeyRSA, err := rsa.GenerateKey(rand.Reader, 2048)
	assert(err == nil, "failed to generate RSA private key")

	// Test 1: NewCSR creates and signs a valid CertificateRequest for given DNS SANs
	{
		sans := []string{"example.com", "api.example.com"}
		csr, err := acmez.NewCSR(privKeyECDSA, sans)
		assert(err == nil, "NewCSR should not fail for valid DNS SANs")
		assert(csr != nil, "CSR should not be nil")
		assert(len(csr.DNSNames) == 2, "CSR should contain 2 DNS names")
		assert(csr.DNSNames[0] == "example.com" && csr.DNSNames[1] == "api.example.com", "DNS names must match input")
		assert(len(csr.IPAddresses) == 0 && len(csr.EmailAddresses) == 0 && len(csr.URIs) == 0, "non-DNS SAN slices should be empty")
	}

	// Test 2: NewCSR correctly categorizes IPv4 and IPv6 addresses into IPAddresses
	{
		sans := []string{"192.0.2.1", "2001:db8::1"}
		csr, err := acmez.NewCSR(privKeyECDSA, sans)
		assert(err == nil, "NewCSR should not fail for IP addresses")
		assert(len(csr.IPAddresses) == 2, "CSR should contain 2 IP addresses")
		assert(csr.IPAddresses[0].Equal(net.ParseIP("192.0.2.1")), "IPv4 address must match")
		assert(csr.IPAddresses[1].Equal(net.ParseIP("2001:db8::1")), "IPv6 address must match")
		assert(len(csr.DNSNames) == 0 && len(csr.EmailAddresses) == 0 && len(csr.URIs) == 0, "other SAN slices should be empty")
	}

	// Test 3: NewCSR correctly categorizes email addresses into EmailAddresses
	{
		sans := []string{"admin@example.com", "security@example.org"}
		csr, err := acmez.NewCSR(privKeyECDSA, sans)
		assert(err == nil, "NewCSR should not fail for email addresses")
		assert(len(csr.EmailAddresses) == 2, "CSR should contain 2 email addresses")
		assert(csr.EmailAddresses[0] == "admin@example.com" && csr.EmailAddresses[1] == "security@example.org", "Email addresses must match")
		assert(len(csr.DNSNames) == 0 && len(csr.IPAddresses) == 0 && len(csr.URIs) == 0, "other SAN slices should be empty")
	}

	// Test 4: NewCSR correctly categorizes URI identifiers into URIs
	{
		sans := []string{"https://example.com/id/device1"}
		csr, err := acmez.NewCSR(privKeyECDSA, sans)
		assert(err == nil, "NewCSR should not fail for URI")
		assert(len(csr.URIs) == 1, "CSR should contain 1 URI")
		assert(csr.URIs[0].String() == "https://example.com/id/device1", "URI string must match")
	}

	// Test 5: NewCSR normalizes internationalized domain names (IDN) to ASCII punycode in DNSNames
	{
		sans := []string{"münchen.example.com"}
		csr, err := acmez.NewCSR(privKeyECDSA, sans)
		assert(err == nil, "NewCSR should not fail for IDN")
		assert(len(csr.DNSNames) == 1, "CSR should contain 1 DNS name")
		assert(csr.DNSNames[0] == "xn--mnchen-3ya.example.com", "IDN must be converted to punycode ASCII")
	}

	// Test 6: NewCSR creates a CSR that passes cryptographic signature verification
	{
		sans := []string{"example.com", "127.0.0.1", "admin@example.com"}
		csrECDSA, err := acmez.NewCSR(privKeyECDSA, sans)
		assert(err == nil, "NewCSR with ECDSA key should succeed")
		assert(csrECDSA.CheckSignature() == nil, "ECDSA CSR signature must be valid")

		csrRSA, err := acmez.NewCSR(privKeyRSA, sans)
		assert(err == nil, "NewCSR with RSA key should succeed")
		assert(csrRSA.CheckSignature() == nil, "RSA CSR signature must be valid")
	}

	// Test 7: NewCSR returns an error when the SANs list is empty
	{
		csr, err := acmez.NewCSR(privKeyECDSA, []string{})
		assert(err != nil, "NewCSR with empty SANs slice must return an error")
		assert(csr == nil, "CSR returned on empty SANs must be nil")

		csrNil, errNil := acmez.NewCSR(privKeyECDSA, nil)
		assert(errNil != nil, "NewCSR with nil SANs slice must return an error")
		assert(csrNil == nil, "CSR returned on nil SANs must be nil")
	}

	fmt.Println("Contract verification passed successfully")
}