github.com/mholt/acmez/v3 v3.1.6

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify pkg:golang/github.com/mholt/acmez/v3@v3.1.6
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/github.com/mholt/acmez/v3@v3.1.6
Constraints:
  - executionContext: node
Required runtime conditions:
  - ecosystem: npm
  - language: javascript
  - moduleSystem: cjs
  - packageManager: npm@10.9.8
  - runtime: node@22.23.2

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:1b9a8225c3813bceb2ae0d26c121e24261f059df79a63473787a8e7c72f93a82","contract":["acmez.NewCSR creates a signed x509 CertificateRequest from subject alternative names including DNS, IP, and email addresses","acmez.OrderParametersFromCSR maps CertificateRequest SANs into matching ACME Identifiers with DNS and IP types","acmez.StaticCSR wraps a pre-constructed CertificateRequest as a CSRSource interface","acmez.TLSALPN01ChallengeCert creates a self-signed TLS certificate with critical id-pe-acmeIdentifier extension for TLS-ALPN-01 challenges","acme.Challenge computes standard HTTP-01 resource paths and DNS-01 TXT record names and digest authorization","acmez.MailReplyChallengeResponse formats RFC 8823 email-reply-00 challenge response email body with headers and key authorization","acme.ARIUniqueIdentifier constructs RFC draft ARI unique identifiers from certificate AuthorityKeyId and SerialNumber","acme.RenewalInfo provides window validation with HasWindow and SameWindow comparisons","acme.Problem formats RFC 7807 problem details with HTTP status and detail text"],"goal":"verify pkg:golang/github.com/mholt/acmez/v3@v3.1.6","kind":"HOW","packages":["pkg:golang/github.com/mholt/acmez/v3@v3.1.6"],"schemaVersion":1},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/github.com/mholt/acmez/v3@v3.1.6"],"schemaVersion":1,"subject":"pkg:golang/github.com/mholt/acmez/v3@v3.1.6","verifierAdapter":"golang@1"}

module sample-acmez

go 1.24.0

require github.com/mholt/acmez/v3 v3.1.6

require (
	golang.org/x/crypto v0.48.0 // indirect
	golang.org/x/net v0.50.0 // indirect
	golang.org/x/text v0.34.0 // indirect
)

code.pfad.fr/check v1.1.0 h1:GWvjdzhSEgHvEHe2uJujDcpmZoySKuHQNrZMfzfO0bE=
code.pfad.fr/check v1.1.0/go.mod h1:NiUH13DtYsb7xp5wll0U4SXx7KhXQVCtRgdC96IPfoM=
github.com/go-jose/go-jose/v4 v4.1.3 h1:CVLmWDhDVRa6Mi/IgCgaopNosCaHz7zrMeF9MlZRkrs=
github.com/go-jose/go-jose/v4 v4.1.3/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
github.com/letsencrypt/challtestsrv v1.4.2 h1:0ON3ldMhZyWlfVNYYpFuWRTmZNnyfiL9Hh5YzC3JVwU=
github.com/letsencrypt/challtestsrv v1.4.2/go.mod h1:GhqMqcSoeGpYd5zX5TgwA6er/1MbWzx/o7yuuVya+Wk=
github.com/letsencrypt/pebble/v2 v2.10.0 h1:Wq6gYXlsY6ubqI3hhxsTzdyotvfdjFBxuwYqCLCnj/U=
github.com/letsencrypt/pebble/v2 v2.10.0/go.mod h1:Sk8cmUIPcIdv2nINo+9PB4L+ZBhzY+F9A1a/h/xmWiQ=
github.com/mholt/acmez/v3 v3.1.6 h1:eGVQNObP0pBN4sxqrXeg7MYqTOWyoiYpQqITVWlrevk=
github.com/mholt/acmez/v3 v3.1.6/go.mod h1:5nTPosTGosLxF3+LU4ygbgMRFDhbAVpqMI4+a4aHLBY=
github.com/miekg/dns v1.1.72 h1:vhmr+TF2A3tuoGNkLDFK9zi36F2LS+hKTRW0Uf8kbzI=
github.com/miekg/dns v1.1.72/go.mod h1:+EuEPhdHOsfk6Wk5TT2CzssZdqkmFhf8r+aVyDEToIs=
golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=
golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos=
golang.org/x/mod v0.33.0 h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8=
golang.org/x/mod v0.33.0/go.mod h1:swjeQEj+6r7fODbD2cqrnje9PnziFuw4bmLbBZFrQ5w=
golang.org/x/net v0.50.0 h1:ucWh9eiCGyDR3vtzso0WMQinm2Dnt8cFMuQa9K33J60=
golang.org/x/net v0.50.0/go.mod h1:UgoSli3F/pBgdJBHCTc+tp3gmrU4XswgGRgtnwWTfyM=
golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k=
golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=
golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=
golang.org/x/tools v0.42.0 h1:uNgphsn75Tdz5Ji2q36v/nsFSfR/9BRFvqhGBaJGd5k=
golang.org/x/tools v0.42.0/go.mod h1:Ma6lCIwGZvHK6XtgbswSoWroEkhugApmsXyrUmBhfr0=

package main

import (
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"fmt"

	"github.com/mholt/acmez/v3"
	"github.com/mholt/acmez/v3/acme"
)

func main() {
	privKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		fmt.Printf("failed to generate key: %v\n", err)
		return
	}

	csr, err := acmez.NewCSR(privKey, []string{"example.com", "192.0.2.1"})
	if err != nil {
		fmt.Printf("failed to create CSR: %v\n", err)
		return
	}

	account := acme.Account{
		PrivateKey: privKey,
		Location:   "https://example.com/acme/acct/1",
		Status:     acme.StatusValid,
	}

	params, err := acmez.OrderParametersFromCSR(account, csr)
	if err != nil {
		fmt.Printf("failed to derive order params: %v\n", err)
		return
	}

	fmt.Printf("Order identifiers: %d\n", len(params.Identifiers))
}

{
  "schemaVersion": 1,
  "goal": "verify pkg:golang/github.com/mholt/acmez/v3@v3.1.6",
  "kind": "HOW",
  "packages": [
    "pkg:golang/github.com/mholt/acmez/v3@v3.1.6"
  ],
  "constraints": {
    "executionContext": "node"
  },
  "runtimeConditions": {
    "ecosystem": "npm",
    "language": "javascript",
    "moduleSystem": "cjs",
    "packageManager": "npm@10.9.8",
    "runtime": "node@22.23.2"
  }
}

package main

import (
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"crypto/x509"
	"crypto/x509/pkix"
	"encoding/asn1"
	"encoding/base64"
	"fmt"
	"math/big"
	"os"
	"strings"
	"time"

	"github.com/mholt/acmez/v3"
	"github.com/mholt/acmez/v3/acme"
)

func main() {
	// Assertion 1: acmez.NewCSR creates a signed x509 CertificateRequest from subject alternative names including DNS, IP, and email addresses
	privKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: key generation error: %v\n", err)
		os.Exit(1)
	}

	sans := []string{"example.com", "sub.example.com", "192.0.2.1", "admin@example.com"}
	csr, err := acmez.NewCSR(privKey, sans)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: NewCSR failed: %v\n", err)
		os.Exit(1)
	}
	if len(csr.DNSNames) != 2 || csr.DNSNames[0] != "example.com" || csr.DNSNames[1] != "sub.example.com" {
		fmt.Fprintf(os.Stderr, "FAIL: DNSNames mismatch: %v\n", csr.DNSNames)
		os.Exit(1)
	}
	if len(csr.IPAddresses) != 1 || csr.IPAddresses[0].String() != "192.0.2.1" {
		fmt.Fprintf(os.Stderr, "FAIL: IPAddresses mismatch: %v\n", csr.IPAddresses)
		os.Exit(1)
	}
	if len(csr.EmailAddresses) != 1 || csr.EmailAddresses[0] != "admin@example.com" {
		fmt.Fprintf(os.Stderr, "FAIL: EmailAddresses mismatch: %v\n", csr.EmailAddresses)
		os.Exit(1)
	}
	if err := csr.CheckSignature(); err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: CSR CheckSignature failed: %v\n", err)
		os.Exit(1)
	}

	// Assertion 2: acmez.OrderParametersFromCSR maps CertificateRequest SANs into matching ACME Identifiers with DNS and IP types
	account := acme.Account{
		PrivateKey: privKey,
		Location:   "https://example.com/acme/acct/1",
		Status:     acme.StatusValid,
	}
	orderParams, err := acmez.OrderParametersFromCSR(account, csr)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: OrderParametersFromCSR failed: %v\n", err)
		os.Exit(1)
	}
	if len(orderParams.Identifiers) != 4 {
		fmt.Fprintf(os.Stderr, "FAIL: expected 4 identifiers, got %d\n", len(orderParams.Identifiers))
		os.Exit(1)
	}
	if orderParams.Identifiers[0].Type != "dns" || orderParams.Identifiers[0].Value != "example.com" {
		fmt.Fprintf(os.Stderr, "FAIL: identifier[0] mismatch: %+v\n", orderParams.Identifiers[0])
		os.Exit(1)
	}
	if orderParams.Identifiers[2].Type != "ip" || orderParams.Identifiers[2].Value != "192.0.2.1" {
		fmt.Fprintf(os.Stderr, "FAIL: identifier[2] mismatch: %+v\n", orderParams.Identifiers[2])
		os.Exit(1)
	}

	// Assertion 3: acmez.StaticCSR wraps a pre-constructed CertificateRequest as a CSRSource interface
	staticSource := acmez.StaticCSR(csr)
	returnedCSR, err := staticSource.CSR(nil, orderParams.Identifiers)
	if err != nil || returnedCSR != csr {
		fmt.Fprintf(os.Stderr, "FAIL: StaticCSR mismatch or error: %v\n", err)
		os.Exit(1)
	}

	// Assertion 4: acmez.TLSALPN01ChallengeCert creates a self-signed TLS certificate with critical id-pe-acmeIdentifier extension for TLS-ALPN-01 challenges
	chal := acme.Challenge{
		Type:             acme.ChallengeTypeTLSALPN01,
		Token:            "test-token-12345",
		KeyAuthorization: "test-token-12345.thumbprint-abcde",
		Identifier: acme.Identifier{
			Type:  "dns",
			Value: "example.com",
		},
	}
	tlsCert, err := acmez.TLSALPN01ChallengeCert(chal)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: TLSALPN01ChallengeCert failed: %v\n", err)
		os.Exit(1)
	}
	if len(tlsCert.Certificate) == 0 {
		fmt.Fprintf(os.Stderr, "FAIL: TLSALPN01ChallengeCert empty certificate\n")
		os.Exit(1)
	}
	parsedCert, err := x509.ParseCertificate(tlsCert.Certificate[0])
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: ParseCertificate failed: %v\n", err)
		os.Exit(1)
	}
	var foundOID bool
	for _, ext := range parsedCert.Extensions {
		if ext.Id.Equal(asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 1, 31}) {
			foundOID = true
			if !ext.Critical {
				fmt.Fprintf(os.Stderr, "FAIL: id-pe-acmeIdentifier extension must be critical\n")
				os.Exit(1)
			}
			break
		}
	}
	if !foundOID {
		fmt.Fprintf(os.Stderr, "FAIL: id-pe-acmeIdentifier extension not found\n")
		os.Exit(1)
	}

	// Assertion 5: acme.Challenge computes standard HTTP-01 resource paths and DNS-01 TXT record names and digest authorization
	httpChal := acme.Challenge{
		Type:             acme.ChallengeTypeHTTP01,
		Token:            "token_xyz",
		KeyAuthorization: "token_xyz.thumbprint123",
	}
	if httpChal.HTTP01ResourcePath() != "/.well-known/acme-challenge/token_xyz" {
		fmt.Fprintf(os.Stderr, "FAIL: HTTP01ResourcePath mismatch: %s\n", httpChal.HTTP01ResourcePath())
		os.Exit(1)
	}

	dnsChal := acme.Challenge{
		Type:             acme.ChallengeTypeDNS01,
		Token:            "token_dns",
		KeyAuthorization: "token_dns.thumbprint456",
		Identifier: acme.Identifier{
			Type:  "dns",
			Value: "sub.example.com",
		},
	}
	if dnsChal.DNS01TXTRecordName() != "_acme-challenge.sub.example.com" {
		fmt.Fprintf(os.Stderr, "FAIL: DNS01TXTRecordName mismatch: %s\n", dnsChal.DNS01TXTRecordName())
		os.Exit(1)
	}
	if len(dnsChal.DNS01KeyAuthorization()) == 0 {
		fmt.Fprintf(os.Stderr, "FAIL: DNS01KeyAuthorization is empty\n")
		os.Exit(1)
	}

	// Assertion 6: acmez.MailReplyChallengeResponse formats RFC 8823 email-reply-00 challenge response email body with headers and key authorization
	tokenPart1 := []byte("mail-part1-sample-token")
	tokenPart2 := []byte("mail-part2-sample-token")
	encodedPart1 := base64.RawURLEncoding.EncodeToString(tokenPart1)
	encodedPart2 := base64.RawURLEncoding.EncodeToString(tokenPart2)
	emailChal := acme.Challenge{
		Type:             acme.ChallengeTypeEmailReply00,
		Token:            encodedPart2,
		KeyAuthorization: encodedPart2 + ".test-thumbprint-9876",
		Identifier: acme.Identifier{
			Type:  "email",
			Value: "user@example.com",
		},
		From: "ca@example.com",
	}
	mailResp, err := acmez.MailReplyChallengeResponse(emailChal, "ACME: "+encodedPart1, "<msg-001@example.com>", "")
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: MailReplyChallengeResponse failed: %v\n", err)
		os.Exit(1)
	}
	if !strings.Contains(mailResp, "To: ca@example.com") ||
		!strings.Contains(mailResp, "From: user@example.com") ||
		!strings.Contains(mailResp, "-----BEGIN ACME RESPONSE-----") {
		fmt.Fprintf(os.Stderr, "FAIL: MailReplyChallengeResponse invalid body: %s\n", mailResp)
		os.Exit(1)
	}

	// Assertion 7: acme.ARIUniqueIdentifier constructs RFC draft ARI unique identifiers from certificate AuthorityKeyId and SerialNumber
	templateCert := &x509.Certificate{
		SerialNumber:   big.NewInt(1337),
		Subject:        pkix.Name{CommonName: "example.com"},
		NotBefore:      time.Now().Add(-1 * time.Hour),
		NotAfter:       time.Now().Add(24 * time.Hour),
		AuthorityKeyId: []byte{0x01, 0x02, 0x03, 0x04},
	}
	certDER, err := x509.CreateCertificate(rand.Reader, templateCert, templateCert, &privKey.PublicKey, privKey)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: CreateCertificate failed: %v\n", err)
		os.Exit(1)
	}
	leafCert, err := x509.ParseCertificate(certDER)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: ParseCertificate leaf failed: %v\n", err)
		os.Exit(1)
	}
	ariID, err := acme.ARIUniqueIdentifier(leafCert)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: ARIUniqueIdentifier failed: %v\n", err)
		os.Exit(1)
	}
	if !strings.Contains(ariID, ".") {
		fmt.Fprintf(os.Stderr, "FAIL: ARI identifier must contain period: %s\n", ariID)
		os.Exit(1)
	}

	// Assertion 8: acme.RenewalInfo provides window validation with HasWindow and SameWindow comparisons
	now := time.Now().Truncate(time.Second)
	ari := acme.RenewalInfo{}
	if ari.HasWindow() {
		fmt.Fprintf(os.Stderr, "FAIL: empty RenewalInfo should not have window\n")
		os.Exit(1)
	}
	ari.SuggestedWindow.Start = now
	ari.SuggestedWindow.End = now.Add(30 * 24 * time.Hour)
	if !ari.HasWindow() {
		fmt.Fprintf(os.Stderr, "FAIL: populated RenewalInfo should have window\n")
		os.Exit(1)
	}
	otherAri := ari
	if !ari.SameWindow(otherAri) {
		fmt.Fprintf(os.Stderr, "FAIL: identical RenewalInfo should match SameWindow\n")
		os.Exit(1)
	}

	// Assertion 9: acme.Problem formats RFC 7807 problem details with HTTP status and detail text
	prob := acme.Problem{
		Type:   "urn:ietf:params:acme:error:unauthorized",
		Status: 403,
		Detail: "Account is not authorized",
	}
	errStr := prob.Error()
	if !strings.Contains(errStr, "403") || !strings.Contains(errStr, "unauthorized") || !strings.Contains(errStr, "Account is not authorized") {
		fmt.Fprintf(os.Stderr, "FAIL: Problem.Error() format unexpected: %s\n", errStr)
		os.Exit(1)
	}

	fmt.Println("PASS: pkg:golang/github.com/mholt/acmez/v3@v3.1.6 contract passed")
}