github.com/slackhq/nebula v1.11.1: cert.NebulaCertificate, cert.TBSCertificate, cert.TBSCertificate.Sign

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify github.com/slackhq/nebula/cert.NebulaCertificate in pkg:golang/github.com/slackhq/nebula@v1.11.1
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/github.com/slackhq/nebula@v1.11.1
Demonstrate these symbols/APIs:
  - github.com/slackhq/nebula/cert.NebulaCertificate

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:70e82994814e7af3df867a0887b00dd9e55982835904b73cd2d8e906778399db","contract":["TBSCertificate.Sign signs CA certificate details with an Ed25519 private key","Certificate.MarshalPEM exports a signed certificate to PEM format","NewCAPoolFromPEM initializes a CA pool from PEM certificate bytes","TBSCertificate.Sign signs host certificate details using CA certificate and private key","Certificate.VerifyPrivateKey verifies the private key corresponds to the certificate public key","UnmarshalCertificateFromPEM parses a PEM encoded Nebula certificate","CAPool.VerifyCertificate validates a certificate against a trusted CA pool","Certificate.Expired returns true when evaluated outside validity dates","CAPool.BlocklistFingerprint causes VerifyCertificate to reject blocklisted certificates"],"goal":"verify github.com/slackhq/nebula/cert.NebulaCertificate in pkg:golang/github.com/slackhq/nebula@v1.11.1","kind":"HOW","packages":["pkg:golang/github.com/slackhq/nebula@v1.11.1"],"schemaVersion":1,"symbols":["github.com/slackhq/nebula/cert.NebulaCertificate","github.com/slackhq/nebula/cert.TBSCertificate","github.com/slackhq/nebula/cert.TBSCertificate.Sign","github.com/slackhq/nebula/cert.Certificate","github.com/slackhq/nebula/cert.Certificate.MarshalPEM","github.com/slackhq/nebula/cert.Certificate.VerifyPrivateKey","github.com/slackhq/nebula/cert.UnmarshalCertificateFromPEM","github.com/slackhq/nebula/cert.NewCAPoolFromPEM","github.com/slackhq/nebula/cert.CAPool.VerifyCertificate","github.com/slackhq/nebula/cert.Certificate.Expired","github.com/slackhq/nebula/cert.CAPool.BlocklistFingerprint"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/github.com/slackhq/nebula@v1.11.1"],"schemaVersion":1,"subject":"pkg:golang/github.com/slackhq/nebula@v1.11.1","symbols":["github.com/slackhq/nebula/cert.NebulaCertificate","github.com/slackhq/nebula/cert.TBSCertificate","github.com/slackhq/nebula/cert.TBSCertificate.Sign","github.com/slackhq/nebula/cert.Certificate","github.com/slackhq/nebula/cert.Certificate.MarshalPEM","github.com/slackhq/nebula/cert.Certificate.VerifyPrivateKey","github.com/slackhq/nebula/cert.UnmarshalCertificateFromPEM","github.com/slackhq/nebula/cert.NewCAPoolFromPEM","github.com/slackhq/nebula/cert.CAPool.VerifyCertificate","github.com/slackhq/nebula/cert.Certificate.Expired","github.com/slackhq/nebula/cert.CAPool.BlocklistFingerprint"],"verifierAdapter":"golang@1"}

module example.com/sample

go 1.26.6

require github.com/slackhq/nebula v1.11.1

require (
	filippo.io/bigmod v0.1.0 // indirect
	golang.org/x/crypto v0.54.0 // indirect
	golang.org/x/sys v0.47.0 // indirect
	google.golang.org/protobuf v1.36.11 // indirect
)

filippo.io/bigmod v0.1.0 h1:UNzDk7y9ADKST+axd9skUpBQeW7fG2KrTZyOE4uGQy8=
filippo.io/bigmod v0.1.0/go.mod h1:OjOXDNlClLblvXdwgFFOQFJEocLhhtai8vGLy0JCZlI=
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
github.com/slackhq/nebula v1.11.1 h1:+rGehGQErPk7+Fz4bi83ys2fIfZ9voEUVz4sa/ZuZ+g=
github.com/slackhq/nebula v1.11.1/go.mod h1:bb/x63VYmvohK/7DKJrTYxM/ynmrOzR7E4sR0oSXiMc=
github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

package main

import (
	"crypto/ecdh"
	"crypto/ed25519"
	"crypto/rand"
	"fmt"
	"log"
	"net/netip"
	"time"

	"github.com/slackhq/nebula/cert"
)

func main() {
	// 1. Generate CA keypair (Ed25519 for signing)
	caPub, caPriv, err := ed25519.GenerateKey(rand.Reader)
	if err != nil {
		log.Fatalf("failed to generate CA keypair: %v", err)
	}

	now := time.Now()
	tbsCA := &cert.TBSCertificate{
		Version:   cert.Version2,
		Name:      "root-ca",
		NotBefore: now.Add(-1 * time.Hour),
		NotAfter:  now.Add(24 * time.Hour),
		PublicKey: caPub,
		IsCA:      true,
		Curve:     cert.Curve_CURVE25519,
	}

	caCert, err := tbsCA.Sign(nil, cert.Curve_CURVE25519, caPriv)
	if err != nil {
		log.Fatalf("failed to sign CA certificate: %v", err)
	}

	caPem, err := caCert.MarshalPEM()
	if err != nil {
		log.Fatalf("failed to marshal CA certificate to PEM: %v", err)
	}

	caPool, err := cert.NewCAPoolFromPEM(caPem)
	if err != nil {
		log.Fatalf("failed to create CA pool: %v", err)
	}

	// 2. Generate node keypair (X25519 for mesh node)
	nodePrivKey, err := ecdh.X25519().GenerateKey(rand.Reader)
	if err != nil {
		log.Fatalf("failed to generate node keypair: %v", err)
	}

	ipNet, err := netip.ParsePrefix("192.168.100.10/24")
	if err != nil {
		log.Fatalf("failed to parse IP prefix: %v", err)
	}

	tbsNode := &cert.TBSCertificate{
		Version:   cert.Version2,
		Name:      "node-1",
		Networks:  []netip.Prefix{ipNet},
		Groups:    []string{"servers", "prod"},
		NotBefore: now.Add(-1 * time.Hour),
		NotAfter:  now.Add(24 * time.Hour),
		PublicKey: nodePrivKey.PublicKey().Bytes(),
		IsCA:      false,
		Curve:     cert.Curve_CURVE25519,
	}

	nodeCert, err := tbsNode.Sign(caCert, cert.Curve_CURVE25519, caPriv)
	if err != nil {
		log.Fatalf("failed to sign node certificate: %v", err)
	}

	nodePem, err := nodeCert.MarshalPEM()
	if err != nil {
		log.Fatalf("failed to marshal node certificate to PEM: %v", err)
	}

	parsedCert, _, err := cert.UnmarshalCertificateFromPEM(nodePem)
	if err != nil {
		log.Fatalf("failed to unmarshal node certificate: %v", err)
	}

	cached, err := caPool.VerifyCertificate(now, parsedCert)
	if err != nil || cached == nil {
		log.Fatalf("node certificate verification failed: cached=%v, err=%v", cached, err)
	}

	fmt.Println("Successfully created and verified Nebula CA and node certificates.")
}

{
  "schemaVersion": 1,
  "goal": "verify github.com/slackhq/nebula/cert.NebulaCertificate in pkg:golang/github.com/slackhq/nebula@v1.11.1",
  "kind": "HOW",
  "packages": [
    "pkg:golang/github.com/slackhq/nebula@v1.11.1"
  ],
  "symbols": [
    "github.com/slackhq/nebula/cert.NebulaCertificate"
  ]
}

package main

import (
	"crypto/ecdh"
	"crypto/ed25519"
	"crypto/rand"
	"fmt"
	"net/netip"
	"os"
	"time"

	"github.com/slackhq/nebula/cert"
)

func main() {
	// 1. TBSCertificate.Sign signs CA certificate details with an Ed25519 private key
	caPub, caPriv, err := ed25519.GenerateKey(rand.Reader)
	if err != nil {
		fmt.Fprintf(os.Stderr, "failed to generate CA key: %v\n", err)
		os.Exit(1)
	}

	now := time.Now()
	tbsCA := &cert.TBSCertificate{
		Version:   cert.Version2,
		Name:      "ca.example.com",
		NotBefore: now.Add(-1 * time.Hour),
		NotAfter:  now.Add(24 * time.Hour),
		PublicKey: caPub,
		IsCA:      true,
		Curve:     cert.Curve_CURVE25519,
	}

	caCert, err := tbsCA.Sign(nil, cert.Curve_CURVE25519, caPriv)
	if err != nil {
		fmt.Fprintf(os.Stderr, "tbsCA.Sign failed: %v\n", err)
		os.Exit(1)
	}
	if !caCert.IsCA() {
		fmt.Fprintf(os.Stderr, "expected caCert.IsCA() to be true\n")
		os.Exit(1)
	}

	// 2. Certificate.MarshalPEM exports a signed certificate to PEM format
	caPem, err := caCert.MarshalPEM()
	if err != nil {
		fmt.Fprintf(os.Stderr, "caCert.MarshalPEM failed: %v\n", err)
		os.Exit(1)
	}
	if len(caPem) == 0 {
		fmt.Fprintf(os.Stderr, "caCert.MarshalPEM returned empty bytes\n")
		os.Exit(1)
	}

	// 3. NewCAPoolFromPEM initializes a CA pool from PEM certificate bytes
	caPool, err := cert.NewCAPoolFromPEM(caPem)
	if err != nil {
		fmt.Fprintf(os.Stderr, "NewCAPoolFromPEM failed: %v\n", err)
		os.Exit(1)
	}

	// 4. TBSCertificate.Sign signs host certificate details using CA certificate and private key
	nodePrivKey, err := ecdh.X25519().GenerateKey(rand.Reader)
	if err != nil {
		fmt.Fprintf(os.Stderr, "failed to generate node key: %v\n", err)
		os.Exit(1)
	}
	nodePub := nodePrivKey.PublicKey().Bytes()
	nodePriv := nodePrivKey.Bytes()

	ipPrefix, err := netip.ParsePrefix("10.100.0.1/24")
	if err != nil {
		fmt.Fprintf(os.Stderr, "netip.ParsePrefix failed: %v\n", err)
		os.Exit(1)
	}

	tbsNode := &cert.TBSCertificate{
		Version:   cert.Version2,
		Name:      "node1.example.com",
		Networks:  []netip.Prefix{ipPrefix},
		Groups:    []string{"default", "web"},
		NotBefore: now.Add(-1 * time.Hour),
		NotAfter:  now.Add(24 * time.Hour),
		PublicKey: nodePub,
		IsCA:      false,
		Curve:     cert.Curve_CURVE25519,
	}

	nodeCert, err := tbsNode.Sign(caCert, cert.Curve_CURVE25519, caPriv)
	if err != nil {
		fmt.Fprintf(os.Stderr, "tbsNode.Sign failed: %v\n", err)
		os.Exit(1)
	}

	// 5. Certificate.VerifyPrivateKey verifies the private key corresponds to the certificate public key
	if err := nodeCert.VerifyPrivateKey(cert.Curve_CURVE25519, nodePriv); err != nil {
		fmt.Fprintf(os.Stderr, "nodeCert.VerifyPrivateKey failed: %v\n", err)
		os.Exit(1)
	}

	// 6. UnmarshalCertificateFromPEM parses a PEM encoded Nebula certificate
	nodePem, err := nodeCert.MarshalPEM()
	if err != nil {
		fmt.Fprintf(os.Stderr, "nodeCert.MarshalPEM failed: %v\n", err)
		os.Exit(1)
	}

	parsedCert, _, err := cert.UnmarshalCertificateFromPEM(nodePem)
	if err != nil {
		fmt.Fprintf(os.Stderr, "UnmarshalCertificateFromPEM failed: %v\n", err)
		os.Exit(1)
	}
	if parsedCert.Name() != "node1.example.com" {
		fmt.Fprintf(os.Stderr, "parsed cert name mismatch: %q\n", parsedCert.Name())
		os.Exit(1)
	}

	// 7. CAPool.VerifyCertificate validates a certificate against a trusted CA pool
	cached, err := caPool.VerifyCertificate(now, parsedCert)
	if err != nil || cached == nil {
		fmt.Fprintf(os.Stderr, "caPool.VerifyCertificate failed: cached=%v, err=%v\n", cached, err)
		os.Exit(1)
	}

	// 8. Certificate.Expired returns true when evaluated outside validity dates
	if !parsedCert.Expired(now.Add(48 * time.Hour)) {
		fmt.Fprintf(os.Stderr, "expected certificate to be expired in future\n")
		os.Exit(1)
	}
	if _, err := caPool.VerifyCertificate(now.Add(48*time.Hour), parsedCert); err == nil {
		fmt.Fprintf(os.Stderr, "expected VerifyCertificate to fail for expired certificate\n")
		os.Exit(1)
	}

	// 9. CAPool.BlocklistFingerprint causes VerifyCertificate to reject blocklisted certificates
	nodeFingerprint, err := parsedCert.Fingerprint()
	if err != nil {
		fmt.Fprintf(os.Stderr, "Fingerprint failed: %v\n", err)
		os.Exit(1)
	}
	caPool.BlocklistFingerprint(nodeFingerprint)
	if !caPool.IsBlocklisted(nodeFingerprint) {
		fmt.Fprintf(os.Stderr, "expected IsBlocklisted to return true\n")
		os.Exit(1)
	}
	if _, err := caPool.VerifyCertificate(now, parsedCert); err == nil {
		fmt.Fprintf(os.Stderr, "expected VerifyCertificate to fail for blocklisted certificate\n")
		os.Exit(1)
	}

	fmt.Println("All nebula certificate contract assertions passed.")
}