github.com/slackhq/nebula v1.11.1: cert.NebulaCertificateDetails

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify github.com/slackhq/nebula/cert.NebulaCertificateDetails in pkg:golang/github.com/slackhq/nebula@v1.11.1
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/github.com/slackhq/nebula@v1.11.1
Demonstrate these symbols/APIs:
  - github.com/slackhq/nebula/cert.NebulaCertificateDetails
Constraints:
  - executionContext: node
Required runtime conditions:
  - ecosystem: npm
  - language: javascript
  - moduleSystem: cjs
  - packageManager: npm@10.9.8
  - runtime: node@22.23.2

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:ace3c52501443db0c835be4139a37d83b26ba465ef6f0ec8ece822c7b0f53f7f","contract":["RawNebulaCertificateDetails initializes properly with certificate metadata and round-trips through protobuf serialization.","TBSCertificate configures root CA parameters and signs a self-signed CA certificate.","MarshalPEM serializes CA certificate and UnmarshalCertificateFromPEM restores certificate details.","TBSCertificate signs child node certificate under CA, recording the issuer CA fingerprint.","CheckCAConstraints verifies that child certificate details conform to CA constraints.","CheckCAConstraints and Sign reject child certificate details that violate CA groups, networks, subnets, or validity period.","Certificate.Expired evaluates validity against active timestamps, NotBefore, and NotAfter.","CAPool verifies certificates issued by trusted CAs and rejects untrusted certificates."],"goal":"verify github.com/slackhq/nebula/cert.NebulaCertificateDetails in pkg:golang/github.com/slackhq/nebula@v1.11.1","kind":"HOW","packages":["pkg:golang/github.com/slackhq/nebula@v1.11.1"],"schemaVersion":1,"symbols":["github.com/slackhq/nebula/cert.NebulaCertificateDetails"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/github.com/slackhq/nebula@v1.11.1"],"schemaVersion":1,"subject":"pkg:golang/github.com/slackhq/nebula@v1.11.1","symbols":["github.com/slackhq/nebula/cert.NebulaCertificateDetails"],"verifierAdapter":"golang@1"}

module sample

go 1.26.6

require (
	github.com/slackhq/nebula v1.11.1
	google.golang.org/protobuf v1.36.11
)

require (
	filippo.io/bigmod v0.1.0 // indirect
	golang.org/x/crypto v0.54.0 // indirect
	golang.org/x/sys v0.47.0 // indirect
)

filippo.io/bigmod v0.1.0 h1:UNzDk7y9ADKST+axd9skUpBQeW7fG2KrTZyOE4uGQy8=
filippo.io/bigmod v0.1.0/go.mod h1:OjOXDNlClLblvXdwgFFOQFJEocLhhtai8vGLy0JCZlI=
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
github.com/slackhq/nebula v1.11.1 h1:+rGehGQErPk7+Fz4bi83ys2fIfZ9voEUVz4sa/ZuZ+g=
github.com/slackhq/nebula v1.11.1/go.mod h1:bb/x63VYmvohK/7DKJrTYxM/ynmrOzR7E4sR0oSXiMc=
github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

package main

import (
	"crypto/ed25519"
	"crypto/rand"
	"fmt"
	"log"
	"net/netip"
	"time"

	"github.com/slackhq/nebula/cert"
	"google.golang.org/protobuf/proto"
)

func main() {
	now := time.Now().Truncate(time.Second)

	// 1. Demonstrate RawNebulaCertificateDetails (protobuf representation)
	rawDetails := &cert.RawNebulaCertificateDetails{
		Name:      "raw-node-01",
		Groups:    []string{"default", "web"},
		NotBefore: now.Add(-10 * time.Minute).Unix(),
		NotAfter:  now.Add(24 * time.Hour).Unix(),
		IsCA:      false,
		Curve:     cert.Curve_CURVE25519,
	}

	rawCert := &cert.RawNebulaCertificate{
		Details:   rawDetails,
		Signature: []byte("raw-test-signature"),
	}

	rawBytes, err := proto.Marshal(rawCert)
	if err != nil {
		log.Fatalf("failed to marshal raw certificate: %v", err)
	}

	var parsedRawCert cert.RawNebulaCertificate
	if err := proto.Unmarshal(rawBytes, &parsedRawCert); err != nil {
		log.Fatalf("failed to unmarshal raw certificate: %v", err)
	}
	fmt.Printf("Parsed RawNebulaCertificateDetails name: %s, groups: %v\n",
		parsedRawCert.Details.GetName(), parsedRawCert.Details.GetGroups())

	// 2. Generate CA key pair and Root CA certificate
	caPub, caPriv, err := ed25519.GenerateKey(rand.Reader)
	if err != nil {
		log.Fatalf("generate CA key error: %v", err)
	}

	caNetwork := netip.MustParsePrefix("10.100.0.0/16")
	caTBS := cert.TBSCertificate{
		Version:   cert.Version1,
		Name:      "nebula-root-ca",
		Networks:  []netip.Prefix{caNetwork},
		Groups:    []string{"default", "web", "admin"},
		NotBefore: now.Add(-1 * time.Hour),
		NotAfter:  now.Add(365 * 24 * time.Hour),
		PublicKey: caPub,
		IsCA:      true,
		Curve:     cert.Curve_CURVE25519,
	}

	caCert, err := caTBS.Sign(nil, cert.Curve_CURVE25519, caPriv)
	if err != nil {
		log.Fatalf("sign CA cert error: %v", err)
	}

	caPem, err := caCert.MarshalPEM()
	if err != nil {
		log.Fatalf("marshal CA PEM error: %v", err)
	}

	caPool, err := cert.NewCAPoolFromPEM(caPem)
	if err != nil {
		log.Fatalf("create CA pool error: %v", err)
	}

	// 3. Generate Host key pair and Host certificate signed by CA
	hostPub, _, err := ed25519.GenerateKey(rand.Reader)
	if err != nil {
		log.Fatalf("generate host key error: %v", err)
	}

	hostNetwork := netip.MustParsePrefix("10.100.1.5/24")
	hostTBS := cert.TBSCertificate{
		Version:   cert.Version1,
		Name:      "web-node-01",
		Networks:  []netip.Prefix{hostNetwork},
		Groups:    []string{"default", "web"},
		NotBefore: now.Add(-10 * time.Minute),
		NotAfter:  now.Add(30 * 24 * time.Hour),
		PublicKey: hostPub,
		IsCA:      false,
		Curve:     cert.Curve_CURVE25519,
	}

	hostCert, err := hostTBS.Sign(caCert, cert.Curve_CURVE25519, caPriv)
	if err != nil {
		log.Fatalf("sign host cert error: %v", err)
	}

	hostPem, err := hostCert.MarshalPEM()
	if err != nil {
		log.Fatalf("marshal host PEM error: %v", err)
	}

	// 4. Unmarshal and verify host certificate against CA Pool
	parsedHostCert, _, err := cert.UnmarshalCertificateFromPEM(hostPem)
	if err != nil {
		log.Fatalf("unmarshal host PEM error: %v", err)
	}

	// Check CA constraints directly
	if err := cert.CheckCAConstraints(caCert, parsedHostCert); err != nil {
		log.Fatalf("CA constraints check failed: %v", err)
	}

	// Verify with CAPool
	cachedCert, err := caPool.VerifyCertificate(now, parsedHostCert)
	if err != nil {
		log.Fatalf("host verification against CA pool failed: %v", err)
	}

	fmt.Printf("Successfully verified certificate for %s in CAPool (fingerprint: %s)\n",
		cachedCert.Certificate.Name(), cachedCert.Fingerprint)
}

{
  "schemaVersion": 1,
  "goal": "verify github.com/slackhq/nebula/cert.NebulaCertificateDetails in pkg:golang/github.com/slackhq/nebula@v1.11.1",
  "kind": "HOW",
  "packages": [
    "pkg:golang/github.com/slackhq/nebula@v1.11.1"
  ],
  "symbols": [
    "github.com/slackhq/nebula/cert.NebulaCertificateDetails"
  ]
}

package main

import (
	"bytes"
	"crypto/ed25519"
	"crypto/rand"
	"fmt"
	"net/netip"
	"os"
	"time"

	"github.com/slackhq/nebula/cert"
	"google.golang.org/protobuf/proto"
)

func main() {
	now := time.Now().Truncate(time.Second)

	// Assertion 1: RawNebulaCertificateDetails initializes with expected metadata fields and round-trips via protobuf.
	rawDetails := &cert.RawNebulaCertificateDetails{
		Name:      "test-raw-cert",
		Groups:    []string{"default", "prod", "infra"},
		NotBefore: now.Add(-1 * time.Hour).Unix(),
		NotAfter:  now.Add(24 * time.Hour).Unix(),
		PublicKey: []byte("01234567890123456789012345678901"),
		IsCA:      false,
		Curve:     cert.Curve_CURVE25519,
	}

	if rawDetails.GetName() != "test-raw-cert" || rawDetails.GetIsCA() || len(rawDetails.GetGroups()) != 3 {
		fmt.Fprintf(os.Stderr, "FAIL: rawDetails field mismatch\n")
		os.Exit(1)
	}

	rawCert := &cert.RawNebulaCertificate{
		Details:   rawDetails,
		Signature: []byte("sample-signature-bytes"),
	}

	rawProtoBytes, err := proto.Marshal(rawCert)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: proto.Marshal failed: %v\n", err)
		os.Exit(1)
	}

	var parsedRawCert cert.RawNebulaCertificate
	if err := proto.Unmarshal(rawProtoBytes, &parsedRawCert); err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: proto.Unmarshal failed: %v\n", err)
		os.Exit(1)
	}

	if parsedRawCert.Details.GetName() != "test-raw-cert" {
		fmt.Fprintf(os.Stderr, "FAIL: parsedRawCert name mismatch: got %q\n", parsedRawCert.Details.GetName())
		os.Exit(1)
	}
	if parsedRawCert.Details.GetCurve() != cert.Curve_CURVE25519 {
		fmt.Fprintf(os.Stderr, "FAIL: parsedRawCert curve mismatch\n")
		os.Exit(1)
	}

	// Assertion 2: TBSCertificate configures root CA parameters and signs a valid self-signed CA certificate.
	caPub, caPriv, err := ed25519.GenerateKey(rand.Reader)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: generate CA key failed: %v\n", err)
		os.Exit(1)
	}

	caNetwork := netip.MustParsePrefix("10.0.0.0/8")
	caTBS := cert.TBSCertificate{
		Version:        cert.Version1,
		Name:           "root-ca",
		Networks:       []netip.Prefix{caNetwork},
		UnsafeNetworks: []netip.Prefix{caNetwork},
		Groups:         []string{"default", "prod", "internal"},
		NotBefore:      now.Add(-1 * time.Hour),
		NotAfter:       now.Add(48 * time.Hour),
		PublicKey:      caPub,
		IsCA:           true,
		Curve:          cert.Curve_CURVE25519,
	}

	caCert, err := caTBS.Sign(nil, cert.Curve_CURVE25519, caPriv)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: caTBS.Sign failed: %v\n", err)
		os.Exit(1)
	}

	if caCert.Name() != "root-ca" || !caCert.IsCA() || len(caCert.Groups()) != 3 {
		fmt.Fprintf(os.Stderr, "FAIL: caCert details mismatch\n")
		os.Exit(1)
	}
	if !caCert.CheckSignature(caPub) {
		fmt.Fprintf(os.Stderr, "FAIL: caCert CheckSignature failed\n")
		os.Exit(1)
	}

	// Assertion 3: MarshalPEM serializes CA certificate and UnmarshalCertificateFromPEM restores details.
	caPem, err := caCert.MarshalPEM()
	if err != nil || len(caPem) == 0 {
		fmt.Fprintf(os.Stderr, "FAIL: caCert.MarshalPEM failed: %v\n", err)
		os.Exit(1)
	}

	parsedCACert, _, err := cert.UnmarshalCertificateFromPEM(caPem)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: UnmarshalCertificateFromPEM failed for CA: %v\n", err)
		os.Exit(1)
	}
	if parsedCACert.Name() != "root-ca" || !parsedCACert.IsCA() {
		fmt.Fprintf(os.Stderr, "FAIL: parsed CA properties mismatch\n")
		os.Exit(1)
	}

	caFingerprint, err := parsedCACert.Fingerprint()
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: CA Fingerprint failed: %v\n", err)
		os.Exit(1)
	}

	// Assertion 4: TBSCertificate signs child node certificate under CA, recording issuer fingerprint.
	nodePub, _, err := ed25519.GenerateKey(rand.Reader)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: generate node key failed: %v\n", err)
		os.Exit(1)
	}

	nodeNetwork := netip.MustParsePrefix("10.0.1.10/24")
	nodeSubnet := netip.MustParsePrefix("10.0.1.0/24")
	nodeTBS := cert.TBSCertificate{
		Version:        cert.Version1,
		Name:           "test-node",
		Networks:       []netip.Prefix{nodeNetwork},
		UnsafeNetworks: []netip.Prefix{nodeSubnet},
		Groups:         []string{"default", "prod"},
		NotBefore:      now.Add(-30 * time.Minute),
		NotAfter:       now.Add(24 * time.Hour),
		PublicKey:      nodePub,
		IsCA:           false,
		Curve:          cert.Curve_CURVE25519,
	}

	nodeCert, err := nodeTBS.Sign(caCert, cert.Curve_CURVE25519, caPriv)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: nodeTBS.Sign failed: %v\n", err)
		os.Exit(1)
	}

	nodePem, err := nodeCert.MarshalPEM()
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: nodeCert.MarshalPEM failed: %v\n", err)
		os.Exit(1)
	}

	parsedNodeCert, _, err := cert.UnmarshalCertificateFromPEM(nodePem)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: parse node PEM failed: %v\n", err)
		os.Exit(1)
	}
	if parsedNodeCert.Name() != "test-node" {
		fmt.Fprintf(os.Stderr, "FAIL: node name mismatch\n")
		os.Exit(1)
	}
	if parsedNodeCert.Issuer() != caFingerprint {
		fmt.Fprintf(os.Stderr, "FAIL: node issuer mismatch: got %q, want %q\n", parsedNodeCert.Issuer(), caFingerprint)
		os.Exit(1)
	}
	if !bytes.Equal(parsedNodeCert.PublicKey(), nodePub) {
		fmt.Fprintf(os.Stderr, "FAIL: node public key mismatch\n")
		os.Exit(1)
	}

	// Assertion 5: CheckCAConstraints verifies that child certificate details conform to CA constraints.
	if err := cert.CheckCAConstraints(parsedCACert, parsedNodeCert); err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: CheckCAConstraints failed on valid node: %v\n", err)
		os.Exit(1)
	}

	// Assertion 6: CheckCAConstraints and Sign reject child certificate details that violate CA groups, networks, subnets, or validity.
	badGroupTBS := cert.TBSCertificate{
		Version:   cert.Version1,
		Name:      "bad-group-node",
		Networks:  []netip.Prefix{nodeNetwork},
		Groups:    []string{"unauthorized-group"},
		NotBefore: now.Add(-30 * time.Minute),
		NotAfter:  now.Add(24 * time.Hour),
		PublicKey: nodePub,
		IsCA:      false,
		Curve:     cert.Curve_CURVE25519,
	}
	if _, err := badGroupTBS.Sign(caCert, cert.Curve_CURVE25519, caPriv); err == nil {
		fmt.Fprintf(os.Stderr, "FAIL: Sign should reject unauthorized group\n")
		os.Exit(1)
	}

	badNetworkTBS := cert.TBSCertificate{
		Version:   cert.Version1,
		Name:      "bad-net-node",
		Networks:  []netip.Prefix{netip.MustParsePrefix("192.168.1.10/24")},
		Groups:    []string{"default"},
		NotBefore: now.Add(-30 * time.Minute),
		NotAfter:  now.Add(24 * time.Hour),
		PublicKey: nodePub,
		IsCA:      false,
		Curve:     cert.Curve_CURVE25519,
	}
	if _, err := badNetworkTBS.Sign(caCert, cert.Curve_CURVE25519, caPriv); err == nil {
		fmt.Fprintf(os.Stderr, "FAIL: Sign should reject network outside CA scope\n")
		os.Exit(1)
	}

	badSubnetTBS := cert.TBSCertificate{
		Version:        cert.Version1,
		Name:           "bad-subnet-node",
		Networks:       []netip.Prefix{nodeNetwork},
		UnsafeNetworks: []netip.Prefix{netip.MustParsePrefix("192.168.1.0/24")},
		Groups:         []string{"default"},
		NotBefore:      now.Add(-30 * time.Minute),
		NotAfter:       now.Add(24 * time.Hour),
		PublicKey:      nodePub,
		IsCA:           false,
		Curve:          cert.Curve_CURVE25519,
	}
	if _, err := badSubnetTBS.Sign(caCert, cert.Curve_CURVE25519, caPriv); err == nil {
		fmt.Fprintf(os.Stderr, "FAIL: Sign should reject subnet outside CA scope\n")
		os.Exit(1)
	}

	badTimeTBS := cert.TBSCertificate{
		Version:   cert.Version1,
		Name:      "bad-time-node",
		Networks:  []netip.Prefix{nodeNetwork},
		Groups:    []string{"default"},
		NotBefore: now.Add(-30 * time.Minute),
		NotAfter:  now.Add(72 * time.Hour),
		PublicKey: nodePub,
		IsCA:      false,
		Curve:     cert.Curve_CURVE25519,
	}
	if _, err := badTimeTBS.Sign(caCert, cert.Curve_CURVE25519, caPriv); err == nil {
		fmt.Fprintf(os.Stderr, "FAIL: Sign should reject validity past CA expiry\n")
		os.Exit(1)
	}

	// Assertion 7: Certificate.Expired evaluates validity against NotBefore and NotAfter timestamps.
	if parsedNodeCert.Expired(now) {
		fmt.Fprintf(os.Stderr, "FAIL: node cert should not be expired at current time\n")
		os.Exit(1)
	}
	if !parsedNodeCert.Expired(now.Add(-2 * time.Hour)) {
		fmt.Fprintf(os.Stderr, "FAIL: node cert should be expired before NotBefore\n")
		os.Exit(1)
	}
	if !parsedNodeCert.Expired(now.Add(48 * time.Hour)) {
		fmt.Fprintf(os.Stderr, "FAIL: node cert should be expired after NotAfter\n")
		os.Exit(1)
	}

	// Assertion 8: CAPool verifies trusted certificates and rejects certificates from untrusted CAs.
	caPool, err := cert.NewCAPoolFromPEM(caPem)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: NewCAPoolFromPEM failed: %v\n", err)
		os.Exit(1)
	}

	cachedCert, err := caPool.VerifyCertificate(now, parsedNodeCert)
	if err != nil || cachedCert == nil {
		fmt.Fprintf(os.Stderr, "FAIL: caPool.VerifyCertificate failed: %v\n", err)
		os.Exit(1)
	}

	// Generate untrusted other CA
	otherPub, otherPriv, err := ed25519.GenerateKey(rand.Reader)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: generate other CA key failed: %v\n", err)
		os.Exit(1)
	}
	otherTBS := cert.TBSCertificate{
		Version:   cert.Version1,
		Name:      "other-ca",
		Networks:  []netip.Prefix{caNetwork},
		Groups:    []string{"default", "prod"},
		NotBefore: now.Add(-1 * time.Hour),
		NotAfter:  now.Add(48 * time.Hour),
		PublicKey: otherPub,
		IsCA:      true,
		Curve:     cert.Curve_CURVE25519,
	}
	otherCACert, err := otherTBS.Sign(nil, cert.Curve_CURVE25519, otherPriv)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: otherTBS.Sign failed: %v\n", err)
		os.Exit(1)
	}
	untrustedNodeCert, err := nodeTBS.Sign(otherCACert, cert.Curve_CURVE25519, otherPriv)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: sign untrusted node cert failed: %v\n", err)
		os.Exit(1)
	}
	if _, err := caPool.VerifyCertificate(now, untrustedNodeCert); err == nil {
		fmt.Fprintf(os.Stderr, "FAIL: caPool.VerifyCertificate should reject cert from untrusted CA\n")
		os.Exit(1)
	}

	fmt.Println("PASS: all NebulaCertificateDetails contract assertions passed.")
}