github.com/slackhq/nebula v1.11.1: cert.TBSCertificate, cert.TBSCertificate.Sign, cert.Certificate

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify pkg:golang/github.com/slackhq/nebula@v1.11.1
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/github.com/slackhq/nebula@v1.11.1

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:b089702b8da67476e6a4ddf04fa17b3724c1902a8eca93606edd5538b84a58e3","contract":["TBSCertificate.Sign creates and signs a root CA certificate when signer is nil","Certificate.VerifyPrivateKey validates CA Ed25519 private key matches public key","Certificate.MarshalPEM exports signed certificate to PEM format","NewCAPoolFromPEM initializes a trusted CA pool from PEM certificate bytes","TBSCertificate.Sign creates and signs a host certificate with the CA certificate","UnmarshalCertificateFromPEM parses a PEM encoded Nebula certificate","Certificate.VerifyPrivateKey validates host X25519 private key matches public key","CAPool.VerifyCertificate validates a host certificate against trusted CA pool","Certificate.Expired evaluates certificate validity outside NotBefore / NotAfter","CheckCAConstraints and TBSCertificate.Sign reject child certificates violating CA network bounds","CAPool.BlocklistFingerprint causes VerifyCertificate to reject blocklisted certificates"],"goal":"verify pkg:golang/github.com/slackhq/nebula@v1.11.1","kind":"HOW","packages":["pkg:golang/github.com/slackhq/nebula@v1.11.1"],"schemaVersion":1,"symbols":["github.com/slackhq/nebula/cert.TBSCertificate","github.com/slackhq/nebula/cert.TBSCertificate.Sign","github.com/slackhq/nebula/cert.Certificate","github.com/slackhq/nebula/cert.Certificate.MarshalPEM","github.com/slackhq/nebula/cert.UnmarshalCertificateFromPEM","github.com/slackhq/nebula/cert.Certificate.VerifyPrivateKey","github.com/slackhq/nebula/cert.CAPool","github.com/slackhq/nebula/cert.NewCAPoolFromPEM","github.com/slackhq/nebula/cert.CAPool.VerifyCertificate","github.com/slackhq/nebula/cert.CAPool.BlocklistFingerprint","github.com/slackhq/nebula/cert.Certificate.Expired","github.com/slackhq/nebula/cert.CheckCAConstraints"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/github.com/slackhq/nebula@v1.11.1"],"schemaVersion":1,"subject":"pkg:golang/github.com/slackhq/nebula@v1.11.1","symbols":["github.com/slackhq/nebula/cert.TBSCertificate","github.com/slackhq/nebula/cert.TBSCertificate.Sign","github.com/slackhq/nebula/cert.Certificate","github.com/slackhq/nebula/cert.Certificate.MarshalPEM","github.com/slackhq/nebula/cert.UnmarshalCertificateFromPEM","github.com/slackhq/nebula/cert.Certificate.VerifyPrivateKey","github.com/slackhq/nebula/cert.CAPool","github.com/slackhq/nebula/cert.NewCAPoolFromPEM","github.com/slackhq/nebula/cert.CAPool.VerifyCertificate","github.com/slackhq/nebula/cert.CAPool.BlocklistFingerprint","github.com/slackhq/nebula/cert.Certificate.Expired","github.com/slackhq/nebula/cert.CheckCAConstraints"],"verifierAdapter":"golang@1"}

module sample

go 1.26.6

require (
	github.com/slackhq/nebula v1.11.1
	golang.org/x/crypto v0.54.0
)

require (
	filippo.io/bigmod v0.1.0 // indirect
	golang.org/x/sys v0.47.0 // indirect
	google.golang.org/protobuf v1.36.11 // indirect
)

filippo.io/bigmod v0.1.0 h1:UNzDk7y9ADKST+axd9skUpBQeW7fG2KrTZyOE4uGQy8=
filippo.io/bigmod v0.1.0/go.mod h1:OjOXDNlClLblvXdwgFFOQFJEocLhhtai8vGLy0JCZlI=
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
github.com/slackhq/nebula v1.11.1 h1:+rGehGQErPk7+Fz4bi83ys2fIfZ9voEUVz4sa/ZuZ+g=
github.com/slackhq/nebula v1.11.1/go.mod h1:bb/x63VYmvohK/7DKJrTYxM/ynmrOzR7E4sR0oSXiMc=
github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

{
  "schemaVersion": 1,
  "goal": "verify pkg:golang/github.com/slackhq/nebula@v1.11.1",
  "kind": "HOW",
  "packages": [
    "pkg:golang/github.com/slackhq/nebula@v1.11.1"
  ]
}

package main

import (
	"crypto/ed25519"
	"crypto/rand"
	"fmt"
	"io"
	"net/netip"
	"os"
	"time"

	"github.com/slackhq/nebula/cert"
	"golang.org/x/crypto/curve25519"
)

func main() {
	now := time.Now()

	// 1. Generate Ed25519 keypair for CA
	caPub, caPriv, err := ed25519.GenerateKey(rand.Reader)
	if err != nil {
		fmt.Fprintf(os.Stderr, "failed to generate CA key: %v\n", err)
		os.Exit(1)
	}

	// 2. TBSCertificate.Sign creates and signs a root CA certificate when signer is nil
	caTbs := &cert.TBSCertificate{
		Version:   cert.Version2,
		Name:      "ca.example.com",
		IsCA:      true,
		NotBefore: now.Add(-1 * time.Hour),
		NotAfter:  now.Add(24 * time.Hour),
		PublicKey: caPub,
		Curve:     cert.Curve_CURVE25519,
		Networks:  []netip.Prefix{netip.MustParsePrefix("10.100.0.0/16")},
		Groups:    []string{"default", "web"},
	}

	caCert, err := caTbs.Sign(nil, cert.Curve_CURVE25519, caPriv)
	if err != nil {
		fmt.Fprintf(os.Stderr, "caTbs.Sign failed: %v\n", err)
		os.Exit(1)
	}

	// 3. Certificate.VerifyPrivateKey validates CA Ed25519 private key matches public key
	if err := caCert.VerifyPrivateKey(cert.Curve_CURVE25519, caPriv); err != nil {
		fmt.Fprintf(os.Stderr, "caCert.VerifyPrivateKey failed: %v\n", err)
		os.Exit(1)
	}

	// 4. Certificate.MarshalPEM exports signed certificate to PEM format
	caPem, err := caCert.MarshalPEM()
	if err != nil {
		fmt.Fprintf(os.Stderr, "caCert.MarshalPEM failed: %v\n", err)
		os.Exit(1)
	}
	if len(caPem) == 0 {
		fmt.Fprintf(os.Stderr, "caCert.MarshalPEM returned empty bytes\n")
		os.Exit(1)
	}

	// 5. NewCAPoolFromPEM initializes a trusted CA pool from PEM certificate bytes
	caPool, err := cert.NewCAPoolFromPEM(caPem)
	if err != nil {
		fmt.Fprintf(os.Stderr, "NewCAPoolFromPEM failed: %v\n", err)
		os.Exit(1)
	}

	// 6. Generate X25519 keypair for host node
	nodePriv := make([]byte, 32)
	if _, err := io.ReadFull(rand.Reader, nodePriv); err != nil {
		fmt.Fprintf(os.Stderr, "failed to generate node private key: %v\n", err)
		os.Exit(1)
	}
	nodePub, err := curve25519.X25519(nodePriv, curve25519.Basepoint)
	if err != nil {
		fmt.Fprintf(os.Stderr, "failed to derive node public key: %v\n", err)
		os.Exit(1)
	}

	// 7. TBSCertificate.Sign creates and signs a host certificate with the CA certificate
	nodeTbs := &cert.TBSCertificate{
		Version:   cert.Version2,
		Name:      "node1.example.com",
		IsCA:      false,
		NotBefore: now.Add(-1 * time.Hour),
		NotAfter:  now.Add(24 * time.Hour),
		PublicKey: nodePub,
		Curve:     cert.Curve_CURVE25519,
		Networks:  []netip.Prefix{netip.MustParsePrefix("10.100.0.1/32")},
		Groups:    []string{"web"},
	}

	nodeCert, err := nodeTbs.Sign(caCert, cert.Curve_CURVE25519, caPriv)
	if err != nil {
		fmt.Fprintf(os.Stderr, "nodeTbs.Sign failed: %v\n", err)
		os.Exit(1)
	}

	// 8. UnmarshalCertificateFromPEM parses a PEM encoded Nebula certificate
	nodePem, err := nodeCert.MarshalPEM()
	if err != nil {
		fmt.Fprintf(os.Stderr, "nodeCert.MarshalPEM failed: %v\n", err)
		os.Exit(1)
	}

	parsedCert, _, err := cert.UnmarshalCertificateFromPEM(nodePem)
	if err != nil {
		fmt.Fprintf(os.Stderr, "UnmarshalCertificateFromPEM failed: %v\n", err)
		os.Exit(1)
	}
	if parsedCert.Name() != "node1.example.com" {
		fmt.Fprintf(os.Stderr, "parsed cert name mismatch: %q\n", parsedCert.Name())
		os.Exit(1)
	}

	// 9. Certificate.VerifyPrivateKey validates host X25519 private key matches public key
	if err := parsedCert.VerifyPrivateKey(cert.Curve_CURVE25519, nodePriv); err != nil {
		fmt.Fprintf(os.Stderr, "parsedCert.VerifyPrivateKey failed: %v\n", err)
		os.Exit(1)
	}

	// 10. CAPool.VerifyCertificate validates a host certificate against trusted CA pool
	cachedCert, err := caPool.VerifyCertificate(now, parsedCert)
	if err != nil || cachedCert == nil {
		fmt.Fprintf(os.Stderr, "caPool.VerifyCertificate failed: %v\n", err)
		os.Exit(1)
	}

	// 11. Certificate.Expired evaluates certificate validity outside NotBefore / NotAfter
	if !parsedCert.Expired(now.Add(48 * time.Hour)) {
		fmt.Fprintf(os.Stderr, "expected certificate to be expired in future\n")
		os.Exit(1)
	}
	if _, err := caPool.VerifyCertificate(now.Add(48*time.Hour), parsedCert); err == nil {
		fmt.Fprintf(os.Stderr, "expected VerifyCertificate to fail for expired certificate\n")
		os.Exit(1)
	}

	// 12. CheckCAConstraints and TBSCertificate.Sign reject child certificates violating CA network bounds
	invalidTbs := &cert.TBSCertificate{
		Version:   cert.Version2,
		Name:      "invalid.example.com",
		IsCA:      false,
		NotBefore: now.Add(-1 * time.Hour),
		NotAfter:  now.Add(24 * time.Hour),
		PublicKey: nodePub,
		Curve:     cert.Curve_CURVE25519,
		Networks:  []netip.Prefix{netip.MustParsePrefix("192.168.1.1/32")}, // not in CA's 10.100.0.0/16
		Groups:    []string{"web"},
	}
	if _, err := invalidTbs.Sign(caCert, cert.Curve_CURVE25519, caPriv); err == nil {
		fmt.Fprintf(os.Stderr, "expected Sign to fail for certificate violating CA network constraints\n")
		os.Exit(1)
	}

	// 13. CAPool.BlocklistFingerprint causes VerifyCertificate to reject blocklisted certificates
	nodeFp, err := parsedCert.Fingerprint()
	if err != nil {
		fmt.Fprintf(os.Stderr, "parsedCert.Fingerprint failed: %v\n", err)
		os.Exit(1)
	}
	caPool.BlocklistFingerprint(nodeFp)
	if _, err := caPool.VerifyCertificate(now, parsedCert); err == nil {
		fmt.Fprintf(os.Stderr, "expected VerifyCertificate to fail for blocklisted fingerprint\n")
		os.Exit(1)
	}

	fmt.Println("All nebula certificate contract assertions passed.")
}