github.com/smallstep/pkcs7 v0.0.0-20231024181729-3b98ecc1ca81: Encrypt

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify github.com/smallstep/pkcs7.Encrypt in pkg:golang/github.com/smallstep/pkcs7@v0.0.0-20231024181729-3b98ecc1ca81
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/github.com/smallstep/pkcs7@v0.0.0-20231024181729-3b98ecc1ca81
Demonstrate these symbols/APIs:
  - github.com/smallstep/pkcs7.Encrypt
Constraints:
  - executionContext: node
Required runtime conditions:
  - ecosystem: npm
  - language: javascript
  - moduleSystem: cjs
  - packageManager: npm@10.9.8
  - runtime: node@22.23.2

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:e92582e718b1be0e1571537a88fa52c2348a9a6f5e28c0df4284e272c87fdd7f","contract":["pkcs7.Encrypt encrypts plaintext for a single recipient certificate which can be parsed and decrypted","pkcs7.Encrypt encrypts plaintext for multiple recipient certificates allowing each recipient to decrypt","pkcs7.Encrypt supports AES-GCM encryption algorithms via ContentEncryptionAlgorithm setting","pkcs7.Encrypt returns error for unsupported algorithm values"],"goal":"verify github.com/smallstep/pkcs7.Encrypt in pkg:golang/github.com/smallstep/pkcs7@v0.0.0-20231024181729-3b98ecc1ca81","kind":"HOW","packages":["pkg:golang/github.com/smallstep/pkcs7@v0.0.0-20231024181729-3b98ecc1ca81"],"schemaVersion":1,"symbols":["github.com/smallstep/pkcs7.Encrypt"]},"contractCommand":["go","test","./..."],"environment":{"arch":"amd64","distro":"ubuntu","ecosystem":"golang","language":"go","libc":"glibc","libcVersion":"2.39","moduleSystem":"go","os":"linux","osVersionBucket":"24","packageManager":"go","packageManagerVersion":"1.26.6","runtime":"go","runtimeVersion":"1.26.6","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/github.com/smallstep/pkcs7@v0.0.0-20231024181729-3b98ecc1ca81"],"schemaVersion":1,"subject":"pkg:golang/github.com/smallstep/pkcs7@v0.0.0-20231024181729-3b98ecc1ca81","symbols":["github.com/smallstep/pkcs7.Encrypt"],"verifierAdapter":"golang@1"}

module example.com/sample

go 1.26.6

require github.com/smallstep/pkcs7 v0.0.0-20231024181729-3b98ecc1ca81 // indirect

github.com/smallstep/pkcs7 v0.0.0-20231024181729-3b98ecc1ca81 h1:B6cED3iLJTgxpdh4tuqByDjRRKan2EvtnOfHr2zHJVg=
github.com/smallstep/pkcs7 v0.0.0-20231024181729-3b98ecc1ca81/go.mod h1:SoUAr/4M46rZ3WaLstHxGhLEgoYIDRqxQEXLOmOEB0Y=

package main

import (
	"crypto/rand"
	"crypto/rsa"
	"crypto/x509"
	"crypto/x509/pkix"
	"fmt"
	"math/big"
	"time"

	"github.com/smallstep/pkcs7"
)

func generateSelfSignedCert() (*x509.Certificate, *rsa.PrivateKey, error) {
	priv, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		return nil, nil, err
	}

	template := x509.Certificate{
		SerialNumber: big.NewInt(1),
		Subject: pkix.Name{
			CommonName: "example.com",
		},
		NotBefore:             time.Now().Add(-1 * time.Hour),
		NotAfter:              time.Now().Add(24 * time.Hour),
		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
		BasicConstraintsValid: true,
	}

	certBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, &priv.PublicKey, priv)
	if err != nil {
		return nil, nil, err
	}

	cert, err := x509.ParseCertificate(certBytes)
	if err != nil {
		return nil, nil, err
	}

	return cert, priv, nil
}

func main() {
	cert, priv, err := generateSelfSignedCert()
	if err != nil {
		panic(err)
	}

	plaintext := []byte("Hello, CodeSampleX PKCS#7 Encrypt!")
	ciphertext, err := pkcs7.Encrypt(plaintext, []*x509.Certificate{cert})
	if err != nil {
		panic(err)
	}

	p7, err := pkcs7.Parse(ciphertext)
	if err != nil {
		panic(err)
	}

	decrypted, err := p7.Decrypt(cert, priv)
	if err != nil {
		panic(err)
	}

	fmt.Printf("Decrypted message: %s\n", string(decrypted))
}

{
  "schemaVersion": 1,
  "goal": "verify github.com/smallstep/pkcs7.Encrypt in pkg:golang/github.com/smallstep/pkcs7@v0.0.0-20231024181729-3b98ecc1ca81",
  "kind": "HOW",
  "packages": [
    "pkg:golang/github.com/smallstep/pkcs7@v0.0.0-20231024181729-3b98ecc1ca81"
  ],
  "symbols": [
    "github.com/smallstep/pkcs7.Encrypt"
  ],
  "constraints": {
    "executionContext": "node"
  },
  "runtimeConditions": {
    "ecosystem": "npm",
    "language": "javascript",
    "moduleSystem": "cjs",
    "packageManager": "npm@10.9.8",
    "runtime": "node@22.23.2"
  }
}

package test

import (
	"bytes"
	"crypto/rand"
	"crypto/rsa"
	"crypto/x509"
	"crypto/x509/pkix"
	"errors"
	"math/big"
	"testing"
	"time"

	"github.com/smallstep/pkcs7"
)

func createTestCert(t *testing.T, commonName string) (*x509.Certificate, *rsa.PrivateKey) {
	t.Helper()
	priv, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		t.Fatalf("failed to generate RSA key: %v", err)
	}

	template := x509.Certificate{
		SerialNumber: big.NewInt(time.Now().UnixNano()),
		Subject: pkix.Name{
			CommonName: commonName,
		},
		NotBefore:             time.Now().Add(-1 * time.Hour),
		NotAfter:              time.Now().Add(24 * time.Hour),
		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
		BasicConstraintsValid: true,
	}

	certBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, &priv.PublicKey, priv)
	if err != nil {
		t.Fatalf("failed to create certificate: %v", err)
	}

	cert, err := x509.ParseCertificate(certBytes)
	if err != nil {
		t.Fatalf("failed to parse certificate: %v", err)
	}

	return cert, priv
}

func TestEncryptSingleRecipient(t *testing.T) {
	cert, priv := createTestCert(t, "recipient1.example.com")
	plaintext := []byte("secret payload for single recipient")

	ciphertext, err := pkcs7.Encrypt(plaintext, []*x509.Certificate{cert})
	if err != nil {
		t.Fatalf("pkcs7.Encrypt failed: %v", err)
	}

	if len(ciphertext) == 0 {
		t.Fatal("expected non-empty ciphertext")
	}

	p7, err := pkcs7.Parse(ciphertext)
	if err != nil {
		t.Fatalf("pkcs7.Parse failed: %v", err)
	}

	decrypted, err := p7.Decrypt(cert, priv)
	if err != nil {
		t.Fatalf("p7.Decrypt failed: %v", err)
	}

	if !bytes.Equal(decrypted, plaintext) {
		t.Fatalf("decrypted mismatch: expected %q, got %q", string(plaintext), string(decrypted))
	}
}

func TestEncryptMultipleRecipients(t *testing.T) {
	cert1, priv1 := createTestCert(t, "user1.example.com")
	cert2, priv2 := createTestCert(t, "user2.example.com")
	plaintext := []byte("broadcast secret message to multiple recipients")

	ciphertext, err := pkcs7.Encrypt(plaintext, []*x509.Certificate{cert1, cert2})
	if err != nil {
		t.Fatalf("pkcs7.Encrypt failed with multiple recipients: %v", err)
	}

	p7_1, err := pkcs7.Parse(ciphertext)
	if err != nil {
		t.Fatalf("pkcs7.Parse failed for recipient 1: %v", err)
	}
	decrypted1, err := p7_1.Decrypt(cert1, priv1)
	if err != nil {
		t.Fatalf("p7.Decrypt failed for recipient 1: %v", err)
	}
	if !bytes.Equal(decrypted1, plaintext) {
		t.Fatalf("recipient 1 mismatch: expected %q, got %q", string(plaintext), string(decrypted1))
	}

	p7_2, err := pkcs7.Parse(ciphertext)
	if err != nil {
		t.Fatalf("pkcs7.Parse failed for recipient 2: %v", err)
	}
	decrypted2, err := p7_2.Decrypt(cert2, priv2)
	if err != nil {
		t.Fatalf("p7.Decrypt failed for recipient 2: %v", err)
	}
	if !bytes.Equal(decrypted2, plaintext) {
		t.Fatalf("recipient 2 mismatch: expected %q, got %q", string(plaintext), string(decrypted2))
	}
}

func TestEncryptWithAES256GCM(t *testing.T) {
	cert, priv := createTestCert(t, "aes256gcm.example.com")
	plaintext := []byte("confidential data encrypted with AES-256-GCM")

	origAlg := pkcs7.ContentEncryptionAlgorithm
	defer func() {
		pkcs7.ContentEncryptionAlgorithm = origAlg
	}()

	pkcs7.ContentEncryptionAlgorithm = pkcs7.EncryptionAlgorithmAES256GCM

	ciphertext, err := pkcs7.Encrypt(plaintext, []*x509.Certificate{cert})
	if err != nil {
		t.Fatalf("pkcs7.Encrypt with AES256GCM failed: %v", err)
	}

	p7, err := pkcs7.Parse(ciphertext)
	if err != nil {
		t.Fatalf("pkcs7.Parse failed: %v", err)
	}

	decrypted, err := p7.Decrypt(cert, priv)
	if err != nil {
		t.Fatalf("p7.Decrypt failed: %v", err)
	}

	if !bytes.Equal(decrypted, plaintext) {
		t.Fatalf("decrypted mismatch: expected %q, got %q", string(plaintext), string(decrypted))
	}
}

func TestEncryptUnsupportedAlgorithm(t *testing.T) {
	cert, _ := createTestCert(t, "invalid-alg.example.com")
	plaintext := []byte("test invalid algorithm")

	origAlg := pkcs7.ContentEncryptionAlgorithm
	defer func() {
		pkcs7.ContentEncryptionAlgorithm = origAlg
	}()

	pkcs7.ContentEncryptionAlgorithm = 9999

	_, err := pkcs7.Encrypt(plaintext, []*x509.Certificate{cert})
	if err == nil {
		t.Fatal("expected error for unsupported algorithm, got nil")
	}
	if !errors.Is(err, pkcs7.ErrUnsupportedEncryptionAlgorithm) {
		t.Fatalf("expected ErrUnsupportedEncryptionAlgorithm, got: %v", err)
	}
}