github.com/smallstep/pkcs7 v0.0.0-20231024181729-3b98ecc1ca81: Encrypt, NewSignedData, Parse

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify pkg:golang/github.com/smallstep/pkcs7@v0.0.0-20231024181729-3b98ecc1ca81
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/github.com/smallstep/pkcs7@v0.0.0-20231024181729-3b98ecc1ca81
Demonstrate these symbols/APIs:
  - pkcs7.Encrypt
  - pkcs7.NewSignedData
  - pkcs7.Parse
Constraints:
  - executionContext: node
Required runtime conditions:
  - ecosystem: npm
  - language: javascript
  - moduleSystem: cjs
  - packageManager: npm@10.9.8
  - runtime: node@22.23.2

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:457c01f7d0d103d3e048df5e5571ac8bcde43c297bdc8753b1ef2e1c87ab4cb8","contract":["NewSignedData and AddSigner create verifiable PKCS#7 detached and attached digital signatures","Parse reads signed PKCS#7 structures and verifies payload integrity against signer certificates","Verify and VerifyWithChain validate PKCS#7 signatures against trusted x509 certificate pools","Encrypt and Decrypt envelope data for recipient x509 certificates and recover original plaintext","GetOnlySigner returns the leaf signer certificate from a single-signer PKCS#7 payload"],"goal":"verify pkg:golang/github.com/smallstep/pkcs7@v0.0.0-20231024181729-3b98ecc1ca81","kind":"HOW","packages":["pkg:golang/github.com/smallstep/pkcs7@v0.0.0-20231024181729-3b98ecc1ca81"],"schemaVersion":1,"symbols":["pkcs7.Encrypt","pkcs7.NewSignedData","pkcs7.Parse"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/github.com/smallstep/pkcs7@v0.0.0-20231024181729-3b98ecc1ca81"],"schemaVersion":1,"symbols":["pkcs7.Encrypt","pkcs7.NewSignedData","pkcs7.Parse"],"verifierAdapter":"golang@1"}

module example.com/sample

go 1.26.6

require github.com/smallstep/pkcs7 v0.0.0-20231024181729-3b98ecc1ca81

github.com/smallstep/pkcs7 v0.0.0-20231024181729-3b98ecc1ca81 h1:B6cED3iLJTgxpdh4tuqByDjRRKan2EvtnOfHr2zHJVg=
github.com/smallstep/pkcs7 v0.0.0-20231024181729-3b98ecc1ca81/go.mod h1:SoUAr/4M46rZ3WaLstHxGhLEgoYIDRqxQEXLOmOEB0Y=

package main

import (
	"crypto/rand"
	"crypto/rsa"
	"crypto/x509"
	"crypto/x509/pkix"
	"fmt"
	"math/big"
	"time"

	"github.com/smallstep/pkcs7"
)

// PKCS7Manager demonstrates digital signature and encryption workflows using smallstep/pkcs7.
type PKCS7Manager struct {
	Cert    *x509.Certificate
	PrivKey *rsa.PrivateKey
}

// NewPKCS7Manager initializes a manager with an in-memory test RSA keypair and certificate.
func NewPKCS7Manager() (*PKCS7Manager, error) {
	priv, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		return nil, fmt.Errorf("generate RSA key: %w", err)
	}

	template := &x509.Certificate{
		SerialNumber: big.NewInt(1),
		Subject: pkix.Name{
			CommonName: "signer.example.com",
		},
		NotBefore:             time.Now().Add(-1 * time.Hour),
		NotAfter:              time.Now().Add(24 * time.Hour),
		KeyUsage:              x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageCodeSigning},
		BasicConstraintsValid: true,
		IsCA:                  true,
	}

	der, err := x509.CreateCertificate(rand.Reader, template, template, &priv.PublicKey, priv)
	if err != nil {
		return nil, fmt.Errorf("create certificate: %w", err)
	}

	cert, err := x509.ParseCertificate(der)
	if err != nil {
		return nil, fmt.Errorf("parse certificate: %w", err)
	}

	return &PKCS7Manager{
		Cert:    cert,
		PrivKey: priv,
	}, nil
}

// Sign creates a signed PKCS#7 DER payload from the input message.
func (m *PKCS7Manager) Sign(data []byte) ([]byte, error) {
	sd, err := pkcs7.NewSignedData(data)
	if err != nil {
		return nil, fmt.Errorf("create signed data: %w", err)
	}

	if err := sd.AddSigner(m.Cert, m.PrivKey, pkcs7.SignerInfoConfig{}); err != nil {
		return nil, fmt.Errorf("add signer: %w", err)
	}

	return sd.Finish()
}

// Verify parses and verifies a PKCS#7 signed DER payload against a trusted certificate pool.
func (m *PKCS7Manager) Verify(signedDER []byte) ([]byte, error) {
	p7, err := pkcs7.Parse(signedDER)
	if err != nil {
		return nil, fmt.Errorf("parse pkcs7: %w", err)
	}

	pool := x509.NewCertPool()
	pool.AddCert(m.Cert)

	if err := p7.VerifyWithChain(pool); err != nil {
		return nil, fmt.Errorf("verify signature: %w", err)
	}

	return p7.Content, nil
}

// Encrypt generates a PKCS#7 EnvelopedData ciphertext for the manager's certificate.
func (m *PKCS7Manager) Encrypt(plaintext []byte) ([]byte, error) {
	return pkcs7.Encrypt(plaintext, []*x509.Certificate{m.Cert})
}

// Decrypt parses and decrypts a PKCS#7 EnvelopedData ciphertext.
func (m *PKCS7Manager) Decrypt(cipherDER []byte) ([]byte, error) {
	p7, err := pkcs7.Parse(cipherDER)
	if err != nil {
		return nil, fmt.Errorf("parse enveloped data: %w", err)
	}

	return p7.Decrypt(m.Cert, m.PrivKey)
}

func main() {
	manager, err := NewPKCS7Manager()
	if err != nil {
		fmt.Printf("Failed to initialize PKCS#7 manager: %v\n", err)
		return
	}

	message := []byte("Hello, PKCS#7 signed and encrypted world!")

	signedDER, err := manager.Sign(message)
	if err != nil {
		fmt.Printf("Sign error: %v\n", err)
		return
	}
	fmt.Printf("Successfully signed %d bytes of payload into %d bytes PKCS#7 DER\n", len(message), len(signedDER))

	verifiedContent, err := manager.Verify(signedDER)
	if err != nil {
		fmt.Printf("Verify error: %v\n", err)
		return
	}
	fmt.Printf("Successfully verified signature: %s\n", string(verifiedContent))

	cipherDER, err := manager.Encrypt(message)
	if err != nil {
		fmt.Printf("Encrypt error: %v\n", err)
		return
	}
	fmt.Printf("Successfully encrypted payload into %d bytes\n", len(cipherDER))

	decryptedContent, err := manager.Decrypt(cipherDER)
	if err != nil {
		fmt.Printf("Decrypt error: %v\n", err)
		return
	}
	fmt.Printf("Successfully decrypted payload: %s\n", string(decryptedContent))
}

{
  "schemaVersion": 1,
  "goal": "verify pkg:golang/github.com/smallstep/pkcs7@v0.0.0-20231024181729-3b98ecc1ca81",
  "kind": "HOW",
  "packages": [
    "pkg:golang/github.com/smallstep/pkcs7@v0.0.0-20231024181729-3b98ecc1ca81"
  ],
  "symbols": [
    "pkcs7.Encrypt",
    "pkcs7.NewSignedData",
    "pkcs7.Parse"
  ],
  "constraints": {
    "executionContext": "node"
  },
  "runtimeConditions": {
    "ecosystem": "npm",
    "language": "javascript",
    "moduleSystem": "cjs",
    "packageManager": "npm@10.9.8",
    "runtime": "node@22.23.2"
  }
}

package main

import (
	"bytes"
	"crypto/rand"
	"crypto/rsa"
	"crypto/x509"
	"crypto/x509/pkix"
	"fmt"
	"math/big"
	"os"
	"time"

	"github.com/smallstep/pkcs7"
)

func generateTestCertificate() (*x509.Certificate, *rsa.PrivateKey, error) {
	priv, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		return nil, nil, fmt.Errorf("failed to generate RSA key: %w", err)
	}

	template := &x509.Certificate{
		SerialNumber: big.NewInt(1001),
		Subject: pkix.Name{
			CommonName: "signer.example.com",
		},
		NotBefore:             time.Now().Add(-1 * time.Hour),
		NotAfter:              time.Now().Add(24 * time.Hour),
		KeyUsage:              x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageCodeSigning, x509.ExtKeyUsageEmailProtection},
		BasicConstraintsValid: true,
		IsCA:                  true,
	}

	derBytes, err := x509.CreateCertificate(rand.Reader, template, template, &priv.PublicKey, priv)
	if err != nil {
		return nil, nil, fmt.Errorf("failed to create certificate: %w", err)
	}

	cert, err := x509.ParseCertificate(derBytes)
	if err != nil {
		return nil, nil, fmt.Errorf("failed to parse certificate: %w", err)
	}

	return cert, priv, nil
}

func main() {
	cert, privKey, err := generateTestCertificate()
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: certificate generation failed: %v\n", err)
		os.Exit(1)
	}

	rawMessage := []byte("Sample PKCS#7 contract payload for verification")

	// Assertion 1: NewSignedData and AddSigner create verifiable PKCS#7 detached and attached digital signatures
	var signedDER []byte
	{
		sd, err := pkcs7.NewSignedData(rawMessage)
		if err != nil {
			fmt.Fprintf(os.Stderr, "FAIL: NewSignedData error: %v\n", err)
			os.Exit(1)
		}

		if err := sd.AddSigner(cert, privKey, pkcs7.SignerInfoConfig{}); err != nil {
			fmt.Fprintf(os.Stderr, "FAIL: AddSigner error: %v\n", err)
			os.Exit(1)
		}

		signedDER, err = sd.Finish()
		if err != nil {
			fmt.Fprintf(os.Stderr, "FAIL: Finish error: %v\n", err)
			os.Exit(1)
		}

		if len(signedDER) == 0 {
			fmt.Fprintf(os.Stderr, "FAIL: Finish produced empty signed data\n")
			os.Exit(1)
		}
	}

	// Assertion 2: Parse reads signed PKCS#7 structures and verifies payload integrity against signer certificates
	var parsedP7 *pkcs7.PKCS7
	{
		parsedP7, err = pkcs7.Parse(signedDER)
		if err != nil {
			fmt.Fprintf(os.Stderr, "FAIL: Parse signed data error: %v\n", err)
			os.Exit(1)
		}

		if !bytes.Equal(parsedP7.Content, rawMessage) {
			fmt.Fprintf(os.Stderr, "FAIL: Content mismatch, got %q, want %q\n", parsedP7.Content, rawMessage)
			os.Exit(1)
		}

		if len(parsedP7.Certificates) == 0 {
			fmt.Fprintf(os.Stderr, "FAIL: expected embedded signer certificate in parsed PKCS7\n")
			os.Exit(1)
		}
	}

	// Assertion 3: Verify and VerifyWithChain validate PKCS#7 signatures against trusted x509 certificate pools
	{
		if err := parsedP7.Verify(); err != nil {
			fmt.Fprintf(os.Stderr, "FAIL: Verify error: %v\n", err)
			os.Exit(1)
		}

		pool := x509.NewCertPool()
		pool.AddCert(cert)
		if err := parsedP7.VerifyWithChain(pool); err != nil {
			fmt.Fprintf(os.Stderr, "FAIL: VerifyWithChain error: %v\n", err)
			os.Exit(1)
		}

		untrustedPool := x509.NewCertPool()
		if err := parsedP7.VerifyWithChain(untrustedPool); err == nil {
			fmt.Fprintf(os.Stderr, "FAIL: VerifyWithChain should fail with empty untrusted pool\n")
			os.Exit(1)
		}
	}

	// Assertion 4: Encrypt and Decrypt envelope data for recipient x509 certificates and recover original plaintext
	{
		secretData := []byte("confidential document contents")
		encryptedDER, err := pkcs7.Encrypt(secretData, []*x509.Certificate{cert})
		if err != nil {
			fmt.Fprintf(os.Stderr, "FAIL: Encrypt error: %v\n", err)
			os.Exit(1)
		}

		encP7, err := pkcs7.Parse(encryptedDER)
		if err != nil {
			fmt.Fprintf(os.Stderr, "FAIL: Parse encrypted data error: %v\n", err)
			os.Exit(1)
		}

		decrypted, err := encP7.Decrypt(cert, privKey)
		if err != nil {
			fmt.Fprintf(os.Stderr, "FAIL: Decrypt error: %v\n", err)
			os.Exit(1)
		}

		if !bytes.Equal(decrypted, secretData) {
			fmt.Fprintf(os.Stderr, "FAIL: decrypted data mismatch, got %q, want %q\n", decrypted, secretData)
			os.Exit(1)
		}
	}

	// Assertion 5: GetOnlySigner returns the leaf signer certificate from a single-signer PKCS#7 payload
	{
		signer := parsedP7.GetOnlySigner()
		if signer == nil {
			fmt.Fprintf(os.Stderr, "FAIL: GetOnlySigner returned nil\n")
			os.Exit(1)
		}

		if signer.Subject.CommonName != "signer.example.com" {
			fmt.Fprintf(os.Stderr, "FAIL: Signer CommonName mismatch, got %s\n", signer.Subject.CommonName)
			os.Exit(1)
		}
	}

	fmt.Println("PASS: smallstep/pkcs7 contract passed")
}