github.com/smallstep/scep v0.0.0-20231024192529-aee96d7ad34d: CACerts

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify github.com/smallstep/scep.CACerts in pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d
Demonstrate these symbols/APIs:
  - github.com/smallstep/scep.CACerts
Constraints:
  - executionContext: node
Required runtime conditions:
  - ecosystem: npm
  - language: javascript
  - moduleSystem: esm
  - packageManager: npm@10.9.8
  - runtime: node@22.23.2

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:46552b096bee69b5706c9f5f837c81f1a98c4f9f58350edd579cda89a06b4807","contract":["CACerts extracts a single CA certificate from PKCS#7 degenerate certificate payload","CACerts preserves certificate properties including Subject, SerialNumber, and raw DER encoding","CACerts extracts full certificate chains preserving certificate order in the chain","CACerts returns an error when parsing invalid or corrupted PKCS#7 data","CACerts returns an error when parsing empty byte slice"],"goal":"verify github.com/smallstep/scep.CACerts in pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d","kind":"HOW","packages":["pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d"],"schemaVersion":1,"symbols":["github.com/smallstep/scep.CACerts"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d"],"schemaVersion":1,"subject":"pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d","symbols":["github.com/smallstep/scep.CACerts"],"verifierAdapter":"golang@1"}

module example.com/sample

go 1.26.6

require github.com/smallstep/scep v0.0.0-20231024192529-aee96d7ad34d

require (
	github.com/go-kit/kit v0.4.0 // indirect
	github.com/go-logfmt/logfmt v0.5.1 // indirect
	github.com/go-stack/stack v1.6.0 // indirect
	github.com/smallstep/pkcs7 v0.0.0-20231024181729-3b98ecc1ca81 // indirect
)

github.com/go-kit/kit v0.4.0 h1:KeVK+Emj3c3S4eRztFuzbFYb2BAgf2jmwDwyXEri7Lo=
github.com/go-kit/kit v0.4.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
github.com/go-logfmt/logfmt v0.5.1 h1:otpy5pqBCBZ1ng9RQ0dPu4PN7ba75Y/aA+UpowDyNVA=
github.com/go-logfmt/logfmt v0.5.1/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
github.com/go-stack/stack v1.6.0 h1:MmJCxYVKTJ0SplGKqFVX3SBnmaUhODHZrrFF6jMbpZk=
github.com/go-stack/stack v1.6.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
github.com/smallstep/pkcs7 v0.0.0-20231024181729-3b98ecc1ca81 h1:B6cED3iLJTgxpdh4tuqByDjRRKan2EvtnOfHr2zHJVg=
github.com/smallstep/pkcs7 v0.0.0-20231024181729-3b98ecc1ca81/go.mod h1:SoUAr/4M46rZ3WaLstHxGhLEgoYIDRqxQEXLOmOEB0Y=
github.com/smallstep/scep v0.0.0-20231024192529-aee96d7ad34d h1:06LUHn4Ia2X6syjIaCMNaXXDNdU+1N/oOHynJbWgpXw=
github.com/smallstep/scep v0.0.0-20231024192529-aee96d7ad34d/go.mod h1:4d0ub42ut1mMtvGyMensjuHYEUpRrASvkzLEJvoRQcU=

package main

import (
	"crypto/rand"
	"crypto/rsa"
	"crypto/x509"
	"crypto/x509/pkix"
	"fmt"
	"math/big"
	"time"

	"github.com/smallstep/scep"
)

// createCertificate creates a self-signed or parent-signed test certificate.
func createCertificate(commonName string, isCA bool, parent *x509.Certificate, parentKey *rsa.PrivateKey) (*x509.Certificate, *rsa.PrivateKey, error) {
	privKey, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		return nil, nil, err
	}

	tmpl := &x509.Certificate{
		SerialNumber: big.NewInt(time.Now().UnixNano()),
		Subject: pkix.Name{
			CommonName: commonName,
		},
		NotBefore:             time.Now().Add(-1 * time.Hour),
		NotAfter:              time.Now().Add(24 * time.Hour),
		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageDigitalSignature,
		BasicConstraintsValid: true,
		IsCA:                  isCA,
	}

	signerCert := tmpl
	signerKey := privKey
	if parent != nil && parentKey != nil {
		signerCert = parent
		signerKey = parentKey
	}

	derBytes, err := x509.CreateCertificate(rand.Reader, tmpl, signerCert, &privKey.PublicKey, signerKey)
	if err != nil {
		return nil, nil, err
	}

	cert, err := x509.ParseCertificate(derBytes)
	if err != nil {
		return nil, nil, err
	}

	return cert, privKey, nil
}

func main() {
	// Generate a root CA and an intermediate issuing CA
	rootCA, rootKey, err := createCertificate("Example Root CA", true, nil, nil)
	if err != nil {
		panic(err)
	}

	issuingCA, _, err := createCertificate("Example Issuing CA", true, rootCA, rootKey)
	if err != nil {
		panic(err)
	}

	// Create PKCS#7 degenerate certificate payload containing the CA chain
	caChain := []*x509.Certificate{issuingCA, rootCA}
	p7Data, err := scep.DegenerateCertificates(caChain)
	if err != nil {
		panic(err)
	}

	// Extract certificates from the PKCS#7 payload using scep.CACerts
	extractedCerts, err := scep.CACerts(p7Data)
	if err != nil {
		panic(err)
	}

	fmt.Printf("Extracted %d CA certificate(s) from SCEP payload:\n", len(extractedCerts))
	for idx, cert := range extractedCerts {
		fmt.Printf("  [%d] Subject: %s (IsCA=%v)\n", idx+1, cert.Subject.CommonName, cert.IsCA)
	}
}

{
  "schemaVersion": 1,
  "goal": "verify github.com/smallstep/scep.CACerts in pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d",
  "kind": "HOW",
  "packages": [
    "pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d"
  ],
  "symbols": [
    "github.com/smallstep/scep.CACerts"
  ]
}

package main

import (
	"bytes"
	"crypto/rand"
	"crypto/rsa"
	"crypto/x509"
	"crypto/x509/pkix"
	"fmt"
	"math/big"
	"os"
	"time"

	"github.com/smallstep/scep"
)

func generateTestCert(commonName string, isCA bool, parent *x509.Certificate, parentKey *rsa.PrivateKey) (*x509.Certificate, *rsa.PrivateKey, error) {
	privKey, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		return nil, nil, err
	}

	tmpl := &x509.Certificate{
		SerialNumber: big.NewInt(time.Now().UnixNano()),
		Subject: pkix.Name{
			CommonName: commonName,
		},
		NotBefore:             time.Now().Add(-1 * time.Hour),
		NotAfter:              time.Now().Add(24 * time.Hour),
		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageDigitalSignature,
		BasicConstraintsValid: true,
		IsCA:                  isCA,
	}

	signerCert := tmpl
	signerKey := privKey
	if parent != nil && parentKey != nil {
		signerCert = parent
		signerKey = parentKey
	}

	derBytes, err := x509.CreateCertificate(rand.Reader, tmpl, signerCert, &privKey.PublicKey, signerKey)
	if err != nil {
		return nil, nil, err
	}

	cert, err := x509.ParseCertificate(derBytes)
	if err != nil {
		return nil, nil, err
	}

	return cert, privKey, nil
}

func main() {
	rootCert, rootKey, err := generateTestCert("Contract Root CA", true, nil, nil)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: failed to generate root certificate: %v\n", err)
		os.Exit(1)
	}

	intermediateCert, _, err := generateTestCert("Contract Intermediate CA", true, rootCert, rootKey)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: failed to generate intermediate certificate: %v\n", err)
		os.Exit(1)
	}

	// Assertion 1: CACerts extracts a single CA certificate from PKCS#7 degenerate certificate payload
	singleP7, err := scep.DegenerateCertificates([]*x509.Certificate{rootCert})
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: DegenerateCertificates failed: %v\n", err)
		os.Exit(1)
	}
	singleExtracted, err := scep.CACerts(singleP7)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: CACerts failed for single cert: %v\n", err)
		os.Exit(1)
	}
	if len(singleExtracted) != 1 {
		fmt.Fprintf(os.Stderr, "FAIL: expected 1 extracted cert, got %d\n", len(singleExtracted))
		os.Exit(1)
	}

	// Assertion 2: CACerts preserves certificate properties including Subject, SerialNumber, and raw DER encoding
	parsedRoot := singleExtracted[0]
	if parsedRoot.Subject.CommonName != rootCert.Subject.CommonName {
		fmt.Fprintf(os.Stderr, "FAIL: expected Subject CN %s, got %s\n", rootCert.Subject.CommonName, parsedRoot.Subject.CommonName)
		os.Exit(1)
	}
	if parsedRoot.SerialNumber.Cmp(rootCert.SerialNumber) != 0 {
		fmt.Fprintf(os.Stderr, "FAIL: serial number mismatch\n")
		os.Exit(1)
	}
	if !parsedRoot.IsCA {
		fmt.Fprintf(os.Stderr, "FAIL: expected IsCA to be true\n")
		os.Exit(1)
	}
	if !bytes.Equal(parsedRoot.Raw, rootCert.Raw) {
		fmt.Fprintf(os.Stderr, "FAIL: raw DER bytes do not match original certificate\n")
		os.Exit(1)
	}

	// Assertion 3: CACerts extracts full certificate chains preserving certificate order in the chain
	chainP7, err := scep.DegenerateCertificates([]*x509.Certificate{intermediateCert, rootCert})
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: DegenerateCertificates for chain failed: %v\n", err)
		os.Exit(1)
	}
	chainExtracted, err := scep.CACerts(chainP7)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: CACerts failed for certificate chain: %v\n", err)
		os.Exit(1)
	}
	if len(chainExtracted) != 2 {
		fmt.Fprintf(os.Stderr, "FAIL: expected 2 extracted certs in chain, got %d\n", len(chainExtracted))
		os.Exit(1)
	}
	if !bytes.Equal(chainExtracted[0].Raw, intermediateCert.Raw) {
		fmt.Fprintf(os.Stderr, "FAIL: first cert in chain does not match intermediate certificate\n")
		os.Exit(1)
	}
	if !bytes.Equal(chainExtracted[1].Raw, rootCert.Raw) {
		fmt.Fprintf(os.Stderr, "FAIL: second cert in chain does not match root certificate\n")
		os.Exit(1)
	}

	// Assertion 4: CACerts returns an error when parsing invalid or corrupted PKCS#7 data
	invalidData := []byte("this is not valid pkcs7 degenerate data")
	_, errInvalid := scep.CACerts(invalidData)
	if errInvalid == nil {
		fmt.Fprintf(os.Stderr, "FAIL: expected error when parsing invalid PKCS#7 data, got nil\n")
		os.Exit(1)
	}

	corruptedASN1 := []byte{0x30, 0x05, 0x01, 0x01, 0xff}
	_, errCorrupted := scep.CACerts(corruptedASN1)
	if errCorrupted == nil {
		fmt.Fprintf(os.Stderr, "FAIL: expected error when parsing corrupted ASN.1 data, got nil\n")
		os.Exit(1)
	}

	// Assertion 5: CACerts returns an error when parsing empty byte slice
	_, errEmpty := scep.CACerts([]byte{})
	if errEmpty == nil {
		fmt.Fprintf(os.Stderr, "FAIL: expected error when parsing empty byte slice, got nil\n")
		os.Exit(1)
	}

	fmt.Println("PASS: github.com/smallstep/scep.CACerts contract passed")
}