github.com/smallstep/scep v0.0.0-20231024192529-aee96d7ad34d: DegenerateCertificates

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify github.com/smallstep/scep.DegenerateCertificates in pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d
Demonstrate these symbols/APIs:
  - github.com/smallstep/scep.DegenerateCertificates
Constraints:
  - executionContext: node
Required runtime conditions:
  - ecosystem: npm
  - language: javascript
  - moduleSystem: esm
  - packageManager: npm@10.9.8
  - runtime: node@22.23.2

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:9e3a5b7385c19f9b0abb1a38315b48fde1d93adb0c67807f7a993135cfe53030","contract":["DegenerateCertificates creates a valid PKCS#7 payload from a single certificate","DegenerateCertificates encodes multiple certificates preserving order and certificate contents","DegenerateCertificates handles empty certificate slice without error","DegenerateCertificates preserves Subject, SerialNumber, and IsCA flags"],"goal":"verify github.com/smallstep/scep.DegenerateCertificates in pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d","kind":"HOW","packages":["pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d"],"schemaVersion":1,"symbols":["github.com/smallstep/scep.DegenerateCertificates"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d"],"schemaVersion":1,"subject":"pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d","symbols":["github.com/smallstep/scep.DegenerateCertificates"],"verifierAdapter":"golang@1"}

module example.com/sample

go 1.26.6

require github.com/smallstep/scep v0.0.0-20231024192529-aee96d7ad34d

require (
	github.com/go-kit/kit v0.4.0 // indirect
	github.com/go-logfmt/logfmt v0.5.1 // indirect
	github.com/go-stack/stack v1.6.0 // indirect
	github.com/smallstep/pkcs7 v0.0.0-20231024181729-3b98ecc1ca81 // indirect
)

github.com/go-kit/kit v0.4.0 h1:KeVK+Emj3c3S4eRztFuzbFYb2BAgf2jmwDwyXEri7Lo=
github.com/go-kit/kit v0.4.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
github.com/go-logfmt/logfmt v0.5.1 h1:otpy5pqBCBZ1ng9RQ0dPu4PN7ba75Y/aA+UpowDyNVA=
github.com/go-logfmt/logfmt v0.5.1/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
github.com/go-stack/stack v1.6.0 h1:MmJCxYVKTJ0SplGKqFVX3SBnmaUhODHZrrFF6jMbpZk=
github.com/go-stack/stack v1.6.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
github.com/smallstep/pkcs7 v0.0.0-20231024181729-3b98ecc1ca81 h1:B6cED3iLJTgxpdh4tuqByDjRRKan2EvtnOfHr2zHJVg=
github.com/smallstep/pkcs7 v0.0.0-20231024181729-3b98ecc1ca81/go.mod h1:SoUAr/4M46rZ3WaLstHxGhLEgoYIDRqxQEXLOmOEB0Y=
github.com/smallstep/scep v0.0.0-20231024192529-aee96d7ad34d h1:06LUHn4Ia2X6syjIaCMNaXXDNdU+1N/oOHynJbWgpXw=
github.com/smallstep/scep v0.0.0-20231024192529-aee96d7ad34d/go.mod h1:4d0ub42ut1mMtvGyMensjuHYEUpRrASvkzLEJvoRQcU=

package main

import (
	"crypto/rand"
	"crypto/rsa"
	"crypto/x509"
	"crypto/x509/pkix"
	"fmt"
	"math/big"
	"time"

	"github.com/smallstep/scep"
)

// createCertificate generates a self-signed or CA-signed certificate for testing.
func createCertificate(commonName string, isCA bool, parent *x509.Certificate, parentKey *rsa.PrivateKey) (*x509.Certificate, *rsa.PrivateKey, error) {
	privKey, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		return nil, nil, err
	}

	tmpl := &x509.Certificate{
		SerialNumber: big.NewInt(time.Now().UnixNano()),
		Subject: pkix.Name{
			CommonName: commonName,
		},
		NotBefore:             time.Now().Add(-1 * time.Hour),
		NotAfter:              time.Now().Add(24 * time.Hour),
		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageDigitalSignature,
		BasicConstraintsValid: true,
		IsCA:                  isCA,
	}

	signerCert := tmpl
	signerKey := privKey
	if parent != nil && parentKey != nil {
		signerCert = parent
		signerKey = parentKey
	}

	derBytes, err := x509.CreateCertificate(rand.Reader, tmpl, signerCert, &privKey.PublicKey, signerKey)
	if err != nil {
		return nil, nil, err
	}

	cert, err := x509.ParseCertificate(derBytes)
	if err != nil {
		return nil, nil, err
	}

	return cert, privKey, nil
}

func main() {
	// Create Root CA and Intermediate CA
	rootCA, rootKey, err := createCertificate("Example Root CA", true, nil, nil)
	if err != nil {
		panic(err)
	}

	intermediateCA, _, err := createCertificate("Example Intermediate CA", true, rootCA, rootKey)
	if err != nil {
		panic(err)
	}

	// Pack the certificate chain into a PKCS#7 degenerate certificate payload
	certs := []*x509.Certificate{intermediateCA, rootCA}
	degenerateBytes, err := scep.DegenerateCertificates(certs)
	if err != nil {
		panic(err)
	}

	fmt.Printf("Generated PKCS#7 degenerate certificates payload (%d bytes)\n", len(degenerateBytes))

	// Verify that the certificates can be unpacked from the payload
	parsedCerts, err := scep.CACerts(degenerateBytes)
	if err != nil {
		panic(err)
	}

	fmt.Printf("Extracted %d certificate(s) from degenerate payload:\n", len(parsedCerts))
	for i, cert := range parsedCerts {
		fmt.Printf("  [%d] Subject: %s (IsCA: %v)\n", i+1, cert.Subject.CommonName, cert.IsCA)
	}
}

{
  "schemaVersion": 1,
  "goal": "verify github.com/smallstep/scep.DegenerateCertificates in pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d",
  "kind": "HOW",
  "packages": [
    "pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d"
  ],
  "symbols": [
    "github.com/smallstep/scep.DegenerateCertificates"
  ],
  "constraints": {
    "executionContext": "node"
  },
  "runtimeConditions": {
    "ecosystem": "npm",
    "language": "javascript",
    "moduleSystem": "esm",
    "packageManager": "npm@10.9.8",
    "runtime": "node@22.23.2"
  }
}

package main

import (
	"bytes"
	"crypto/rand"
	"crypto/rsa"
	"crypto/x509"
	"crypto/x509/pkix"
	"fmt"
	"math/big"
	"os"
	"time"

	"github.com/smallstep/scep"
)

func generateTestCert(commonName string, isCA bool, parent *x509.Certificate, parentKey *rsa.PrivateKey) (*x509.Certificate, *rsa.PrivateKey, error) {
	privKey, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		return nil, nil, err
	}

	tmpl := &x509.Certificate{
		SerialNumber: big.NewInt(time.Now().UnixNano()),
		Subject: pkix.Name{
			CommonName: commonName,
		},
		NotBefore:             time.Now().Add(-1 * time.Hour),
		NotAfter:              time.Now().Add(24 * time.Hour),
		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageDigitalSignature,
		BasicConstraintsValid: true,
		IsCA:                  isCA,
	}

	signerCert := tmpl
	signerKey := privKey
	if parent != nil && parentKey != nil {
		signerCert = parent
		signerKey = parentKey
	}

	derBytes, err := x509.CreateCertificate(rand.Reader, tmpl, signerCert, &privKey.PublicKey, signerKey)
	if err != nil {
		return nil, nil, err
	}

	cert, err := x509.ParseCertificate(derBytes)
	if err != nil {
		return nil, nil, err
	}

	return cert, privKey, nil
}

func main() {
	rootCert, rootKey, err := generateTestCert("Contract Root CA", true, nil, nil)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: failed to generate root certificate: %v\n", err)
		os.Exit(1)
	}

	intermediateCert, _, err := generateTestCert("Contract Intermediate CA", true, rootCert, rootKey)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: failed to generate intermediate certificate: %v\n", err)
		os.Exit(1)
	}

	leafCert, _, err := generateTestCert("Contract Leaf Entity", false, rootCert, rootKey)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: failed to generate leaf certificate: %v\n", err)
		os.Exit(1)
	}

	// Assertion 1: DegenerateCertificates creates a valid PKCS#7 payload from a single certificate
	singlePayload, err := scep.DegenerateCertificates([]*x509.Certificate{rootCert})
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: DegenerateCertificates failed for single certificate: %v\n", err)
		os.Exit(1)
	}
	if len(singlePayload) == 0 {
		fmt.Fprintf(os.Stderr, "FAIL: DegenerateCertificates returned empty payload for single certificate\n")
		os.Exit(1)
	}

	singleParsed, err := scep.CACerts(singlePayload)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: CACerts failed to parse single certificate payload: %v\n", err)
		os.Exit(1)
	}
	if len(singleParsed) != 1 {
		fmt.Fprintf(os.Stderr, "FAIL: expected 1 certificate in payload, got %d\n", len(singleParsed))
		os.Exit(1)
	}
	if !bytes.Equal(singleParsed[0].Raw, rootCert.Raw) {
		fmt.Fprintf(os.Stderr, "FAIL: single certificate DER bytes do not match\n")
		os.Exit(1)
	}

	// Assertion 2: DegenerateCertificates encodes multiple certificates preserving order and certificate contents
	chainPayload, err := scep.DegenerateCertificates([]*x509.Certificate{intermediateCert, rootCert, leafCert})
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: DegenerateCertificates failed for multiple certificates: %v\n", err)
		os.Exit(1)
	}
	if len(chainPayload) == 0 {
		fmt.Fprintf(os.Stderr, "FAIL: DegenerateCertificates returned empty payload for multiple certificates\n")
		os.Exit(1)
	}

	chainParsed, err := scep.CACerts(chainPayload)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: CACerts failed to parse chain payload: %v\n", err)
		os.Exit(1)
	}
	if len(chainParsed) != 3 {
		fmt.Fprintf(os.Stderr, "FAIL: expected 3 certificates in chain, got %d\n", len(chainParsed))
		os.Exit(1)
	}
	if !bytes.Equal(chainParsed[0].Raw, intermediateCert.Raw) {
		fmt.Fprintf(os.Stderr, "FAIL: first certificate in chain does not match intermediate cert\n")
		os.Exit(1)
	}
	if !bytes.Equal(chainParsed[1].Raw, rootCert.Raw) {
		fmt.Fprintf(os.Stderr, "FAIL: second certificate in chain does not match root cert\n")
		os.Exit(1)
	}
	if !bytes.Equal(chainParsed[2].Raw, leafCert.Raw) {
		fmt.Fprintf(os.Stderr, "FAIL: third certificate in chain does not match leaf cert\n")
		os.Exit(1)
	}

	// Assertion 3: DegenerateCertificates handles empty certificate slice without error
	emptyPayload, err := scep.DegenerateCertificates([]*x509.Certificate{})
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: DegenerateCertificates failed on empty slice: %v\n", err)
		os.Exit(1)
	}
	if len(emptyPayload) == 0 {
		fmt.Fprintf(os.Stderr, "FAIL: DegenerateCertificates returned zero-length slice for empty certificates\n")
		os.Exit(1)
	}

	// Assertion 4: DegenerateCertificates preserves Subject, SerialNumber, and IsCA flags
	if chainParsed[0].Subject.CommonName != intermediateCert.Subject.CommonName {
		fmt.Fprintf(os.Stderr, "FAIL: Subject CommonName mismatch on cert 0\n")
		os.Exit(1)
	}
	if chainParsed[0].SerialNumber.Cmp(intermediateCert.SerialNumber) != 0 {
		fmt.Fprintf(os.Stderr, "FAIL: SerialNumber mismatch on cert 0\n")
		os.Exit(1)
	}
	if chainParsed[0].IsCA != true {
		fmt.Fprintf(os.Stderr, "FAIL: IsCA mismatch on cert 0\n")
		os.Exit(1)
	}
	if chainParsed[2].IsCA != false {
		fmt.Fprintf(os.Stderr, "FAIL: IsCA mismatch on cert 2\n")
		os.Exit(1)
	}

	fmt.Println("PASS: github.com/smallstep/scep.DegenerateCertificates contract passed")
}