github.com/smallstep/scep v0.0.0-20231024192529-aee96d7ad34d: FAILURE

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify github.com/smallstep/scep.FAILURE in pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d
Demonstrate these symbols/APIs:
  - github.com/smallstep/scep.FAILURE

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:8dced9201526ddcdf26405eff6b1b21750f5ee50ab6f6f59807617d15576bb6a","contract":["scep.FAILURE constant has the SCEP protocol string value \"2\"","scep.PKIMessage.Fail constructs a signed CertRep FAILURE response with scep.FAILURE status and scep.BadRequest failInfo","scep.PKIMessage.Fail supports all standard SCEP failInfo reasons (BadAlg, BadMessageCheck, BadTime, BadCertID) with scep.FAILURE","scep.PKIMessage.Fail preserves transaction correlation by matching TransactionID and setting RecipientNonce to the request's SenderNonce"],"goal":"verify github.com/smallstep/scep.FAILURE in pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d","kind":"HOW","packages":["pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d"],"schemaVersion":1,"symbols":["github.com/smallstep/scep.FAILURE"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d"],"schemaVersion":1,"subject":"pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d","symbols":["github.com/smallstep/scep.FAILURE"],"verifierAdapter":"golang@1"}

module sample-scep-failure

go 1.22

require github.com/smallstep/scep v0.0.0-20231024192529-aee96d7ad34d

require (
	github.com/go-kit/kit v0.4.0 // indirect
	github.com/go-logfmt/logfmt v0.5.1 // indirect
	github.com/go-stack/stack v1.6.0 // indirect
	github.com/smallstep/pkcs7 v0.0.0-20231024181729-3b98ecc1ca81 // indirect
)

github.com/go-kit/kit v0.4.0 h1:KeVK+Emj3c3S4eRztFuzbFYb2BAgf2jmwDwyXEri7Lo=
github.com/go-kit/kit v0.4.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
github.com/go-logfmt/logfmt v0.5.1 h1:otpy5pqBCBZ1ng9RQ0dPu4PN7ba75Y/aA+UpowDyNVA=
github.com/go-logfmt/logfmt v0.5.1/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
github.com/go-stack/stack v1.6.0 h1:MmJCxYVKTJ0SplGKqFVX3SBnmaUhODHZrrFF6jMbpZk=
github.com/go-stack/stack v1.6.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
github.com/smallstep/pkcs7 v0.0.0-20231024181729-3b98ecc1ca81 h1:B6cED3iLJTgxpdh4tuqByDjRRKan2EvtnOfHr2zHJVg=
github.com/smallstep/pkcs7 v0.0.0-20231024181729-3b98ecc1ca81/go.mod h1:SoUAr/4M46rZ3WaLstHxGhLEgoYIDRqxQEXLOmOEB0Y=
github.com/smallstep/scep v0.0.0-20231024192529-aee96d7ad34d h1:06LUHn4Ia2X6syjIaCMNaXXDNdU+1N/oOHynJbWgpXw=
github.com/smallstep/scep v0.0.0-20231024192529-aee96d7ad34d/go.mod h1:4d0ub42ut1mMtvGyMensjuHYEUpRrASvkzLEJvoRQcU=

package main

import (
	"crypto/rand"
	"crypto/rsa"
	"crypto/x509"
	"crypto/x509/pkix"
	"fmt"
	"math/big"
	"time"

	"github.com/smallstep/scep"
	"github.com/smallstep/scep/x509util"
)

func main() {
	caKey, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		fmt.Printf("generate CA key error: %v\n", err)
		return
	}
	caTmpl := &x509.Certificate{
		SerialNumber:          big.NewInt(1),
		Subject:               pkix.Name{CommonName: "SCEP CA"},
		NotBefore:             time.Now().Add(-1 * time.Hour),
		NotAfter:              time.Now().Add(24 * time.Hour),
		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageCRLSign | x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
		BasicConstraintsValid: true,
		IsCA:                  true,
	}
	caDer, err := x509.CreateCertificate(rand.Reader, caTmpl, caTmpl, &caKey.PublicKey, caKey)
	if err != nil {
		fmt.Printf("create CA cert error: %v\n", err)
		return
	}
	caCert, err := x509.ParseCertificate(caDer)
	if err != nil {
		fmt.Printf("parse CA cert error: %v\n", err)
		return
	}

	clientKey, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		fmt.Printf("generate client key error: %v\n", err)
		return
	}
	clientTmpl := &x509.Certificate{
		SerialNumber:          big.NewInt(2),
		Subject:               pkix.Name{CommonName: "client.example.com"},
		NotBefore:             time.Now().Add(-1 * time.Hour),
		NotAfter:              time.Now().Add(24 * time.Hour),
		KeyUsage:              x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
		BasicConstraintsValid: true,
	}
	clientDer, err := x509.CreateCertificate(rand.Reader, clientTmpl, clientTmpl, &clientKey.PublicKey, clientKey)
	if err != nil {
		fmt.Printf("create client cert error: %v\n", err)
		return
	}
	clientCert, err := x509.ParseCertificate(clientDer)
	if err != nil {
		fmt.Printf("parse client cert error: %v\n", err)
		return
	}

	csrTmpl := &x509util.CertificateRequest{
		CertificateRequest: x509.CertificateRequest{
			Subject:            pkix.Name{CommonName: "client.example.com"},
			SignatureAlgorithm: x509.SHA256WithRSA,
		},
		ChallengePassword: "bad-challenge-password",
	}
	csrDer, err := x509util.CreateCertificateRequest(rand.Reader, csrTmpl, clientKey)
	if err != nil {
		fmt.Printf("create CSR error: %v\n", err)
		return
	}
	csr, err := x509.ParseCertificateRequest(csrDer)
	if err != nil {
		fmt.Printf("parse CSR error: %v\n", err)
		return
	}

	reqTmpl := &scep.PKIMessage{
		MessageType: scep.PKCSReq,
		Recipients:  []*x509.Certificate{caCert},
		SignerCert:  clientCert,
		SignerKey:   clientKey,
	}
	reqMsg, err := scep.NewCSRRequest(csr, reqTmpl)
	if err != nil {
		fmt.Printf("NewCSRRequest error: %v\n", err)
		return
	}

	serverParsedReq, err := scep.ParsePKIMessage(reqMsg.Raw)
	if err != nil {
		fmt.Printf("ParsePKIMessage error: %v\n", err)
		return
	}

	failMsg, err := serverParsedReq.Fail(caCert, caKey, scep.BadRequest)
	if err != nil {
		fmt.Printf("Fail error: %v\n", err)
		return
	}

	clientParsedFail, err := scep.ParsePKIMessage(failMsg.Raw, scep.WithCACerts([]*x509.Certificate{caCert}))
	if err != nil {
		fmt.Printf("client ParsePKIMessage error: %v\n", err)
		return
	}

	if clientParsedFail.CertRepMessage != nil && clientParsedFail.CertRepMessage.PKIStatus == scep.FAILURE {
		fmt.Printf("Successfully generated and verified SCEP FAILURE response with status %s and failInfo %v\n",
			clientParsedFail.CertRepMessage.PKIStatus,
			clientParsedFail.CertRepMessage.FailInfo)
	}
}

{
  "schemaVersion": 1,
  "goal": "verify github.com/smallstep/scep.FAILURE in pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d",
  "kind": "HOW",
  "packages": [
    "pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d"
  ],
  "symbols": [
    "github.com/smallstep/scep.FAILURE"
  ]
}

package main

import (
	"bytes"
	"crypto/rand"
	"crypto/rsa"
	"crypto/x509"
	"crypto/x509/pkix"
	"fmt"
	"math/big"
	"os"
	"time"

	"github.com/smallstep/scep"
	"github.com/smallstep/scep/x509util"
)

func generateCA() (*x509.Certificate, *rsa.PrivateKey, error) {
	key, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		return nil, nil, err
	}

	serial, _ := rand.Int(rand.Reader, big.NewInt(1000000))
	tmpl := &x509.Certificate{
		SerialNumber: serial,
		Subject: pkix.Name{
			CommonName: "Contract Test CA",
		},
		NotBefore:             time.Now().Add(-1 * time.Hour),
		NotAfter:              time.Now().Add(24 * time.Hour),
		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageCRLSign | x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
		BasicConstraintsValid: true,
		IsCA:                  true,
	}

	der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &key.PublicKey, key)
	if err != nil {
		return nil, nil, err
	}
	cert, err := x509.ParseCertificate(der)
	if err != nil {
		return nil, nil, err
	}
	return cert, key, nil
}

func generateClientCert(cn string) (*x509.Certificate, *rsa.PrivateKey, error) {
	key, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		return nil, nil, err
	}

	serial, _ := rand.Int(rand.Reader, big.NewInt(1000000))
	tmpl := &x509.Certificate{
		SerialNumber: serial,
		Subject: pkix.Name{
			CommonName: cn,
		},
		NotBefore:             time.Now().Add(-1 * time.Hour),
		NotAfter:              time.Now().Add(24 * time.Hour),
		KeyUsage:              x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
		BasicConstraintsValid: true,
	}

	der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &key.PublicKey, key)
	if err != nil {
		return nil, nil, err
	}
	cert, err := x509.ParseCertificate(der)
	if err != nil {
		return nil, nil, err
	}
	return cert, key, nil
}

func createRequest(caCert *x509.Certificate, clientCert *x509.Certificate, clientKey *rsa.PrivateKey) (*scep.PKIMessage, error) {
	csrTmpl := &x509util.CertificateRequest{
		CertificateRequest: x509.CertificateRequest{
			Subject: pkix.Name{
				CommonName: clientCert.Subject.CommonName,
			},
			SignatureAlgorithm: x509.SHA256WithRSA,
		},
		ChallengePassword: "contract-test-challenge",
	}
	csrDer, err := x509util.CreateCertificateRequest(rand.Reader, csrTmpl, clientKey)
	if err != nil {
		return nil, err
	}
	csr, err := x509.ParseCertificateRequest(csrDer)
	if err != nil {
		return nil, err
	}

	reqTmpl := &scep.PKIMessage{
		MessageType: scep.PKCSReq,
		Recipients:  []*x509.Certificate{caCert},
		SignerCert:  clientCert,
		SignerKey:   clientKey,
	}
	return scep.NewCSRRequest(csr, reqTmpl)
}

func main() {
	// Assertion 1: scep.FAILURE constant has the SCEP protocol string value "2"
	{
		if scep.FAILURE != "2" {
			fmt.Fprintf(os.Stderr, "Contract 1 failed: expected scep.FAILURE to be \"2\", got %q\n", string(scep.FAILURE))
			os.Exit(1)
		}
	}

	caCert, caKey, err := generateCA()
	if err != nil {
		fmt.Fprintf(os.Stderr, "Contract setup failed: CA generation error: %v\n", err)
		os.Exit(1)
	}

	clientCert, clientKey, err := generateClientCert("client.contract.test")
	if err != nil {
		fmt.Fprintf(os.Stderr, "Contract setup failed: Client cert generation error: %v\n", err)
		os.Exit(1)
	}

	scepReq, err := createRequest(caCert, clientCert, clientKey)
	if err != nil {
		fmt.Fprintf(os.Stderr, "Contract setup failed: createRequest error: %v\n", err)
		os.Exit(1)
	}

	parsedReq, err := scep.ParsePKIMessage(scepReq.Raw)
	if err != nil {
		fmt.Fprintf(os.Stderr, "Contract setup failed: ParsePKIMessage error: %v\n", err)
		os.Exit(1)
	}

	// Assertion 2: scep.PKIMessage.Fail constructs a signed CertRep FAILURE response with scep.FAILURE status and scep.BadRequest failInfo
	{
		failMsg, err := parsedReq.Fail(caCert, caKey, scep.BadRequest)
		if err != nil {
			fmt.Fprintf(os.Stderr, "Contract 2 failed: Fail returned error: %v\n", err)
			os.Exit(1)
		}
		if failMsg == nil || len(failMsg.Raw) == 0 {
			fmt.Fprintf(os.Stderr, "Contract 2 failed: empty failMsg Raw bytes\n")
			os.Exit(1)
		}
		if failMsg.MessageType != scep.CertRep {
			fmt.Fprintf(os.Stderr, "Contract 2 failed: expected MessageType %v, got %v\n", scep.CertRep, failMsg.MessageType)
			os.Exit(1)
		}

		parsedFail, err := scep.ParsePKIMessage(failMsg.Raw, scep.WithCACerts([]*x509.Certificate{caCert}))
		if err != nil {
			fmt.Fprintf(os.Stderr, "Contract 2 failed: ParsePKIMessage returned error: %v\n", err)
			os.Exit(1)
		}
		if parsedFail.CertRepMessage == nil {
			fmt.Fprintf(os.Stderr, "Contract 2 failed: CertRepMessage is nil\n")
			os.Exit(1)
		}
		if parsedFail.CertRepMessage.PKIStatus != scep.FAILURE {
			fmt.Fprintf(os.Stderr, "Contract 2 failed: expected PKIStatus %v, got %v\n", scep.FAILURE, parsedFail.CertRepMessage.PKIStatus)
			os.Exit(1)
		}
		if parsedFail.CertRepMessage.FailInfo != scep.BadRequest {
			fmt.Fprintf(os.Stderr, "Contract 2 failed: expected FailInfo %v, got %v\n", scep.BadRequest, parsedFail.CertRepMessage.FailInfo)
			os.Exit(1)
		}
	}

	// Assertion 3: scep.PKIMessage.Fail supports all standard SCEP failInfo reasons (BadAlg, BadMessageCheck, BadTime, BadCertID) with scep.FAILURE
	{
		reasons := []scep.FailInfo{
			scep.BadAlg,
			scep.BadMessageCheck,
			scep.BadTime,
			scep.BadCertID,
		}

		for _, reason := range reasons {
			failMsg, err := parsedReq.Fail(caCert, caKey, reason)
			if err != nil {
				fmt.Fprintf(os.Stderr, "Contract 3 failed for reason %v: Fail error: %v\n", reason, err)
				os.Exit(1)
			}
			parsedFail, err := scep.ParsePKIMessage(failMsg.Raw, scep.WithCACerts([]*x509.Certificate{caCert}))
			if err != nil {
				fmt.Fprintf(os.Stderr, "Contract 3 failed for reason %v: ParsePKIMessage error: %v\n", reason, err)
				os.Exit(1)
			}
			if parsedFail.CertRepMessage == nil || parsedFail.CertRepMessage.PKIStatus != scep.FAILURE {
				fmt.Fprintf(os.Stderr, "Contract 3 failed for reason %v: expected PKIStatus FAILURE\n", reason)
				os.Exit(1)
			}
			if parsedFail.CertRepMessage.FailInfo != reason {
				fmt.Fprintf(os.Stderr, "Contract 3 failed for reason %v: expected FailInfo %v, got %v\n", reason, reason, parsedFail.CertRepMessage.FailInfo)
				os.Exit(1)
			}
		}
	}

	// Assertion 4: scep.PKIMessage.Fail preserves transaction correlation by matching TransactionID and setting RecipientNonce to the request's SenderNonce
	{
		failMsg, err := parsedReq.Fail(caCert, caKey, scep.BadRequest)
		if err != nil {
			fmt.Fprintf(os.Stderr, "Contract 4 failed: Fail error: %v\n", err)
			os.Exit(1)
		}
		if failMsg.TransactionID != parsedReq.TransactionID {
			fmt.Fprintf(os.Stderr, "Contract 4 failed: TransactionID mismatch: expected %v, got %v\n", parsedReq.TransactionID, failMsg.TransactionID)
			os.Exit(1)
		}
		if !bytes.Equal(failMsg.RecipientNonce, parsedReq.SenderNonce) {
			fmt.Fprintf(os.Stderr, "Contract 4 failed: RecipientNonce mismatch with request SenderNonce\n")
			os.Exit(1)
		}

		parsedFail, err := scep.ParsePKIMessage(failMsg.Raw, scep.WithCACerts([]*x509.Certificate{caCert}))
		if err != nil {
			fmt.Fprintf(os.Stderr, "Contract 4 failed: ParsePKIMessage error: %v\n", err)
			os.Exit(1)
		}
		if parsedFail.TransactionID != scepReq.TransactionID {
			fmt.Fprintf(os.Stderr, "Contract 4 failed: parsed TransactionID mismatch: expected %v, got %v\n", scepReq.TransactionID, parsedFail.TransactionID)
			os.Exit(1)
		}
		if !bytes.Equal(parsedFail.RecipientNonce, scepReq.SenderNonce) {
			fmt.Fprintf(os.Stderr, "Contract 4 failed: parsed RecipientNonce mismatch with original SenderNonce\n")
			os.Exit(1)
		}
	}

	fmt.Println("All contract assertions passed.")
}