github.com/smallstep/scep v0.0.0-20231024192529-aee96d7ad34d: ParsePKIMessage

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify github.com/smallstep/scep.ParsePKIMessage in pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d
Demonstrate these symbols/APIs:
  - github.com/smallstep/scep.ParsePKIMessage

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:9a061c5e6d6b14d716ee806d97a829fc52d6f5f130e3589ffeaab367442c4a73","contract":["scep.ParsePKIMessage parses raw DER bytes into a PKIMessage with matching MessageType, TransactionID, and SenderNonce","scep.ParsePKIMessage populates the Raw field with the exact input bytes","scep.ParsePKIMessage with scep.WithLogger receives structured log events during parsing","scep.ParsePKIMessage allows decrypting the inner PKI envelope from the parsed request to access the CSR","scep.ParsePKIMessage with scep.WithCACerts successfully parses and verifies a CertRep response signed by the CA","scep.ParsePKIMessage with scep.WithCACerts fails verification when an untrusted CA cert is provided","scep.ParsePKIMessage parses a CertRep FAILURE response with matching FailInfo","scep.ParsePKIMessage returns an error when given invalid or empty input bytes"],"goal":"verify github.com/smallstep/scep.ParsePKIMessage in pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d","kind":"HOW","packages":["pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d"],"schemaVersion":1,"symbols":["github.com/smallstep/scep.ParsePKIMessage"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d"],"schemaVersion":1,"subject":"pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d","symbols":["github.com/smallstep/scep.ParsePKIMessage"],"verifierAdapter":"golang@1"}

module sample

go 1.26.6

require (
	github.com/go-kit/kit v0.4.0 // indirect
	github.com/go-logfmt/logfmt v0.5.1 // indirect
	github.com/go-stack/stack v1.6.0 // indirect
	github.com/smallstep/pkcs7 v0.0.0-20231024181729-3b98ecc1ca81 // indirect
	github.com/smallstep/scep v0.0.0-20231024192529-aee96d7ad34d // indirect
)

github.com/go-kit/kit v0.4.0 h1:KeVK+Emj3c3S4eRztFuzbFYb2BAgf2jmwDwyXEri7Lo=
github.com/go-kit/kit v0.4.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
github.com/go-logfmt/logfmt v0.5.1 h1:otpy5pqBCBZ1ng9RQ0dPu4PN7ba75Y/aA+UpowDyNVA=
github.com/go-logfmt/logfmt v0.5.1/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
github.com/go-stack/stack v1.6.0 h1:MmJCxYVKTJ0SplGKqFVX3SBnmaUhODHZrrFF6jMbpZk=
github.com/go-stack/stack v1.6.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
github.com/smallstep/pkcs7 v0.0.0-20231024181729-3b98ecc1ca81 h1:B6cED3iLJTgxpdh4tuqByDjRRKan2EvtnOfHr2zHJVg=
github.com/smallstep/pkcs7 v0.0.0-20231024181729-3b98ecc1ca81/go.mod h1:SoUAr/4M46rZ3WaLstHxGhLEgoYIDRqxQEXLOmOEB0Y=
github.com/smallstep/scep v0.0.0-20231024192529-aee96d7ad34d h1:06LUHn4Ia2X6syjIaCMNaXXDNdU+1N/oOHynJbWgpXw=
github.com/smallstep/scep v0.0.0-20231024192529-aee96d7ad34d/go.mod h1:4d0ub42ut1mMtvGyMensjuHYEUpRrASvkzLEJvoRQcU=

package main

import (
	"crypto/rand"
	"crypto/rsa"
	"crypto/x509"
	"crypto/x509/pkix"
	"fmt"
	"math/big"
	"time"

	"github.com/smallstep/scep"
)

func main() {
	// 1. Generate CA RSA key and self-signed CA certificate
	caKey, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		panic(err)
	}
	caTmpl := &x509.Certificate{
		SerialNumber: big.NewInt(1),
		Subject: pkix.Name{
			CommonName: "Example SCEP CA",
		},
		NotBefore:             time.Now().Add(-1 * time.Hour),
		NotAfter:              time.Now().Add(24 * time.Hour),
		IsCA:                  true,
		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageCRLSign | x509.KeyUsageDigitalSignature,
		BasicConstraintsValid: true,
	}
	caDer, err := x509.CreateCertificate(rand.Reader, caTmpl, caTmpl, &caKey.PublicKey, caKey)
	if err != nil {
		panic(err)
	}
	caCert, err := x509.ParseCertificate(caDer)
	if err != nil {
		panic(err)
	}

	// 2. Generate Client RSA key and self-signed certificate for SCEP request signing
	clientKey, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		panic(err)
	}
	clientTmpl := &x509.Certificate{
		SerialNumber: big.NewInt(2),
		Subject: pkix.Name{
			CommonName: "Example SCEP Client",
		},
		NotBefore: time.Now().Add(-1 * time.Hour),
		NotAfter:  time.Now().Add(24 * time.Hour),
	}
	clientDer, err := x509.CreateCertificate(rand.Reader, clientTmpl, clientTmpl, &clientKey.PublicKey, clientKey)
	if err != nil {
		panic(err)
	}
	clientCert, err := x509.ParseCertificate(clientDer)
	if err != nil {
		panic(err)
	}

	// 3. Create CSR for target identity
	csrTmpl := &x509.CertificateRequest{
		Subject: pkix.Name{
			CommonName: "device.example.com",
		},
		SignatureAlgorithm: x509.SHA256WithRSA,
	}
	csrDer, err := x509.CreateCertificateRequest(rand.Reader, csrTmpl, clientKey)
	if err != nil {
		panic(err)
	}
	csr, err := x509.ParseCertificateRequest(csrDer)
	if err != nil {
		panic(err)
	}

	// 4. Construct SCEP PKCSReq message template and generate request DER bytes
	reqTmpl := &scep.PKIMessage{
		MessageType:   scep.PKCSReq,
		TransactionID: scep.TransactionID("tx-sample-001"),
		SenderNonce:   scep.SenderNonce([]byte("1234567890123456")),
		Recipients:    []*x509.Certificate{caCert},
		SignerCert:    clientCert,
		SignerKey:     clientKey,
	}
	reqMsg, err := scep.NewCSRRequest(csr, reqTmpl)
	if err != nil {
		panic(err)
	}

	// 5. Parse the PKCSReq DER bytes on the CA side using ParsePKIMessage
	parsedReq, err := scep.ParsePKIMessage(reqMsg.Raw)
	if err != nil {
		panic(err)
	}
	fmt.Printf("Parsed request MessageType: %s, TransactionID: %s\n", parsedReq.MessageType, parsedReq.TransactionID)

	// Decrypt envelope to extract CSR
	if err := parsedReq.DecryptPKIEnvelope(caCert, caKey); err != nil {
		panic(err)
	}
	fmt.Printf("Decrypted CSR subject CommonName: %s\n", parsedReq.CSRReqMessage.CSR.Subject.CommonName)

	// 6. Issue certificate and generate SCEP CertRep response
	issuedTmpl := &x509.Certificate{
		SerialNumber: big.NewInt(100),
		Subject:      csr.Subject,
		NotBefore:    time.Now().Add(-1 * time.Hour),
		NotAfter:     time.Now().Add(24 * time.Hour),
		KeyUsage:     x509.KeyUsageDigitalSignature,
	}
	issuedDer, err := x509.CreateCertificate(rand.Reader, issuedTmpl, caCert, csr.PublicKey, caKey)
	if err != nil {
		panic(err)
	}
	issuedCert, err := x509.ParseCertificate(issuedDer)
	if err != nil {
		panic(err)
	}

	respMsg, err := parsedReq.Success(caCert, caKey, issuedCert)
	if err != nil {
		panic(err)
	}

	// 7. Parse the CertRep response on the client side using ParsePKIMessage with CA verification
	parsedResp, err := scep.ParsePKIMessage(respMsg.Raw, scep.WithCACerts([]*x509.Certificate{caCert}))
	if err != nil {
		panic(err)
	}
	fmt.Printf("Parsed response MessageType: %s, PKIStatus: %s\n", parsedResp.MessageType, parsedResp.CertRepMessage.PKIStatus)

	if err := parsedResp.DecryptPKIEnvelope(clientCert, clientKey); err != nil {
		panic(err)
	}
	fmt.Printf("Decrypted issued cert serial: %s\n", parsedResp.CertRepMessage.Certificate.SerialNumber.String())
}

{
  "schemaVersion": 1,
  "goal": "verify github.com/smallstep/scep.ParsePKIMessage in pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d",
  "kind": "HOW",
  "packages": [
    "pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d"
  ],
  "symbols": [
    "github.com/smallstep/scep.ParsePKIMessage"
  ]
}

package main

import (
	"bytes"
	"crypto/rand"
	"crypto/rsa"
	"crypto/x509"
	"crypto/x509/pkix"
	"fmt"
	"math/big"
	"os"
	"time"

	"github.com/smallstep/scep"
)

type contractLogger struct {
	entries []string
}

func (l *contractLogger) Log(keyvals ...interface{}) error {
	l.entries = append(l.entries, fmt.Sprint(keyvals...))
	return nil
}

func main() {
	// Setup CA certificate and key
	caKey, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		fmt.Fprintf(os.Stderr, "Contract setup failed: GenerateKey (CA) error: %v\n", err)
		os.Exit(1)
	}
	caTmpl := &x509.Certificate{
		SerialNumber: big.NewInt(100),
		Subject: pkix.Name{
			CommonName: "Contract Test CA",
		},
		NotBefore:             time.Now().Add(-1 * time.Hour),
		NotAfter:              time.Now().Add(24 * time.Hour),
		IsCA:                  true,
		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageCRLSign | x509.KeyUsageDigitalSignature,
		BasicConstraintsValid: true,
	}
	caDer, err := x509.CreateCertificate(rand.Reader, caTmpl, caTmpl, &caKey.PublicKey, caKey)
	if err != nil {
		fmt.Fprintf(os.Stderr, "Contract setup failed: CreateCertificate (CA) error: %v\n", err)
		os.Exit(1)
	}
	caCert, err := x509.ParseCertificate(caDer)
	if err != nil {
		fmt.Fprintf(os.Stderr, "Contract setup failed: ParseCertificate (CA) error: %v\n", err)
		os.Exit(1)
	}

	// Setup Client certificate and key
	clientKey, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		fmt.Fprintf(os.Stderr, "Contract setup failed: GenerateKey (Client) error: %v\n", err)
		os.Exit(1)
	}
	clientTmpl := &x509.Certificate{
		SerialNumber: big.NewInt(101),
		Subject: pkix.Name{
			CommonName: "Contract Test Client",
		},
		NotBefore: time.Now().Add(-1 * time.Hour),
		NotAfter:  time.Now().Add(24 * time.Hour),
	}
	clientDer, err := x509.CreateCertificate(rand.Reader, clientTmpl, clientTmpl, &clientKey.PublicKey, clientKey)
	if err != nil {
		fmt.Fprintf(os.Stderr, "Contract setup failed: CreateCertificate (Client) error: %v\n", err)
		os.Exit(1)
	}
	clientCert, err := x509.ParseCertificate(clientDer)
	if err != nil {
		fmt.Fprintf(os.Stderr, "Contract setup failed: ParseCertificate (Client) error: %v\n", err)
		os.Exit(1)
	}

	// Setup CSR
	csrTmpl := &x509.CertificateRequest{
		Subject: pkix.Name{
			CommonName: "contract-node.example.com",
		},
		SignatureAlgorithm: x509.SHA256WithRSA,
	}
	csrDer, err := x509.CreateCertificateRequest(rand.Reader, csrTmpl, clientKey)
	if err != nil {
		fmt.Fprintf(os.Stderr, "Contract setup failed: CreateCertificateRequest error: %v\n", err)
		os.Exit(1)
	}
	csr, err := x509.ParseCertificateRequest(csrDer)
	if err != nil {
		fmt.Fprintf(os.Stderr, "Contract setup failed: ParseCertificateRequest error: %v\n", err)
		os.Exit(1)
	}

	// Create a sample PKCSReq message
	reqTmpl := &scep.PKIMessage{
		MessageType: scep.PKCSReq,
		Recipients:  []*x509.Certificate{caCert},
		SignerCert:  clientCert,
		SignerKey:   clientKey,
	}
	reqMsg, err := scep.NewCSRRequest(csr, reqTmpl)
	if err != nil {
		fmt.Fprintf(os.Stderr, "Contract setup failed: NewCSRRequest error: %v\n", err)
		os.Exit(1)
	}

	// Assertion 1: scep.ParsePKIMessage parses raw DER bytes into a PKIMessage with matching MessageType, TransactionID, and SenderNonce
	var parsedReq *scep.PKIMessage
	{
		parsedReq, err = scep.ParsePKIMessage(reqMsg.Raw)
		if err != nil {
			fmt.Fprintf(os.Stderr, "Assertion 1 failed: ParsePKIMessage returned error: %v\n", err)
			os.Exit(1)
		}
		if parsedReq.MessageType != scep.PKCSReq {
			fmt.Fprintf(os.Stderr, "Assertion 1 failed: expected MessageType %v, got %v\n", scep.PKCSReq, parsedReq.MessageType)
			os.Exit(1)
		}
		if parsedReq.TransactionID != reqMsg.TransactionID {
			fmt.Fprintf(os.Stderr, "Assertion 1 failed: expected TransactionID %v, got %v\n", reqMsg.TransactionID, parsedReq.TransactionID)
			os.Exit(1)
		}
		if len(parsedReq.SenderNonce) == 0 || !bytes.Equal(parsedReq.SenderNonce, reqMsg.SenderNonce) {
			fmt.Fprintf(os.Stderr, "Assertion 1 failed: SenderNonce mismatch or empty\n")
			os.Exit(1)
		}
	}

	// Assertion 2: scep.ParsePKIMessage populates the Raw field with the exact input bytes
	{
		if !bytes.Equal(parsedReq.Raw, reqMsg.Raw) {
			fmt.Fprintf(os.Stderr, "Assertion 2 failed: parsedReq.Raw does not match original bytes\n")
			os.Exit(1)
		}
	}

	// Assertion 3: scep.ParsePKIMessage with scep.WithLogger receives structured log events during parsing
	{
		logger := &contractLogger{}
		loggedMsg, err := scep.ParsePKIMessage(reqMsg.Raw, scep.WithLogger(logger))
		if err != nil {
			fmt.Fprintf(os.Stderr, "Assertion 3 failed: ParsePKIMessage with logger error: %v\n", err)
			os.Exit(1)
		}
		if loggedMsg == nil || len(logger.entries) == 0 {
			fmt.Fprintf(os.Stderr, "Assertion 3 failed: expected log entries from custom logger\n")
			os.Exit(1)
		}
	}

	// Assertion 4: scep.ParsePKIMessage allows decrypting the inner PKI envelope from the parsed request to access the CSR
	{
		if err := parsedReq.DecryptPKIEnvelope(caCert, caKey); err != nil {
			fmt.Fprintf(os.Stderr, "Assertion 4 failed: DecryptPKIEnvelope returned error: %v\n", err)
			os.Exit(1)
		}
		if parsedReq.CSRReqMessage == nil || parsedReq.CSRReqMessage.CSR == nil {
			fmt.Fprintf(os.Stderr, "Assertion 4 failed: decrypted CSR is nil\n")
			os.Exit(1)
		}
		if parsedReq.CSRReqMessage.CSR.Subject.CommonName != "contract-node.example.com" {
			fmt.Fprintf(os.Stderr, "Assertion 4 failed: expected CommonName 'contract-node.example.com', got %q\n", parsedReq.CSRReqMessage.CSR.Subject.CommonName)
			os.Exit(1)
		}
	}

	// Assertion 5: scep.ParsePKIMessage with scep.WithCACerts successfully parses and verifies a CertRep response signed by the CA
	var respMsg *scep.PKIMessage
	{
		issuedTmpl := &x509.Certificate{
			SerialNumber: big.NewInt(300),
			Subject:      csr.Subject,
			NotBefore:    time.Now().Add(-1 * time.Hour),
			NotAfter:     time.Now().Add(24 * time.Hour),
			KeyUsage:     x509.KeyUsageDigitalSignature,
		}
		issuedDer, err := x509.CreateCertificate(rand.Reader, issuedTmpl, caCert, csr.PublicKey, caKey)
		if err != nil {
			fmt.Fprintf(os.Stderr, "Assertion 5 setup failed: CreateCertificate error: %v\n", err)
			os.Exit(1)
		}
		issuedCert, err := x509.ParseCertificate(issuedDer)
		if err != nil {
			fmt.Fprintf(os.Stderr, "Assertion 5 setup failed: ParseCertificate error: %v\n", err)
			os.Exit(1)
		}

		respMsg, err = parsedReq.Success(caCert, caKey, issuedCert)
		if err != nil {
			fmt.Fprintf(os.Stderr, "Assertion 5 failed: Success returned error: %v\n", err)
			os.Exit(1)
		}

		parsedResp, err := scep.ParsePKIMessage(respMsg.Raw, scep.WithCACerts([]*x509.Certificate{caCert}))
		if err != nil {
			fmt.Fprintf(os.Stderr, "Assertion 5 failed: ParsePKIMessage with CACerts error: %v\n", err)
			os.Exit(1)
		}
		if parsedResp.CertRepMessage == nil || parsedResp.CertRepMessage.PKIStatus != scep.SUCCESS {
			fmt.Fprintf(os.Stderr, "Assertion 5 failed: expected PKIStatus SUCCESS\n")
			os.Exit(1)
		}
		if err := parsedResp.DecryptPKIEnvelope(clientCert, clientKey); err != nil {
			fmt.Fprintf(os.Stderr, "Assertion 5 failed: DecryptPKIEnvelope on response error: %v\n", err)
			os.Exit(1)
		}
		if parsedResp.CertRepMessage.Certificate.SerialNumber.Cmp(big.NewInt(300)) != 0 {
			fmt.Fprintf(os.Stderr, "Assertion 5 failed: decrypted certificate serial mismatch\n")
			os.Exit(1)
		}
	}

	// Assertion 6: scep.ParsePKIMessage with scep.WithCACerts fails verification when an untrusted CA cert is provided
	{
		unrelatedKey, _ := rsa.GenerateKey(rand.Reader, 2048)
		unrelatedTmpl := &x509.Certificate{
			SerialNumber: big.NewInt(999),
			Subject:      pkix.Name{CommonName: "Untrusted CA"},
			NotBefore:    time.Now().Add(-1 * time.Hour),
			NotAfter:     time.Now().Add(24 * time.Hour),
			IsCA:         true,
		}
		unrelatedDer, _ := x509.CreateCertificate(rand.Reader, unrelatedTmpl, unrelatedTmpl, &unrelatedKey.PublicKey, unrelatedKey)
		untrustedCert, _ := x509.ParseCertificate(unrelatedDer)

		_, err := scep.ParsePKIMessage(respMsg.Raw, scep.WithCACerts([]*x509.Certificate{untrustedCert}))
		if err == nil {
			fmt.Fprintf(os.Stderr, "Assertion 6 failed: expected error when verifying with untrusted CA, got nil\n")
			os.Exit(1)
		}
	}

	// Assertion 7: scep.ParsePKIMessage parses a CertRep FAILURE response with matching FailInfo
	{
		failMsg, err := parsedReq.Fail(caCert, caKey, scep.BadAlg)
		if err != nil {
			fmt.Fprintf(os.Stderr, "Assertion 7 failed: Fail returned error: %v\n", err)
			os.Exit(1)
		}
		parsedFail, err := scep.ParsePKIMessage(failMsg.Raw, scep.WithCACerts([]*x509.Certificate{caCert}))
		if err != nil {
			fmt.Fprintf(os.Stderr, "Assertion 7 failed: ParsePKIMessage on fail message error: %v\n", err)
			os.Exit(1)
		}
		if parsedFail.CertRepMessage == nil || parsedFail.CertRepMessage.PKIStatus != scep.FAILURE {
			fmt.Fprintf(os.Stderr, "Assertion 7 failed: expected PKIStatus FAILURE\n")
			os.Exit(1)
		}
		if parsedFail.CertRepMessage.FailInfo != scep.BadAlg {
			fmt.Fprintf(os.Stderr, "Assertion 7 failed: expected FailInfo BadAlg, got %v\n", parsedFail.CertRepMessage.FailInfo)
			os.Exit(1)
		}
	}

	// Assertion 8: scep.ParsePKIMessage returns an error when given invalid or empty input bytes
	{
		_, err := scep.ParsePKIMessage(nil)
		if err == nil {
			fmt.Fprintf(os.Stderr, "Assertion 8 failed: expected error for nil input, got nil\n")
			os.Exit(1)
		}

		_, err = scep.ParsePKIMessage([]byte("invalid-pkcs7-der-data"))
		if err == nil {
			fmt.Fprintf(os.Stderr, "Assertion 8 failed: expected error for invalid bytes, got nil\n")
			os.Exit(1)
		}
	}

	fmt.Println("All ParsePKIMessage contract assertions passed.")
}