github.com/smallstep/scep v0.0.0-20231024192529-aee96d7ad34d: PKCSReq

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify github.com/smallstep/scep.PKCSReq in pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d
Demonstrate these symbols/APIs:
  - github.com/smallstep/scep.PKCSReq
Constraints:
  - executionContext: node
Required runtime conditions:
  - ecosystem: npm
  - language: javascript
  - moduleSystem: esm
  - packageManager: npm@10.9.8
  - runtime: node@22.23.2

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:187b7acb3c133f2dbb71ac2c03edd29c53a9cfe5039c8e11c04ca59488b3581d","contract":["scep.PKCSReq constant defines the PKCS#10 certificate request MessageType with underlying value \"19\"","scep.PKCSReq.String() formats as descriptive string \"PKCSReq (19)\"","scep.NewCSRRequest creates a PKIMessage with MessageType scep.PKCSReq, populating Raw bytes, TransactionID, and SenderNonce","scep.ParsePKIMessage parses raw DER bytes into a PKIMessage with MessageType matching scep.PKCSReq","scep.PKIMessage.DecryptPKIEnvelope successfully decrypts the recipient-encrypted CSR payload from a PKCSReq message","scep.PKIMessage.Success constructs a CertRep SUCCESS response for a valid PKCSReq message","scep.PKIMessage.Fail constructs a CertRep FAILURE response with the specified FailInfo for a PKCSReq message","scep.NewCSRRequest returns an error when no recipient certificates are provided"],"goal":"verify github.com/smallstep/scep.PKCSReq in pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d","kind":"HOW","packages":["pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d"],"schemaVersion":1,"symbols":["github.com/smallstep/scep.PKCSReq"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d"],"schemaVersion":1,"subject":"pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d","symbols":["github.com/smallstep/scep.PKCSReq"],"verifierAdapter":"golang@1"}

module sample

go 1.26.6

require (
	github.com/go-kit/kit v0.4.0 // indirect
	github.com/go-logfmt/logfmt v0.5.1 // indirect
	github.com/go-stack/stack v1.6.0 // indirect
	github.com/smallstep/pkcs7 v0.0.0-20231024181729-3b98ecc1ca81 // indirect
	github.com/smallstep/scep v0.0.0-20231024192529-aee96d7ad34d // indirect
)

github.com/go-kit/kit v0.4.0 h1:KeVK+Emj3c3S4eRztFuzbFYb2BAgf2jmwDwyXEri7Lo=
github.com/go-kit/kit v0.4.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
github.com/go-logfmt/logfmt v0.5.1 h1:otpy5pqBCBZ1ng9RQ0dPu4PN7ba75Y/aA+UpowDyNVA=
github.com/go-logfmt/logfmt v0.5.1/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
github.com/go-stack/stack v1.6.0 h1:MmJCxYVKTJ0SplGKqFVX3SBnmaUhODHZrrFF6jMbpZk=
github.com/go-stack/stack v1.6.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
github.com/smallstep/pkcs7 v0.0.0-20231024181729-3b98ecc1ca81 h1:B6cED3iLJTgxpdh4tuqByDjRRKan2EvtnOfHr2zHJVg=
github.com/smallstep/pkcs7 v0.0.0-20231024181729-3b98ecc1ca81/go.mod h1:SoUAr/4M46rZ3WaLstHxGhLEgoYIDRqxQEXLOmOEB0Y=
github.com/smallstep/scep v0.0.0-20231024192529-aee96d7ad34d h1:06LUHn4Ia2X6syjIaCMNaXXDNdU+1N/oOHynJbWgpXw=
github.com/smallstep/scep v0.0.0-20231024192529-aee96d7ad34d/go.mod h1:4d0ub42ut1mMtvGyMensjuHYEUpRrASvkzLEJvoRQcU=

package main

import (
	"crypto/rand"
	"crypto/rsa"
	"crypto/x509"
	"crypto/x509/pkix"
	"fmt"
	"math/big"
	"time"

	"github.com/smallstep/scep"
)

func main() {
	// Generate CA key and self-signed CA certificate
	caKey, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		panic(err)
	}
	caTmpl := &x509.Certificate{
		SerialNumber: big.NewInt(1),
		Subject: pkix.Name{
			CommonName: "Example SCEP CA",
		},
		NotBefore:             time.Now().Add(-1 * time.Hour),
		NotAfter:              time.Now().Add(24 * time.Hour),
		IsCA:                  true,
		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageCRLSign | x509.KeyUsageDigitalSignature,
		BasicConstraintsValid: true,
	}
	caDer, err := x509.CreateCertificate(rand.Reader, caTmpl, caTmpl, &caKey.PublicKey, caKey)
	if err != nil {
		panic(err)
	}
	caCert, err := x509.ParseCertificate(caDer)
	if err != nil {
		panic(err)
	}

	// Generate Client key and self-signed certificate for SCEP signing
	clientKey, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		panic(err)
	}
	clientTmpl := &x509.Certificate{
		SerialNumber: big.NewInt(2),
		Subject: pkix.Name{
			CommonName: "Example SCEP Client",
		},
		NotBefore: time.Now().Add(-1 * time.Hour),
		NotAfter:  time.Now().Add(24 * time.Hour),
	}
	clientDer, err := x509.CreateCertificate(rand.Reader, clientTmpl, clientTmpl, &clientKey.PublicKey, clientKey)
	if err != nil {
		panic(err)
	}
	clientCert, err := x509.ParseCertificate(clientDer)
	if err != nil {
		panic(err)
	}

	// Create CSR
	csrTmpl := &x509.CertificateRequest{
		Subject: pkix.Name{
			CommonName: "device.example.com",
		},
		SignatureAlgorithm: x509.SHA256WithRSA,
	}
	csrDer, err := x509.CreateCertificateRequest(rand.Reader, csrTmpl, clientKey)
	if err != nil {
		panic(err)
	}
	csr, err := x509.ParseCertificateRequest(csrDer)
	if err != nil {
		panic(err)
	}

	// Construct SCEP PKCSReq message template
	reqTmpl := &scep.PKIMessage{
		MessageType: scep.PKCSReq,
		Recipients:  []*x509.Certificate{caCert},
		SignerCert:  clientCert,
		SignerKey:   clientKey,
	}

	// Create SCEP PKCSReq message
	msg, err := scep.NewCSRRequest(csr, reqTmpl)
	if err != nil {
		panic(err)
	}

	fmt.Printf("Created SCEP message with MessageType: %s (PKCSReq)\n", msg.MessageType)
	fmt.Printf("Transaction ID: %s\n", msg.TransactionID)
	fmt.Printf("Raw bytes length: %d\n", len(msg.Raw))

	// Parse the PKCSReq message
	parsed, err := scep.ParsePKIMessage(msg.Raw)
	if err != nil {
		panic(err)
	}
	fmt.Printf("Parsed MessageType: %s\n", parsed.MessageType)

	// Decrypt payload with CA credentials
	if err := parsed.DecryptPKIEnvelope(caCert, caKey); err != nil {
		panic(err)
	}
	fmt.Printf("Decrypted CSR CommonName: %s\n", parsed.CSRReqMessage.CSR.Subject.CommonName)
}

{
  "schemaVersion": 1,
  "goal": "verify github.com/smallstep/scep.PKCSReq in pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d",
  "kind": "HOW",
  "packages": [
    "pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d"
  ],
  "symbols": [
    "github.com/smallstep/scep.PKCSReq"
  ],
  "constraints": {
    "executionContext": "node"
  },
  "runtimeConditions": {
    "ecosystem": "npm",
    "language": "javascript",
    "moduleSystem": "esm",
    "packageManager": "npm@10.9.8",
    "runtime": "node@22.23.2"
  }
}

package main

import (
	"bytes"
	"crypto/rand"
	"crypto/rsa"
	"crypto/x509"
	"crypto/x509/pkix"
	"fmt"
	"math/big"
	"os"
	"strings"
	"time"

	"github.com/smallstep/scep"
)

func main() {
	// Setup CA certificate and key
	caKey, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		fmt.Fprintf(os.Stderr, "Contract setup failed: GenerateKey (CA) error: %v\n", err)
		os.Exit(1)
	}
	caTmpl := &x509.Certificate{
		SerialNumber: big.NewInt(100),
		Subject: pkix.Name{
			CommonName: "Contract Test CA",
		},
		NotBefore:             time.Now().Add(-1 * time.Hour),
		NotAfter:              time.Now().Add(24 * time.Hour),
		IsCA:                  true,
		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageCRLSign | x509.KeyUsageDigitalSignature,
		BasicConstraintsValid: true,
	}
	caDer, err := x509.CreateCertificate(rand.Reader, caTmpl, caTmpl, &caKey.PublicKey, caKey)
	if err != nil {
		fmt.Fprintf(os.Stderr, "Contract setup failed: CreateCertificate (CA) error: %v\n", err)
		os.Exit(1)
	}
	caCert, err := x509.ParseCertificate(caDer)
	if err != nil {
		fmt.Fprintf(os.Stderr, "Contract setup failed: ParseCertificate (CA) error: %v\n", err)
		os.Exit(1)
	}

	// Setup Client certificate and key
	clientKey, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		fmt.Fprintf(os.Stderr, "Contract setup failed: GenerateKey (Client) error: %v\n", err)
		os.Exit(1)
	}
	clientTmpl := &x509.Certificate{
		SerialNumber: big.NewInt(101),
		Subject: pkix.Name{
			CommonName: "Contract Test Client",
		},
		NotBefore: time.Now().Add(-1 * time.Hour),
		NotAfter:  time.Now().Add(24 * time.Hour),
	}
	clientDer, err := x509.CreateCertificate(rand.Reader, clientTmpl, clientTmpl, &clientKey.PublicKey, clientKey)
	if err != nil {
		fmt.Fprintf(os.Stderr, "Contract setup failed: CreateCertificate (Client) error: %v\n", err)
		os.Exit(1)
	}
	clientCert, err := x509.ParseCertificate(clientDer)
	if err != nil {
		fmt.Fprintf(os.Stderr, "Contract setup failed: ParseCertificate (Client) error: %v\n", err)
		os.Exit(1)
	}

	// Setup CSR
	csrTmpl := &x509.CertificateRequest{
		Subject: pkix.Name{
			CommonName: "endpoint.example.com",
		},
		SignatureAlgorithm: x509.SHA256WithRSA,
	}
	csrDer, err := x509.CreateCertificateRequest(rand.Reader, csrTmpl, clientKey)
	if err != nil {
		fmt.Fprintf(os.Stderr, "Contract setup failed: CreateCertificateRequest error: %v\n", err)
		os.Exit(1)
	}
	csr, err := x509.ParseCertificateRequest(csrDer)
	if err != nil {
		fmt.Fprintf(os.Stderr, "Contract setup failed: ParseCertificateRequest error: %v\n", err)
		os.Exit(1)
	}

	// Assertion 1: scep.PKCSReq constant defines the PKCS#10 certificate request MessageType with underlying value "19"
	{
		if string(scep.PKCSReq) != "19" {
			fmt.Fprintf(os.Stderr, "Assertion 1 failed: expected string(scep.PKCSReq) to be \"19\", got %q\n", string(scep.PKCSReq))
			os.Exit(1)
		}
	}

	// Assertion 2: scep.PKCSReq.String() formats as descriptive string "PKCSReq (19)"
	{
		if scep.PKCSReq.String() != "PKCSReq (19)" {
			fmt.Fprintf(os.Stderr, "Assertion 2 failed: expected scep.PKCSReq.String() to be \"PKCSReq (19)\", got %q\n", scep.PKCSReq.String())
			os.Exit(1)
		}
	}

	var reqMsg *scep.PKIMessage

	// Assertion 3: scep.NewCSRRequest creates a PKIMessage with MessageType scep.PKCSReq, populating Raw bytes, TransactionID, and SenderNonce
	{
		reqTmpl := &scep.PKIMessage{
			MessageType: scep.PKCSReq,
			Recipients:  []*x509.Certificate{caCert},
			SignerCert:  clientCert,
			SignerKey:   clientKey,
		}
		var err error
		reqMsg, err = scep.NewCSRRequest(csr, reqTmpl)
		if err != nil {
			fmt.Fprintf(os.Stderr, "Assertion 3 failed: NewCSRRequest returned error: %v\n", err)
			os.Exit(1)
		}
		if reqMsg.MessageType != scep.PKCSReq {
			fmt.Fprintf(os.Stderr, "Assertion 3 failed: expected MessageType %v, got %v\n", scep.PKCSReq, reqMsg.MessageType)
			os.Exit(1)
		}
		if len(reqMsg.Raw) == 0 {
			fmt.Fprintf(os.Stderr, "Assertion 3 failed: empty Raw bytes\n")
			os.Exit(1)
		}
		if reqMsg.TransactionID == "" {
			fmt.Fprintf(os.Stderr, "Assertion 3 failed: empty TransactionID\n")
			os.Exit(1)
		}
		if len(reqMsg.SenderNonce) == 0 {
			fmt.Fprintf(os.Stderr, "Assertion 3 failed: empty SenderNonce\n")
			os.Exit(1)
		}
	}

	var parsedReq *scep.PKIMessage

	// Assertion 4: scep.ParsePKIMessage parses raw DER bytes into a PKIMessage with MessageType matching scep.PKCSReq
	{
		var err error
		parsedReq, err = scep.ParsePKIMessage(reqMsg.Raw)
		if err != nil {
			fmt.Fprintf(os.Stderr, "Assertion 4 failed: ParsePKIMessage returned error: %v\n", err)
			os.Exit(1)
		}
		if parsedReq.MessageType != scep.PKCSReq {
			fmt.Fprintf(os.Stderr, "Assertion 4 failed: expected parsed MessageType %v, got %v\n", scep.PKCSReq, parsedReq.MessageType)
			os.Exit(1)
		}
		if parsedReq.TransactionID != reqMsg.TransactionID {
			fmt.Fprintf(os.Stderr, "Assertion 4 failed: TransactionID mismatch: expected %v, got %v\n", reqMsg.TransactionID, parsedReq.TransactionID)
			os.Exit(1)
		}
		if !bytes.Equal(parsedReq.SenderNonce, reqMsg.SenderNonce) {
			fmt.Fprintf(os.Stderr, "Assertion 4 failed: SenderNonce mismatch\n")
			os.Exit(1)
		}
	}

	// Assertion 5: scep.PKIMessage.DecryptPKIEnvelope successfully decrypts the recipient-encrypted CSR payload from a PKCSReq message
	{
		if err := parsedReq.DecryptPKIEnvelope(caCert, caKey); err != nil {
			fmt.Fprintf(os.Stderr, "Assertion 5 failed: DecryptPKIEnvelope returned error: %v\n", err)
			os.Exit(1)
		}
		if parsedReq.CSRReqMessage == nil || parsedReq.CSRReqMessage.CSR == nil {
			fmt.Fprintf(os.Stderr, "Assertion 5 failed: decrypted CSRReqMessage or CSR is nil\n")
			os.Exit(1)
		}
		if parsedReq.CSRReqMessage.CSR.Subject.CommonName != "endpoint.example.com" {
			fmt.Fprintf(os.Stderr, "Assertion 5 failed: expected CommonName 'endpoint.example.com', got %q\n", parsedReq.CSRReqMessage.CSR.Subject.CommonName)
			os.Exit(1)
		}
	}

	// Assertion 6: scep.PKIMessage.Success constructs a CertRep SUCCESS response for a valid PKCSReq message
	{
		issuedTmpl := &x509.Certificate{
			SerialNumber: big.NewInt(200),
			Subject:      csr.Subject,
			NotBefore:    time.Now().Add(-1 * time.Hour),
			NotAfter:     time.Now().Add(24 * time.Hour),
			KeyUsage:     x509.KeyUsageDigitalSignature,
		}
		issuedDer, err := x509.CreateCertificate(rand.Reader, issuedTmpl, caCert, csr.PublicKey, caKey)
		if err != nil {
			fmt.Fprintf(os.Stderr, "Assertion 6 setup failed: CreateCertificate error: %v\n", err)
			os.Exit(1)
		}
		issuedCert, err := x509.ParseCertificate(issuedDer)
		if err != nil {
			fmt.Fprintf(os.Stderr, "Assertion 6 setup failed: ParseCertificate error: %v\n", err)
			os.Exit(1)
		}

		respMsg, err := parsedReq.Success(caCert, caKey, issuedCert)
		if err != nil {
			fmt.Fprintf(os.Stderr, "Assertion 6 failed: Success returned error: %v\n", err)
			os.Exit(1)
		}
		if respMsg.MessageType != scep.CertRep {
			fmt.Fprintf(os.Stderr, "Assertion 6 failed: expected response MessageType %v, got %v\n", scep.CertRep, respMsg.MessageType)
			os.Exit(1)
		}

		clientParsedResp, err := scep.ParsePKIMessage(respMsg.Raw, scep.WithCACerts([]*x509.Certificate{caCert}))
		if err != nil {
			fmt.Fprintf(os.Stderr, "Assertion 6 failed: ParsePKIMessage on response error: %v\n", err)
			os.Exit(1)
		}
		if clientParsedResp.CertRepMessage == nil || clientParsedResp.CertRepMessage.PKIStatus != scep.SUCCESS {
			fmt.Fprintf(os.Stderr, "Assertion 6 failed: expected PKIStatus SUCCESS\n")
			os.Exit(1)
		}
		if err := clientParsedResp.DecryptPKIEnvelope(clientCert, clientKey); err != nil {
			fmt.Fprintf(os.Stderr, "Assertion 6 failed: DecryptPKIEnvelope on client error: %v\n", err)
			os.Exit(1)
		}
		if clientParsedResp.CertRepMessage.Certificate.SerialNumber.Cmp(big.NewInt(200)) != 0 {
			fmt.Fprintf(os.Stderr, "Assertion 6 failed: decrypted certificate serial mismatch\n")
			os.Exit(1)
		}
	}

	// Assertion 7: scep.PKIMessage.Fail constructs a CertRep FAILURE response with the specified FailInfo for a PKCSReq message
	{
		failMsg, err := parsedReq.Fail(caCert, caKey, scep.BadRequest)
		if err != nil {
			fmt.Fprintf(os.Stderr, "Assertion 7 failed: Fail returned error: %v\n", err)
			os.Exit(1)
		}
		parsedFail, err := scep.ParsePKIMessage(failMsg.Raw, scep.WithCACerts([]*x509.Certificate{caCert}))
		if err != nil {
			fmt.Fprintf(os.Stderr, "Assertion 7 failed: ParsePKIMessage on fail message error: %v\n", err)
			os.Exit(1)
		}
		if parsedFail.CertRepMessage == nil || parsedFail.CertRepMessage.PKIStatus != scep.FAILURE {
			fmt.Fprintf(os.Stderr, "Assertion 7 failed: expected PKIStatus FAILURE\n")
			os.Exit(1)
		}
		if parsedFail.CertRepMessage.FailInfo != scep.BadRequest {
			fmt.Fprintf(os.Stderr, "Assertion 7 failed: expected FailInfo BadRequest, got %v\n", parsedFail.CertRepMessage.FailInfo)
			os.Exit(1)
		}
	}

	// Assertion 8: scep.NewCSRRequest returns an error when no recipient certificates are provided
	{
		emptyRecipientsTmpl := &scep.PKIMessage{
			MessageType: scep.PKCSReq,
			SignerCert:  clientCert,
			SignerKey:   clientKey,
		}
		_, err := scep.NewCSRRequest(csr, emptyRecipientsTmpl)
		if err == nil {
			fmt.Fprintf(os.Stderr, "Assertion 8 failed: expected error for empty recipients, got nil\n")
			os.Exit(1)
		}
		if !strings.Contains(err.Error(), "no CA/RA recipients") {
			fmt.Fprintf(os.Stderr, "Assertion 8 failed: unexpected error message: %v\n", err)
			os.Exit(1)
		}
	}

	fmt.Println("All PKCSReq contract assertions passed.")
}