github.com/smallstep/scep v0.0.0-20231024192529-aee96d7ad34d: PKIMessage

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify github.com/smallstep/scep.PKIMessage in pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d
Demonstrate these symbols/APIs:
  - github.com/smallstep/scep.PKIMessage

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:3e0c5d4780bd3df6f115f1b34d7d440f73339e0b3f966d9306b69a964b0d838f","contract":["scep.NewCSRRequest creates a SCEP PKCSReq message encapsulating a PKCS#10 CSR with signer and recipient certificates","scep.ParsePKIMessage decodes a raw PKCS#7 envelope to extract messageType, transactionID, and senderNonce","scep.PKIMessage.DecryptPKIEnvelope decrypts the encrypted CSR payload using CA private key and certificate","scep.PKIMessage.Success constructs an encrypted CertRep response with SUCCESS status for the issued certificate","scep.PKIMessage.Fail constructs a signed CertRep response with FAILURE status and specified FailInfo","scep.DegenerateCertificates and scep.CACerts encode and decode certificate chains in degenerate PKCS#7 format","scep.NewCSRRequest returns an error when no recipient certificates are provided","scep.ParsePKIMessage returns an error when given invalid or corrupt data"],"goal":"verify github.com/smallstep/scep.PKIMessage in pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d","kind":"HOW","packages":["pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d"],"schemaVersion":1,"symbols":["github.com/smallstep/scep.PKIMessage"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d"],"schemaVersion":1,"subject":"pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d","symbols":["github.com/smallstep/scep.PKIMessage"],"verifierAdapter":"golang@1"}

module sample-scep

go 1.22

require github.com/smallstep/scep v0.0.0-20231024192529-aee96d7ad34d

require (
	github.com/go-kit/kit v0.4.0 // indirect
	github.com/go-logfmt/logfmt v0.5.1 // indirect
	github.com/go-stack/stack v1.6.0 // indirect
	github.com/smallstep/pkcs7 v0.0.0-20231024181729-3b98ecc1ca81 // indirect
)

github.com/go-kit/kit v0.4.0 h1:KeVK+Emj3c3S4eRztFuzbFYb2BAgf2jmwDwyXEri7Lo=
github.com/go-kit/kit v0.4.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
github.com/go-logfmt/logfmt v0.5.1 h1:otpy5pqBCBZ1ng9RQ0dPu4PN7ba75Y/aA+UpowDyNVA=
github.com/go-logfmt/logfmt v0.5.1/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
github.com/go-stack/stack v1.6.0 h1:MmJCxYVKTJ0SplGKqFVX3SBnmaUhODHZrrFF6jMbpZk=
github.com/go-stack/stack v1.6.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
github.com/smallstep/pkcs7 v0.0.0-20231024181729-3b98ecc1ca81 h1:B6cED3iLJTgxpdh4tuqByDjRRKan2EvtnOfHr2zHJVg=
github.com/smallstep/pkcs7 v0.0.0-20231024181729-3b98ecc1ca81/go.mod h1:SoUAr/4M46rZ3WaLstHxGhLEgoYIDRqxQEXLOmOEB0Y=
github.com/smallstep/scep v0.0.0-20231024192529-aee96d7ad34d h1:06LUHn4Ia2X6syjIaCMNaXXDNdU+1N/oOHynJbWgpXw=
github.com/smallstep/scep v0.0.0-20231024192529-aee96d7ad34d/go.mod h1:4d0ub42ut1mMtvGyMensjuHYEUpRrASvkzLEJvoRQcU=

package main

import (
	"crypto/rand"
	"crypto/rsa"
	"crypto/x509"
	"crypto/x509/pkix"
	"fmt"
	"math/big"
	"time"

	"github.com/smallstep/scep"
	"github.com/smallstep/scep/x509util"
)

func main() {
	caKey, _ := rsa.GenerateKey(rand.Reader, 2048)
	caTmpl := &x509.Certificate{
		SerialNumber: big.NewInt(1),
		Subject: pkix.Name{
			CommonName: "Example CA",
		},
		NotBefore:             time.Now().Add(-1 * time.Hour),
		NotAfter:              time.Now().Add(24 * time.Hour),
		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageCRLSign | x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
		BasicConstraintsValid: true,
		IsCA:                  true,
	}
	caDer, _ := x509.CreateCertificate(rand.Reader, caTmpl, caTmpl, &caKey.PublicKey, caKey)
	caCert, _ := x509.ParseCertificate(caDer)

	clientKey, _ := rsa.GenerateKey(rand.Reader, 2048)
	clientTmpl := &x509.Certificate{
		SerialNumber: big.NewInt(2),
		Subject: pkix.Name{
			CommonName: "client.example.com",
		},
		NotBefore:             time.Now().Add(-1 * time.Hour),
		NotAfter:              time.Now().Add(24 * time.Hour),
		KeyUsage:              x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
		BasicConstraintsValid: true,
	}
	clientDer, _ := x509.CreateCertificate(rand.Reader, clientTmpl, clientTmpl, &clientKey.PublicKey, clientKey)
	clientCert, _ := x509.ParseCertificate(clientDer)

	csrTmpl := &x509util.CertificateRequest{
		CertificateRequest: x509.CertificateRequest{
			Subject: pkix.Name{
				CommonName: "client.example.com",
			},
			SignatureAlgorithm: x509.SHA256WithRSA,
		},
		ChallengePassword: "challenge-token",
	}
	csrDer, _ := x509util.CreateCertificateRequest(rand.Reader, csrTmpl, clientKey)
	csr, _ := x509.ParseCertificateRequest(csrDer)

	reqTmpl := &scep.PKIMessage{
		MessageType: scep.PKCSReq,
		Recipients:  []*x509.Certificate{caCert},
		SignerCert:  clientCert,
		SignerKey:   clientKey,
	}
	reqMsg, err := scep.NewCSRRequest(csr, reqTmpl)
	if err != nil {
		fmt.Printf("NewCSRRequest error: %v\n", err)
		return
	}
	fmt.Printf("Created SCEP PKCSReq with TransactionID: %s\n", reqMsg.TransactionID)

	parsedReq, err := scep.ParsePKIMessage(reqMsg.Raw)
	if err != nil {
		fmt.Printf("ParsePKIMessage error: %v\n", err)
		return
	}
	if err := parsedReq.DecryptPKIEnvelope(caCert, caKey); err != nil {
		fmt.Printf("DecryptPKIEnvelope error: %v\n", err)
		return
	}
	fmt.Printf("Decrypted CSR CommonName: %s\n", parsedReq.CSRReqMessage.CSR.Subject.CommonName)
}

{
  "schemaVersion": 1,
  "goal": "verify github.com/smallstep/scep.PKIMessage in pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d",
  "kind": "HOW",
  "packages": [
    "pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d"
  ],
  "symbols": [
    "github.com/smallstep/scep.PKIMessage"
  ]
}

package main

import (
	"bytes"
	"crypto/rand"
	"crypto/rsa"
	"crypto/x509"
	"crypto/x509/pkix"
	"fmt"
	"math/big"
	"os"
	"strings"
	"time"

	"github.com/smallstep/scep"
	"github.com/smallstep/scep/x509util"
)

func generateCA() (*x509.Certificate, *rsa.PrivateKey, error) {
	key, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		return nil, nil, err
	}

	serial, _ := rand.Int(rand.Reader, big.NewInt(1000000))
	tmpl := &x509.Certificate{
		SerialNumber: serial,
		Subject: pkix.Name{
			CommonName: "Example CA",
		},
		NotBefore:             time.Now().Add(-1 * time.Hour),
		NotAfter:              time.Now().Add(24 * time.Hour),
		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageCRLSign | x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
		BasicConstraintsValid: true,
		IsCA:                  true,
	}

	der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &key.PublicKey, key)
	if err != nil {
		return nil, nil, err
	}
	cert, err := x509.ParseCertificate(der)
	if err != nil {
		return nil, nil, err
	}
	return cert, key, nil
}

func generateClientCert(cn string) (*x509.Certificate, *rsa.PrivateKey, error) {
	key, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		return nil, nil, err
	}

	serial, _ := rand.Int(rand.Reader, big.NewInt(1000000))
	tmpl := &x509.Certificate{
		SerialNumber: serial,
		Subject: pkix.Name{
			CommonName: cn,
		},
		NotBefore:             time.Now().Add(-1 * time.Hour),
		NotAfter:              time.Now().Add(24 * time.Hour),
		KeyUsage:              x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
		BasicConstraintsValid: true,
	}

	der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &key.PublicKey, key)
	if err != nil {
		return nil, nil, err
	}
	cert, err := x509.ParseCertificate(der)
	if err != nil {
		return nil, nil, err
	}
	return cert, key, nil
}

func main() {
	caCert, caKey, err := generateCA()
	if err != nil {
		fmt.Fprintf(os.Stderr, "Contract setup failed: CA generation error: %v\n", err)
		os.Exit(1)
	}

	clientCert, clientKey, err := generateClientCert("client.example.com")
	if err != nil {
		fmt.Fprintf(os.Stderr, "Contract setup failed: Client cert generation error: %v\n", err)
		os.Exit(1)
	}

	csrTmpl := &x509util.CertificateRequest{
		CertificateRequest: x509.CertificateRequest{
			Subject: pkix.Name{
				CommonName: "client.example.com",
			},
			SignatureAlgorithm: x509.SHA256WithRSA,
		},
		ChallengePassword: "challenge-phrase",
	}
	csrDer, err := x509util.CreateCertificateRequest(rand.Reader, csrTmpl, clientKey)
	if err != nil {
		fmt.Fprintf(os.Stderr, "Contract setup failed: CreateCertificateRequest error: %v\n", err)
		os.Exit(1)
	}
	csr, err := x509.ParseCertificateRequest(csrDer)
	if err != nil {
		fmt.Fprintf(os.Stderr, "Contract setup failed: ParseCertificateRequest error: %v\n", err)
		os.Exit(1)
	}

	var scepReq *scep.PKIMessage

	// Assertion 1: scep.NewCSRRequest creates a SCEP PKCSReq message encapsulating a PKCS#10 CSR with signer and recipient certificates
	{
		reqMsgTmpl := &scep.PKIMessage{
			MessageType: scep.PKCSReq,
			Recipients:  []*x509.Certificate{caCert},
			SignerCert:  clientCert,
			SignerKey:   clientKey,
		}
		scepReq, err = scep.NewCSRRequest(csr, reqMsgTmpl)
		if err != nil {
			fmt.Fprintf(os.Stderr, "Contract 1 failed: NewCSRRequest returned error: %v\n", err)
			os.Exit(1)
		}
		if scepReq == nil || len(scepReq.Raw) == 0 {
			fmt.Fprintf(os.Stderr, "Contract 1 failed: empty raw PKIMessage bytes\n")
			os.Exit(1)
		}
		if scepReq.TransactionID == "" {
			fmt.Fprintf(os.Stderr, "Contract 1 failed: empty TransactionID\n")
			os.Exit(1)
		}
		if len(scepReq.SenderNonce) == 0 {
			fmt.Fprintf(os.Stderr, "Contract 1 failed: empty SenderNonce\n")
			os.Exit(1)
		}
	}

	var parsedReq *scep.PKIMessage

	// Assertion 2: scep.ParsePKIMessage decodes a raw PKCS#7 envelope to extract messageType, transactionID, and senderNonce
	{
		parsedReq, err = scep.ParsePKIMessage(scepReq.Raw)
		if err != nil {
			fmt.Fprintf(os.Stderr, "Contract 2 failed: ParsePKIMessage returned error: %v\n", err)
			os.Exit(1)
		}
		if parsedReq.MessageType != scep.PKCSReq {
			fmt.Fprintf(os.Stderr, "Contract 2 failed: expected MessageType %v, got %v\n", scep.PKCSReq, parsedReq.MessageType)
			os.Exit(1)
		}
		if parsedReq.TransactionID != scepReq.TransactionID {
			fmt.Fprintf(os.Stderr, "Contract 2 failed: TransactionID mismatch: expected %v, got %v\n", scepReq.TransactionID, parsedReq.TransactionID)
			os.Exit(1)
		}
		if !bytes.Equal(parsedReq.SenderNonce, scepReq.SenderNonce) {
			fmt.Fprintf(os.Stderr, "Contract 2 failed: SenderNonce mismatch\n")
			os.Exit(1)
		}
	}

	// Assertion 3: scep.PKIMessage.DecryptPKIEnvelope decrypts the encrypted CSR payload using CA private key and certificate
	{
		if err := parsedReq.DecryptPKIEnvelope(caCert, caKey); err != nil {
			fmt.Fprintf(os.Stderr, "Contract 3 failed: DecryptPKIEnvelope returned error: %v\n", err)
			os.Exit(1)
		}
		if parsedReq.CSRReqMessage == nil || parsedReq.CSRReqMessage.CSR == nil {
			fmt.Fprintf(os.Stderr, "Contract 3 failed: missing decrypted CSR\n")
			os.Exit(1)
		}
		if parsedReq.CSRReqMessage.CSR.Subject.CommonName != "client.example.com" {
			fmt.Fprintf(os.Stderr, "Contract 3 failed: expected CommonName 'client.example.com', got '%s'\n", parsedReq.CSRReqMessage.CSR.Subject.CommonName)
			os.Exit(1)
		}
		if parsedReq.CSRReqMessage.ChallengePassword != "challenge-phrase" {
			fmt.Fprintf(os.Stderr, "Contract 3 failed: expected ChallengePassword 'challenge-phrase', got '%s'\n", parsedReq.CSRReqMessage.ChallengePassword)
			os.Exit(1)
		}
	}

	// Assertion 4: scep.PKIMessage.Success constructs an encrypted CertRep response with SUCCESS status for the issued certificate
	{
		issuedTmpl := &x509.Certificate{
			SerialNumber: big.NewInt(300),
			Subject:      csr.Subject,
			NotBefore:    time.Now().Add(-1 * time.Hour),
			NotAfter:     time.Now().Add(24 * time.Hour),
			KeyUsage:     x509.KeyUsageDigitalSignature,
		}
		issuedDer, err := x509.CreateCertificate(rand.Reader, issuedTmpl, caCert, csr.PublicKey, caKey)
		if err != nil {
			fmt.Fprintf(os.Stderr, "Contract 4 setup failed: CreateCertificate error: %v\n", err)
			os.Exit(1)
		}
		issuedCert, err := x509.ParseCertificate(issuedDer)
		if err != nil {
			fmt.Fprintf(os.Stderr, "Contract 4 setup failed: ParseCertificate error: %v\n", err)
			os.Exit(1)
		}

		respMsg, err := parsedReq.Success(caCert, caKey, issuedCert)
		if err != nil {
			fmt.Fprintf(os.Stderr, "Contract 4 failed: Success returned error: %v\n", err)
			os.Exit(1)
		}
		if respMsg.MessageType != scep.CertRep {
			fmt.Fprintf(os.Stderr, "Contract 4 failed: expected CertRep MessageType, got %v\n", respMsg.MessageType)
			os.Exit(1)
		}

		clientParsedResp, err := scep.ParsePKIMessage(respMsg.Raw, scep.WithCACerts([]*x509.Certificate{caCert}))
		if err != nil {
			fmt.Fprintf(os.Stderr, "Contract 4 failed: client ParsePKIMessage returned error: %v\n", err)
			os.Exit(1)
		}
		if clientParsedResp.CertRepMessage == nil || clientParsedResp.CertRepMessage.PKIStatus != scep.SUCCESS {
			fmt.Fprintf(os.Stderr, "Contract 4 failed: expected SUCCESS status, got %v\n", clientParsedResp.CertRepMessage)
			os.Exit(1)
		}
		if err := clientParsedResp.DecryptPKIEnvelope(clientCert, clientKey); err != nil {
			fmt.Fprintf(os.Stderr, "Contract 4 failed: client DecryptPKIEnvelope returned error: %v\n", err)
			os.Exit(1)
		}
		if clientParsedResp.CertRepMessage.Certificate.SerialNumber.Cmp(big.NewInt(300)) != 0 {
			fmt.Fprintf(os.Stderr, "Contract 4 failed: decrypted cert serial mismatch: %v\n", clientParsedResp.CertRepMessage.Certificate.SerialNumber)
			os.Exit(1)
		}
	}

	// Assertion 5: scep.PKIMessage.Fail constructs a signed CertRep response with FAILURE status and specified FailInfo
	{
		failMsg, err := parsedReq.Fail(caCert, caKey, scep.BadRequest)
		if err != nil {
			fmt.Fprintf(os.Stderr, "Contract 5 failed: Fail returned error: %v\n", err)
			os.Exit(1)
		}
		parsedFail, err := scep.ParsePKIMessage(failMsg.Raw, scep.WithCACerts([]*x509.Certificate{caCert}))
		if err != nil {
			fmt.Fprintf(os.Stderr, "Contract 5 failed: ParsePKIMessage on fail message returned error: %v\n", err)
			os.Exit(1)
		}
		if parsedFail.CertRepMessage == nil || parsedFail.CertRepMessage.PKIStatus != scep.FAILURE {
			fmt.Fprintf(os.Stderr, "Contract 5 failed: expected FAILURE status\n")
			os.Exit(1)
		}
		if parsedFail.CertRepMessage.FailInfo != scep.BadRequest {
			fmt.Fprintf(os.Stderr, "Contract 5 failed: expected FailInfo BadRequest, got %v\n", parsedFail.CertRepMessage.FailInfo)
			os.Exit(1)
		}
	}

	// Assertion 6: scep.DegenerateCertificates and scep.CACerts encode and decode certificate chains in degenerate PKCS#7 format
	{
		deg, err := scep.DegenerateCertificates([]*x509.Certificate{caCert})
		if err != nil {
			fmt.Fprintf(os.Stderr, "Contract 6 failed: DegenerateCertificates returned error: %v\n", err)
			os.Exit(1)
		}
		extracted, err := scep.CACerts(deg)
		if err != nil {
			fmt.Fprintf(os.Stderr, "Contract 6 failed: CACerts returned error: %v\n", err)
			os.Exit(1)
		}
		if len(extracted) != 1 || !bytes.Equal(extracted[0].Raw, caCert.Raw) {
			fmt.Fprintf(os.Stderr, "Contract 6 failed: extracted certificate mismatch\n")
			os.Exit(1)
		}
	}

	// Assertion 7: scep.NewCSRRequest returns an error when no recipient certificates are provided
	{
		emptyRecipientsTmpl := &scep.PKIMessage{
			MessageType: scep.PKCSReq,
			SignerCert:  clientCert,
			SignerKey:   clientKey,
		}
		_, err := scep.NewCSRRequest(csr, emptyRecipientsTmpl)
		if err == nil {
			fmt.Fprintf(os.Stderr, "Contract 7 failed: expected error for empty recipients, got nil\n")
			os.Exit(1)
		}
		if !strings.Contains(err.Error(), "no CA/RA recipients") {
			fmt.Fprintf(os.Stderr, "Contract 7 failed: unexpected error message: %v\n", err)
			os.Exit(1)
		}
	}

	// Assertion 8: scep.ParsePKIMessage returns an error when given invalid or corrupt data
	{
		_, err := scep.ParsePKIMessage([]byte("invalid pki message data"))
		if err == nil {
			fmt.Fprintf(os.Stderr, "Contract 8 failed: expected error for invalid bytes, got nil\n")
			os.Exit(1)
		}
	}

	fmt.Println("All contract assertions passed.")
}