github.com/smallstep/scep v0.0.0-20231024192529-aee96d7ad34d: SUCCESS

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify github.com/smallstep/scep.SUCCESS in pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d
Demonstrate these symbols/APIs:
  - github.com/smallstep/scep.SUCCESS

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:92abfcc5faaf332990e81fa3ae80067b3516d75ed7c68be8653b02e6318ffca6","contract":["scep.SUCCESS is PKIStatus \"0\" and is distinct from FAILURE (\"2\") and PENDING (\"3\")","scep.PKIMessage.Success creates a SCEP CertRep response containing PKIStatus scep.SUCCESS","scep.ParsePKIMessage on a Success response decodes CertRepMessage with PKIStatus matching scep.SUCCESS","DecryptPKIEnvelope on a scep.SUCCESS CertRep message decrypts the issued X.509 certificate payload","scep.PKIMessage.Fail creates a SCEP CertRep response with PKIStatus scep.FAILURE and specified failInfo"],"goal":"verify github.com/smallstep/scep.SUCCESS in pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d","kind":"HOW","packages":["pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d"],"schemaVersion":1,"symbols":["github.com/smallstep/scep.SUCCESS"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d"],"schemaVersion":1,"subject":"pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d","symbols":["github.com/smallstep/scep.SUCCESS"],"verifierAdapter":"golang@1"}

module sample-scep-success

go 1.22

require github.com/smallstep/scep v0.0.0-20231024192529-aee96d7ad34d

require (
	github.com/go-kit/kit v0.4.0 // indirect
	github.com/go-logfmt/logfmt v0.5.1 // indirect
	github.com/go-stack/stack v1.6.0 // indirect
	github.com/smallstep/pkcs7 v0.0.0-20231024181729-3b98ecc1ca81 // indirect
)

github.com/go-kit/kit v0.4.0 h1:KeVK+Emj3c3S4eRztFuzbFYb2BAgf2jmwDwyXEri7Lo=
github.com/go-kit/kit v0.4.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
github.com/go-logfmt/logfmt v0.5.1 h1:otpy5pqBCBZ1ng9RQ0dPu4PN7ba75Y/aA+UpowDyNVA=
github.com/go-logfmt/logfmt v0.5.1/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
github.com/go-stack/stack v1.6.0 h1:MmJCxYVKTJ0SplGKqFVX3SBnmaUhODHZrrFF6jMbpZk=
github.com/go-stack/stack v1.6.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
github.com/smallstep/pkcs7 v0.0.0-20231024181729-3b98ecc1ca81 h1:B6cED3iLJTgxpdh4tuqByDjRRKan2EvtnOfHr2zHJVg=
github.com/smallstep/pkcs7 v0.0.0-20231024181729-3b98ecc1ca81/go.mod h1:SoUAr/4M46rZ3WaLstHxGhLEgoYIDRqxQEXLOmOEB0Y=
github.com/smallstep/scep v0.0.0-20231024192529-aee96d7ad34d h1:06LUHn4Ia2X6syjIaCMNaXXDNdU+1N/oOHynJbWgpXw=
github.com/smallstep/scep v0.0.0-20231024192529-aee96d7ad34d/go.mod h1:4d0ub42ut1mMtvGyMensjuHYEUpRrASvkzLEJvoRQcU=

package main

import (
	"crypto/rand"
	"crypto/rsa"
	"crypto/x509"
	"crypto/x509/pkix"
	"fmt"
	"math/big"
	"time"

	"github.com/smallstep/scep"
	"github.com/smallstep/scep/x509util"
)

func main() {
	caKey, _ := rsa.GenerateKey(rand.Reader, 2048)
	caTmpl := &x509.Certificate{
		SerialNumber: big.NewInt(1),
		Subject: pkix.Name{
			CommonName: "Example CA",
		},
		NotBefore:             time.Now().Add(-1 * time.Hour),
		NotAfter:              time.Now().Add(24 * time.Hour),
		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageCRLSign | x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
		BasicConstraintsValid: true,
		IsCA:                  true,
	}
	caDer, _ := x509.CreateCertificate(rand.Reader, caTmpl, caTmpl, &caKey.PublicKey, caKey)
	caCert, _ := x509.ParseCertificate(caDer)

	clientKey, _ := rsa.GenerateKey(rand.Reader, 2048)
	clientTmpl := &x509.Certificate{
		SerialNumber: big.NewInt(2),
		Subject: pkix.Name{
			CommonName: "client.example.com",
		},
		NotBefore:             time.Now().Add(-1 * time.Hour),
		NotAfter:              time.Now().Add(24 * time.Hour),
		KeyUsage:              x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
		BasicConstraintsValid: true,
	}
	clientDer, _ := x509.CreateCertificate(rand.Reader, clientTmpl, clientTmpl, &clientKey.PublicKey, clientKey)
	clientCert, _ := x509.ParseCertificate(clientDer)

	csrTmpl := &x509util.CertificateRequest{
		CertificateRequest: x509.CertificateRequest{
			Subject: pkix.Name{
				CommonName: "client.example.com",
			},
			SignatureAlgorithm: x509.SHA256WithRSA,
		},
		ChallengePassword: "sample-challenge",
	}
	csrDer, _ := x509util.CreateCertificateRequest(rand.Reader, csrTmpl, clientKey)
	csr, _ := x509.ParseCertificateRequest(csrDer)

	reqTmpl := &scep.PKIMessage{
		MessageType: scep.PKCSReq,
		Recipients:  []*x509.Certificate{caCert},
		SignerCert:  clientCert,
		SignerKey:   clientKey,
	}
	reqMsg, err := scep.NewCSRRequest(csr, reqTmpl)
	if err != nil {
		fmt.Printf("Error creating CSR request: %v\n", err)
		return
	}

	parsedReq, err := scep.ParsePKIMessage(reqMsg.Raw)
	if err != nil {
		fmt.Printf("Error parsing PKI message: %v\n", err)
		return
	}
	if err := parsedReq.DecryptPKIEnvelope(caCert, caKey); err != nil {
		fmt.Printf("Error decrypting PKI envelope: %v\n", err)
		return
	}

	issuedTmpl := &x509.Certificate{
		SerialNumber: big.NewInt(100),
		Subject:      csr.Subject,
		NotBefore:    time.Now().Add(-1 * time.Hour),
		NotAfter:     time.Now().Add(24 * time.Hour),
		KeyUsage:     x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
	}
	issuedDer, _ := x509.CreateCertificate(rand.Reader, issuedTmpl, caCert, csr.PublicKey, caKey)
	issuedCert, _ := x509.ParseCertificate(issuedDer)

	respMsg, err := parsedReq.Success(caCert, caKey, issuedCert)
	if err != nil {
		fmt.Printf("Error creating success response: %v\n", err)
		return
	}

	clientParsedResp, err := scep.ParsePKIMessage(respMsg.Raw, scep.WithCACerts([]*x509.Certificate{caCert}))
	if err != nil {
		fmt.Printf("Error parsing response message: %v\n", err)
		return
	}

	if clientParsedResp.CertRepMessage != nil && clientParsedResp.CertRepMessage.PKIStatus == scep.SUCCESS {
		fmt.Printf("SCEP request completed with status: %s\n", clientParsedResp.CertRepMessage.PKIStatus)
	}
}

{
  "schemaVersion": 1,
  "goal": "verify github.com/smallstep/scep.SUCCESS in pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d",
  "kind": "HOW",
  "packages": [
    "pkg:golang/github.com/smallstep/scep@v0.0.0-20231024192529-aee96d7ad34d"
  ],
  "symbols": [
    "github.com/smallstep/scep.SUCCESS"
  ]
}

package main

import (
	"bytes"
	"crypto/rand"
	"crypto/rsa"
	"crypto/x509"
	"crypto/x509/pkix"
	"fmt"
	"math/big"
	"os"
	"time"

	"github.com/smallstep/scep"
	"github.com/smallstep/scep/x509util"
)

func generateCA() (*x509.Certificate, *rsa.PrivateKey, error) {
	key, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		return nil, nil, err
	}

	serial, _ := rand.Int(rand.Reader, big.NewInt(1000000))
	tmpl := &x509.Certificate{
		SerialNumber: serial,
		Subject: pkix.Name{
			CommonName: "Example CA",
		},
		NotBefore:             time.Now().Add(-1 * time.Hour),
		NotAfter:              time.Now().Add(24 * time.Hour),
		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageCRLSign | x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
		BasicConstraintsValid: true,
		IsCA:                  true,
	}

	der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &key.PublicKey, key)
	if err != nil {
		return nil, nil, err
	}
	cert, err := x509.ParseCertificate(der)
	if err != nil {
		return nil, nil, err
	}
	return cert, key, nil
}

func generateClientCert(cn string) (*x509.Certificate, *rsa.PrivateKey, error) {
	key, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		return nil, nil, err
	}

	serial, _ := rand.Int(rand.Reader, big.NewInt(1000000))
	tmpl := &x509.Certificate{
		SerialNumber: serial,
		Subject: pkix.Name{
			CommonName: cn,
		},
		NotBefore:             time.Now().Add(-1 * time.Hour),
		NotAfter:              time.Now().Add(24 * time.Hour),
		KeyUsage:              x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
		BasicConstraintsValid: true,
	}

	der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &key.PublicKey, key)
	if err != nil {
		return nil, nil, err
	}
	cert, err := x509.ParseCertificate(der)
	if err != nil {
		return nil, nil, err
	}
	return cert, key, nil
}

func main() {
	// Assertion 1: scep.SUCCESS is PKIStatus "0" and is distinct from FAILURE ("2") and PENDING ("3")
	{
		if scep.SUCCESS != scep.PKIStatus("0") {
			fmt.Fprintf(os.Stderr, "Contract 1 failed: expected scep.SUCCESS to equal PKIStatus '0', got %v\n", scep.SUCCESS)
			os.Exit(1)
		}
		if scep.SUCCESS == scep.FAILURE {
			fmt.Fprintf(os.Stderr, "Contract 1 failed: scep.SUCCESS should not equal scep.FAILURE\n")
			os.Exit(1)
		}
		if scep.SUCCESS == scep.PENDING {
			fmt.Fprintf(os.Stderr, "Contract 1 failed: scep.SUCCESS should not equal scep.PENDING\n")
			os.Exit(1)
		}
	}

	caCert, caKey, err := generateCA()
	if err != nil {
		fmt.Fprintf(os.Stderr, "Setup failed: %v\n", err)
		os.Exit(1)
	}

	clientCert, clientKey, err := generateClientCert("client.example.com")
	if err != nil {
		fmt.Fprintf(os.Stderr, "Setup failed: %v\n", err)
		os.Exit(1)
	}

	csrTmpl := &x509util.CertificateRequest{
		CertificateRequest: x509.CertificateRequest{
			Subject: pkix.Name{
				CommonName: "client.example.com",
			},
			SignatureAlgorithm: x509.SHA256WithRSA,
		},
		ChallengePassword: "sample-challenge",
	}
	csrDer, err := x509util.CreateCertificateRequest(rand.Reader, csrTmpl, clientKey)
	if err != nil {
		fmt.Fprintf(os.Stderr, "Setup failed: %v\n", err)
		os.Exit(1)
	}
	csr, err := x509.ParseCertificateRequest(csrDer)
	if err != nil {
		fmt.Fprintf(os.Stderr, "Setup failed: %v\n", err)
		os.Exit(1)
	}

	reqTmpl := &scep.PKIMessage{
		MessageType: scep.PKCSReq,
		Recipients:  []*x509.Certificate{caCert},
		SignerCert:  clientCert,
		SignerKey:   clientKey,
	}
	reqMsg, err := scep.NewCSRRequest(csr, reqTmpl)
	if err != nil {
		fmt.Fprintf(os.Stderr, "Setup failed: %v\n", err)
		os.Exit(1)
	}

	parsedReq, err := scep.ParsePKIMessage(reqMsg.Raw)
	if err != nil {
		fmt.Fprintf(os.Stderr, "Setup failed: %v\n", err)
		os.Exit(1)
	}
	if err := parsedReq.DecryptPKIEnvelope(caCert, caKey); err != nil {
		fmt.Fprintf(os.Stderr, "Setup failed: %v\n", err)
		os.Exit(1)
	}

	issuedTmpl := &x509.Certificate{
		SerialNumber: big.NewInt(200),
		Subject:      csr.Subject,
		NotBefore:    time.Now().Add(-1 * time.Hour),
		NotAfter:     time.Now().Add(24 * time.Hour),
		KeyUsage:     x509.KeyUsageDigitalSignature,
	}
	issuedDer, err := x509.CreateCertificate(rand.Reader, issuedTmpl, caCert, csr.PublicKey, caKey)
	if err != nil {
		fmt.Fprintf(os.Stderr, "Setup failed: %v\n", err)
		os.Exit(1)
	}
	issuedCert, err := x509.ParseCertificate(issuedDer)
	if err != nil {
		fmt.Fprintf(os.Stderr, "Setup failed: %v\n", err)
		os.Exit(1)
	}

	var respMsg *scep.PKIMessage

	// Assertion 2: scep.PKIMessage.Success creates a SCEP CertRep response containing PKIStatus scep.SUCCESS
	{
		respMsg, err = parsedReq.Success(caCert, caKey, issuedCert)
		if err != nil {
			fmt.Fprintf(os.Stderr, "Contract 2 failed: Success returned error: %v\n", err)
			os.Exit(1)
		}
		if respMsg == nil || len(respMsg.Raw) == 0 {
			fmt.Fprintf(os.Stderr, "Contract 2 failed: empty response message\n")
			os.Exit(1)
		}
		if respMsg.MessageType != scep.CertRep {
			fmt.Fprintf(os.Stderr, "Contract 2 failed: expected MessageType CertRep, got %v\n", respMsg.MessageType)
			os.Exit(1)
		}
	}

	var clientParsedResp *scep.PKIMessage

	// Assertion 3: scep.ParsePKIMessage on a Success response decodes CertRepMessage with PKIStatus matching scep.SUCCESS
	{
		clientParsedResp, err = scep.ParsePKIMessage(respMsg.Raw, scep.WithCACerts([]*x509.Certificate{caCert}))
		if err != nil {
			fmt.Fprintf(os.Stderr, "Contract 3 failed: ParsePKIMessage returned error: %v\n", err)
			os.Exit(1)
		}
		if clientParsedResp.CertRepMessage == nil {
			fmt.Fprintf(os.Stderr, "Contract 3 failed: CertRepMessage is nil\n")
			os.Exit(1)
		}
		if clientParsedResp.CertRepMessage.PKIStatus != scep.SUCCESS {
			fmt.Fprintf(os.Stderr, "Contract 3 failed: expected PKIStatus scep.SUCCESS (%v), got %v\n", scep.SUCCESS, clientParsedResp.CertRepMessage.PKIStatus)
			os.Exit(1)
		}
	}

	// Assertion 4: DecryptPKIEnvelope on a scep.SUCCESS CertRep message decrypts the issued X.509 certificate payload
	{
		if err := clientParsedResp.DecryptPKIEnvelope(clientCert, clientKey); err != nil {
			fmt.Fprintf(os.Stderr, "Contract 4 failed: DecryptPKIEnvelope returned error: %v\n", err)
			os.Exit(1)
		}
		if clientParsedResp.CertRepMessage.Certificate == nil {
			fmt.Fprintf(os.Stderr, "Contract 4 failed: decrypted certificate is nil\n")
			os.Exit(1)
		}
		if clientParsedResp.CertRepMessage.Certificate.SerialNumber.Cmp(big.NewInt(200)) != 0 {
			fmt.Fprintf(os.Stderr, "Contract 4 failed: serial number mismatch\n")
			os.Exit(1)
		}
		if !bytes.Equal(clientParsedResp.CertRepMessage.Certificate.Raw, issuedCert.Raw) {
			fmt.Fprintf(os.Stderr, "Contract 4 failed: certificate bytes mismatch\n")
			os.Exit(1)
		}
	}

	// Assertion 5: scep.PKIMessage.Fail creates a SCEP CertRep response with PKIStatus scep.FAILURE and specified failInfo
	{
		failMsg, err := parsedReq.Fail(caCert, caKey, scep.BadRequest)
		if err != nil {
			fmt.Fprintf(os.Stderr, "Contract 5 failed: Fail returned error: %v\n", err)
			os.Exit(1)
		}
		clientParsedFail, err := scep.ParsePKIMessage(failMsg.Raw, scep.WithCACerts([]*x509.Certificate{caCert}))
		if err != nil {
			fmt.Fprintf(os.Stderr, "Contract 5 failed: ParsePKIMessage on fail message returned error: %v\n", err)
			os.Exit(1)
		}
		if clientParsedFail.CertRepMessage == nil || clientParsedFail.CertRepMessage.PKIStatus != scep.FAILURE {
			fmt.Fprintf(os.Stderr, "Contract 5 failed: expected PKIStatus scep.FAILURE, got %v\n", clientParsedFail.CertRepMessage)
			os.Exit(1)
		}
		if clientParsedFail.CertRepMessage.FailInfo != scep.BadRequest {
			fmt.Fprintf(os.Stderr, "Contract 5 failed: expected BadRequest failInfo, got %v\n", clientParsedFail.CertRepMessage.FailInfo)
			os.Exit(1)
		}
	}

	fmt.Println("All contract assertions passed.")
}