github.com/spiffe/go-spiffe/v2 v2.6.0

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify pkg:golang/github.com/spiffe/go-spiffe/v2@v2.6.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/github.com/spiffe/go-spiffe/v2@v2.6.0

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:4be7365b11fd282e1d5a1be1afa035da7f0dfaa5c5e18302d119f62fcdc2b2a3","contract":["spiffeid.TrustDomainFromString(\"example.com\") parses the trust domain with Name() == \"example.com\" and IDString() == \"spiffe://example.com\"","spiffeid.FromSegments(td, \"service\", \"api\") constructs SPIFFE ID \"spiffe://example.com/service/api\" and matches spiffeid.MatchMemberOf(td) and spiffeid.MatchID(workloadID)","x509svid.ParseRaw(leafDER, leafKeyDER) parses raw DER leaf certificate and PKCS#8 key into an SVID whose ID matches the URI SAN","x509svid.Verify(svid.Certificates, bundleSet, x509svid.WithTime(now)) verifies the X509-SVID against an x509bundle.Set containing the trust domain's CA authority"],"goal":"verify pkg:golang/github.com/spiffe/go-spiffe/v2@v2.6.0","kind":"HOW","packages":["pkg:golang/github.com/spiffe/go-spiffe/v2@v2.6.0"],"schemaVersion":1},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/github.com/spiffe/go-spiffe/v2@v2.6.0"],"schemaVersion":1,"subject":"pkg:golang/github.com/spiffe/go-spiffe/v2@v2.6.0","verifierAdapter":"golang@1"}

module sample

go 1.26.6

require github.com/spiffe/go-spiffe/v2 v2.6.0

github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/go-jose/go-jose/v4 v4.1.2 h1:TK/7NqRQZfgAh+Td8AlsrvtPoUyiHh0LqVvokh+1vHI=
github.com/go-jose/go-jose/v4 v4.1.2/go.mod h1:22cg9HWM1pOlnRiY+9cQYJ9XHmya1bYW8OeDM6Ku6Oo=
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
github.com/spiffe/go-spiffe/v2 v2.6.0 h1:l+DolpxNWYgruGQVV0xsfeya3CsC7m8iBzDnMpsbLuo=
github.com/spiffe/go-spiffe/v2 v2.6.0/go.mod h1:gm2SeUoMZEtpnzPNs2Csc0D/gX33k1xIx7lEzqblHEs=
github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
golang.org/x/crypto v0.39.0 h1:SHs+kF4LP+f+p14esP5jAoDpHU8Gu/v9lFRK6IT5imM=
golang.org/x/crypto v0.39.0/go.mod h1:L+Xg3Wf6HoL4Bn4238Z6ft6KfEpN0tJGo53AAPC632U=
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

{
  "schemaVersion": 1,
  "goal": "verify pkg:golang/github.com/spiffe/go-spiffe/v2@v2.6.0",
  "kind": "HOW",
  "packages": [
    "pkg:golang/github.com/spiffe/go-spiffe/v2@v2.6.0"
  ]
}

package main

import (
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"crypto/x509"
	"crypto/x509/pkix"
	"fmt"
	"math/big"
	"net/url"
	"os"
	"time"

	"github.com/spiffe/go-spiffe/v2/bundle/x509bundle"
	"github.com/spiffe/go-spiffe/v2/spiffeid"
	"github.com/spiffe/go-spiffe/v2/svid/x509svid"
)

func main() {
	td, err := spiffeid.TrustDomainFromString("example.com")
	if err != nil {
		fmt.Fprintf(os.Stderr, "TrustDomainFromString failed: %v\n", err)
		os.Exit(1)
	}
	if td.Name() != "example.com" || td.IDString() != "spiffe://example.com" {
		fmt.Fprintf(os.Stderr, "unexpected trust domain: %s / %s\n", td.Name(), td.IDString())
		os.Exit(1)
	}

	workloadID, err := spiffeid.FromSegments(td, "service", "api")
	if err != nil {
		fmt.Fprintf(os.Stderr, "FromSegments failed: %v\n", err)
		os.Exit(1)
	}
	if workloadID.String() != "spiffe://example.com/service/api" || workloadID.Path() != "/service/api" {
		fmt.Fprintf(os.Stderr, "unexpected workloadID: %s\n", workloadID.String())
		os.Exit(1)
	}

	if err := spiffeid.MatchMemberOf(td)(workloadID); err != nil {
		fmt.Fprintf(os.Stderr, "MatchMemberOf failed: %v\n", err)
		os.Exit(1)
	}
	if err := spiffeid.MatchID(workloadID)(workloadID); err != nil {
		fmt.Fprintf(os.Stderr, "MatchID failed: %v\n", err)
		os.Exit(1)
	}

	otherTD := spiffeid.RequireTrustDomainFromString("other.example.com")
	if err := spiffeid.MatchMemberOf(otherTD)(workloadID); err == nil {
		fmt.Fprintf(os.Stderr, "expected MatchMemberOf to fail for different trust domain\n")
		os.Exit(1)
	}

	now := time.Date(2026, 1, 15, 12, 0, 0, 0, time.UTC)

	caKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		fmt.Fprintf(os.Stderr, "GenerateKey CA failed: %v\n", err)
		os.Exit(1)
	}
	caTemplate := &x509.Certificate{
		SerialNumber:          big.NewInt(1),
		Subject:               pkix.Name{CommonName: "Root CA"},
		NotBefore:             now.Add(-time.Hour),
		NotAfter:              now.Add(24 * time.Hour),
		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageCRLSign,
		BasicConstraintsValid: true,
		IsCA:                  true,
		URIs:                  []*url.URL{td.ID().URL()},
	}
	caDER, err := x509.CreateCertificate(rand.Reader, caTemplate, caTemplate, &caKey.PublicKey, caKey)
	if err != nil {
		fmt.Fprintf(os.Stderr, "CreateCertificate CA failed: %v\n", err)
		os.Exit(1)
	}
	caCert, err := x509.ParseCertificate(caDER)
	if err != nil {
		fmt.Fprintf(os.Stderr, "ParseCertificate CA failed: %v\n", err)
		os.Exit(1)
	}

	leafKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		fmt.Fprintf(os.Stderr, "GenerateKey leaf failed: %v\n", err)
		os.Exit(1)
	}
	leafTemplate := &x509.Certificate{
		SerialNumber:          big.NewInt(2),
		Subject:               pkix.Name{CommonName: "Workload SVID"},
		NotBefore:             now.Add(-time.Hour),
		NotAfter:              now.Add(12 * time.Hour),
		KeyUsage:              x509.KeyUsageDigitalSignature,
		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth, x509.ExtKeyUsageServerAuth},
		BasicConstraintsValid: true,
		IsCA:                  false,
		URIs:                  []*url.URL{workloadID.URL()},
	}
	leafDER, err := x509.CreateCertificate(rand.Reader, leafTemplate, caCert, &leafKey.PublicKey, caKey)
	if err != nil {
		fmt.Fprintf(os.Stderr, "CreateCertificate leaf failed: %v\n", err)
		os.Exit(1)
	}
	leafKeyDER, err := x509.MarshalPKCS8PrivateKey(leafKey)
	if err != nil {
		fmt.Fprintf(os.Stderr, "MarshalPKCS8PrivateKey failed: %v\n", err)
		os.Exit(1)
	}

	svid, err := x509svid.ParseRaw(leafDER, leafKeyDER)
	if err != nil {
		fmt.Fprintf(os.Stderr, "x509svid.ParseRaw failed: %v\n", err)
		os.Exit(1)
	}
	if svid.ID != workloadID {
		fmt.Fprintf(os.Stderr, "svid.ID mismatch: got %s, want %s\n", svid.ID, workloadID)
		os.Exit(1)
	}

	bundle := x509bundle.FromX509Authorities(td, []*x509.Certificate{caCert})
	bundleSet := x509bundle.NewSet(bundle)

	verifiedID, chains, err := x509svid.Verify(svid.Certificates, bundleSet, x509svid.WithTime(now))
	if err != nil {
		fmt.Fprintf(os.Stderr, "x509svid.Verify failed: %v\n", err)
		os.Exit(1)
	}
	if verifiedID != workloadID || len(chains) == 0 {
		fmt.Fprintf(os.Stderr, "unexpected verification result: id=%s chains=%d\n", verifiedID, len(chains))
		os.Exit(1)
	}
}