github.com/spiffe/go-spiffe/v2 v2.6.0: spiffeid.FromSegments

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify github.com/spiffe/go-spiffe/v2/spiffeid.FromSegments in pkg:golang/github.com/spiffe/go-spiffe/v2@v2.6.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/github.com/spiffe/go-spiffe/v2@v2.6.0
Demonstrate these symbols/APIs:
  - github.com/spiffe/go-spiffe/v2/spiffeid.FromSegments

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:84e24e28934565319245ca6a995218e8eab4915de237e1c345819cdd99f97f01","contract":["spiffeid.FromSegments(td, \"service\", \"api\", \"v1\") builds ID with String() == \"spiffe://example.com/service/api/v1\" and Path() == \"/service/api/v1\"","spiffeid.FromSegments(td) with zero segments builds root ID with String() == \"spiffe://example.com\" and Path() == \"\"","spiffeid.FromSegments(spiffeid.TrustDomain{}, \"service\") returns non-nil error for empty trust domain","spiffeid.FromSegments rejects empty segments, segments containing '/', and dot segments ('.' and '..') with non-nil error"],"goal":"verify github.com/spiffe/go-spiffe/v2/spiffeid.FromSegments in pkg:golang/github.com/spiffe/go-spiffe/v2@v2.6.0","kind":"HOW","packages":["pkg:golang/github.com/spiffe/go-spiffe/v2@v2.6.0"],"schemaVersion":1,"symbols":["github.com/spiffe/go-spiffe/v2/spiffeid.FromSegments"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/github.com/spiffe/go-spiffe/v2@v2.6.0"],"schemaVersion":1,"subject":"pkg:golang/github.com/spiffe/go-spiffe/v2@v2.6.0","symbols":["github.com/spiffe/go-spiffe/v2/spiffeid.FromSegments"],"verifierAdapter":"golang@1"}

module sample

go 1.24.0

require github.com/spiffe/go-spiffe/v2 v2.6.0

github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
github.com/spiffe/go-spiffe/v2 v2.6.0 h1:l+DolpxNWYgruGQVV0xsfeya3CsC7m8iBzDnMpsbLuo=
github.com/spiffe/go-spiffe/v2 v2.6.0/go.mod h1:gm2SeUoMZEtpnzPNs2Csc0D/gX33k1xIx7lEzqblHEs=
github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

{
  "schemaVersion": 1,
  "goal": "verify github.com/spiffe/go-spiffe/v2/spiffeid.FromSegments in pkg:golang/github.com/spiffe/go-spiffe/v2@v2.6.0",
  "kind": "HOW",
  "packages": [
    "pkg:golang/github.com/spiffe/go-spiffe/v2@v2.6.0"
  ],
  "symbols": [
    "github.com/spiffe/go-spiffe/v2/spiffeid.FromSegments"
  ]
}

package main

import (
	"fmt"
	"os"

	"github.com/spiffe/go-spiffe/v2/spiffeid"
)

func fail(msg string) {
	fmt.Fprintln(os.Stderr, msg)
	os.Exit(1)
}

func main() {
	td := spiffeid.RequireTrustDomainFromString("example.com")

	// 1. Valid segments produce SPIFFE ID with normalized slash-joined path
	id, err := spiffeid.FromSegments(td, "service", "api", "v1")
	if err != nil {
		fail(fmt.Sprintf("expected valid segments to succeed, got: %v", err))
	}
	if id.String() != "spiffe://example.com/service/api/v1" {
		fail(fmt.Sprintf("unexpected id string: %s", id.String()))
	}
	if id.Path() != "/service/api/v1" {
		fail(fmt.Sprintf("unexpected path: %s", id.Path()))
	}
	if id.TrustDomain() != td {
		fail("trust domain mismatch")
	}

	// 2. Zero segments produce root SPIFFE ID with empty path
	rootID, err := spiffeid.FromSegments(td)
	if err != nil {
		fail(fmt.Sprintf("expected zero segments to succeed, got: %v", err))
	}
	if rootID.String() != "spiffe://example.com" {
		fail(fmt.Sprintf("unexpected root id string: %s", rootID.String()))
	}
	if rootID.Path() != "" {
		fail(fmt.Sprintf("expected empty path for zero segments, got: %q", rootID.Path()))
	}

	// 3. Empty trust domain returns an error
	if _, err := spiffeid.FromSegments(spiffeid.TrustDomain{}, "service"); err == nil {
		fail("expected error for zero trust domain")
	}

	// 4. Empty segment or segment containing '/' or dot segments ('.' / '..') are rejected
	invalidSegmentCases := [][]string{
		{""},
		{"a", ""},
		{"a/b"},
		{"/leading"},
		{"."},
		{".."},
		{"service", "..", "admin"},
	}
	for _, segs := range invalidSegmentCases {
		if _, err := spiffeid.FromSegments(td, segs...); err == nil {
			fail(fmt.Sprintf("expected error for invalid segments %v", segs))
		}
	}
}