github.com/spiffe/go-spiffe/v2 v2.6.0: spiffeid.TrustDomainFromString

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify github.com/spiffe/go-spiffe/v2/spiffeid.TrustDomainFromString in pkg:golang/github.com/spiffe/go-spiffe/v2@v2.6.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/github.com/spiffe/go-spiffe/v2@v2.6.0
Demonstrate these symbols/APIs:
  - github.com/spiffe/go-spiffe/v2/spiffeid.TrustDomainFromString

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:23281925692c71aba059a0e588322685459491d0b739c7fc7111e448ddd66b0c","contract":["TrustDomainFromString(\"example.com\") parses a bare trust domain string and returns a non-zero TrustDomain with Name() == \"example.com\" and IDString() == \"spiffe://example.com\"","TrustDomainFromString(\"spiffe://example.com/workload/api\") extracts the trust domain from a full SPIFFE ID URI with path","TrustDomainFromString rejects empty strings, uppercase characters, non-spiffe URI schemes, and bare trust domains containing paths"],"goal":"verify github.com/spiffe/go-spiffe/v2/spiffeid.TrustDomainFromString in pkg:golang/github.com/spiffe/go-spiffe/v2@v2.6.0","kind":"HOW","packages":["pkg:golang/github.com/spiffe/go-spiffe/v2@v2.6.0"],"schemaVersion":1,"symbols":["github.com/spiffe/go-spiffe/v2/spiffeid.TrustDomainFromString"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/github.com/spiffe/go-spiffe/v2@v2.6.0"],"schemaVersion":1,"subject":"pkg:golang/github.com/spiffe/go-spiffe/v2@v2.6.0","symbols":["github.com/spiffe/go-spiffe/v2/spiffeid.TrustDomainFromString"],"verifierAdapter":"golang@1"}

module sample

go 1.24.0

require github.com/spiffe/go-spiffe/v2 v2.6.0

github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
github.com/spiffe/go-spiffe/v2 v2.6.0 h1:l+DolpxNWYgruGQVV0xsfeya3CsC7m8iBzDnMpsbLuo=
github.com/spiffe/go-spiffe/v2 v2.6.0/go.mod h1:gm2SeUoMZEtpnzPNs2Csc0D/gX33k1xIx7lEzqblHEs=
github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

{
  "schemaVersion": 1,
  "goal": "verify github.com/spiffe/go-spiffe/v2/spiffeid.TrustDomainFromString in pkg:golang/github.com/spiffe/go-spiffe/v2@v2.6.0",
  "kind": "HOW",
  "packages": [
    "pkg:golang/github.com/spiffe/go-spiffe/v2@v2.6.0"
  ],
  "symbols": [
    "github.com/spiffe/go-spiffe/v2/spiffeid.TrustDomainFromString"
  ]
}

package main

import (
	"fmt"
	"os"

	"github.com/spiffe/go-spiffe/v2/spiffeid"
)

func main() {
	// 1. Valid bare trust domain name
	td, err := spiffeid.TrustDomainFromString("example.com")
	if err != nil {
		fmt.Fprintf(os.Stderr, "expected valid trust domain, got err: %v\n", err)
		os.Exit(1)
	}
	if td.Name() != "example.com" {
		fmt.Fprintf(os.Stderr, "expected Name() == example.com, got %q\n", td.Name())
		os.Exit(1)
	}
	if td.String() != "example.com" {
		fmt.Fprintf(os.Stderr, "expected String() == example.com, got %q\n", td.String())
		os.Exit(1)
	}
	if td.IDString() != "spiffe://example.com" {
		fmt.Fprintf(os.Stderr, "expected IDString() == spiffe://example.com, got %q\n", td.IDString())
		os.Exit(1)
	}
	if td.IsZero() {
		fmt.Fprintf(os.Stderr, "expected non-zero trust domain\n")
		os.Exit(1)
	}

	// 2. Valid SPIFFE ID URI (extracts the trust domain even when path is present)
	tdFromURI, err := spiffeid.TrustDomainFromString("spiffe://example.com/workload/api")
	if err != nil {
		fmt.Fprintf(os.Stderr, "expected valid trust domain from spiffe URI, got err: %v\n", err)
		os.Exit(1)
	}
	if tdFromURI != td {
		fmt.Fprintf(os.Stderr, "expected %v == %v\n", tdFromURI, td)
		os.Exit(1)
	}

	// 3. Invalid inputs must fail
	invalidInputs := []string{
		"",
		"EXAMPLE.COM",
		"http://example.com",
		"example.com/path",
		"spiffe:///path",
	}
	for _, input := range invalidInputs {
		if _, err := spiffeid.TrustDomainFromString(input); err == nil {
			fmt.Fprintf(os.Stderr, "expected error for invalid input %q, got nil\n", input)
			os.Exit(1)
		}
	}
}