github.com/spiffe/go-spiffe/v2 v2.6.0: x509bundle.FromX509Authorities

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify github.com/spiffe/go-spiffe/v2/bundle/x509bundle.FromX509Authorities in pkg:golang/github.com/spiffe/go-spiffe/v2@v2.6.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/github.com/spiffe/go-spiffe/v2@v2.6.0
Demonstrate these symbols/APIs:
  - github.com/spiffe/go-spiffe/v2/bundle/x509bundle.FromX509Authorities

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:49c6a998ba6009f7f94f4b5a0acfccc082e2f6bc6eb2c1219bc90ab2c4b0bfb4","contract":["FromX509Authorities(td, []*x509.Certificate{cert1, cert2}) returns a non-nil *Bundle bound to trust domain td containing both certificates","bundle.HasX509Authority(cert1) and bundle.HasX509Authority(cert2) return true and bundle.X509Authorities() has length 2","mutating the caller's input []*x509.Certificate slice after calling FromX509Authorities does not alter the bundle's stored authorities","FromX509Authorities(td, nil) returns an empty *Bundle bound to trust domain td where Empty() is true"],"goal":"verify github.com/spiffe/go-spiffe/v2/bundle/x509bundle.FromX509Authorities in pkg:golang/github.com/spiffe/go-spiffe/v2@v2.6.0","kind":"HOW","packages":["pkg:golang/github.com/spiffe/go-spiffe/v2@v2.6.0"],"schemaVersion":1,"symbols":["github.com/spiffe/go-spiffe/v2/bundle/x509bundle.FromX509Authorities"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/github.com/spiffe/go-spiffe/v2@v2.6.0"],"schemaVersion":1,"subject":"pkg:golang/github.com/spiffe/go-spiffe/v2@v2.6.0","symbols":["github.com/spiffe/go-spiffe/v2/bundle/x509bundle.FromX509Authorities"],"verifierAdapter":"golang@1"}

module sample

go 1.26.6

require github.com/spiffe/go-spiffe/v2 v2.6.0

github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/go-jose/go-jose/v4 v4.1.2 h1:TK/7NqRQZfgAh+Td8AlsrvtPoUyiHh0LqVvokh+1vHI=
github.com/go-jose/go-jose/v4 v4.1.2/go.mod h1:22cg9HWM1pOlnRiY+9cQYJ9XHmya1bYW8OeDM6Ku6Oo=
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
github.com/spiffe/go-spiffe/v2 v2.6.0 h1:l+DolpxNWYgruGQVV0xsfeya3CsC7m8iBzDnMpsbLuo=
github.com/spiffe/go-spiffe/v2 v2.6.0/go.mod h1:gm2SeUoMZEtpnzPNs2Csc0D/gX33k1xIx7lEzqblHEs=
github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
golang.org/x/crypto v0.39.0 h1:SHs+kF4LP+f+p14esP5jAoDpHU8Gu/v9lFRK6IT5imM=
golang.org/x/crypto v0.39.0/go.mod h1:L+Xg3Wf6HoL4Bn4238Z6ft6KfEpN0tJGo53AAPC632U=
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

{
  "schemaVersion": 1,
  "goal": "verify github.com/spiffe/go-spiffe/v2/bundle/x509bundle.FromX509Authorities in pkg:golang/github.com/spiffe/go-spiffe/v2@v2.6.0",
  "kind": "HOW",
  "packages": [
    "pkg:golang/github.com/spiffe/go-spiffe/v2@v2.6.0"
  ],
  "symbols": [
    "github.com/spiffe/go-spiffe/v2/bundle/x509bundle.FromX509Authorities"
  ]
}

package main

import (
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"crypto/x509"
	"crypto/x509/pkix"
	"fmt"
	"math/big"
	"os"
	"time"

	"github.com/spiffe/go-spiffe/v2/bundle/x509bundle"
	"github.com/spiffe/go-spiffe/v2/spiffeid"
)

func generateCert(cn string) (*x509.Certificate, error) {
	priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		return nil, err
	}
	tmpl := &x509.Certificate{
		SerialNumber: big.NewInt(1),
		Subject: pkix.Name{
			CommonName: cn,
		},
		NotBefore:             time.Now().Add(-time.Hour),
		NotAfter:              time.Now().Add(time.Hour),
		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageCRLSign,
		BasicConstraintsValid: true,
		IsCA:                  true,
	}
	der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &priv.PublicKey, priv)
	if err != nil {
		return nil, err
	}
	return x509.ParseCertificate(der)
}

func main() {
	td, err := spiffeid.TrustDomainFromString("example.com")
	if err != nil {
		fmt.Fprintln(os.Stderr, err)
		os.Exit(1)
	}

	cert1, err := generateCert("authority-1")
	if err != nil {
		fmt.Fprintln(os.Stderr, err)
		os.Exit(1)
	}
	cert2, err := generateCert("authority-2")
	if err != nil {
		fmt.Fprintln(os.Stderr, err)
		os.Exit(1)
	}

	input := []*x509.Certificate{cert1, cert2}
	bundle := x509bundle.FromX509Authorities(td, input)
	if bundle == nil {
		fmt.Fprintln(os.Stderr, "expected non-nil bundle")
		os.Exit(1)
	}
	if bundle.TrustDomain() != td {
		fmt.Fprintf(os.Stderr, "expected trust domain %v, got %v\n", td, bundle.TrustDomain())
		os.Exit(1)
	}
	if bundle.Empty() {
		fmt.Fprintln(os.Stderr, "expected non-empty bundle")
		os.Exit(1)
	}
	auths := bundle.X509Authorities()
	if len(auths) != 2 {
		fmt.Fprintf(os.Stderr, "expected 2 authorities, got %d\n", len(auths))
		os.Exit(1)
	}
	if !bundle.HasX509Authority(cert1) || !bundle.HasX509Authority(cert2) {
		fmt.Fprintln(os.Stderr, "expected bundle to contain both cert1 and cert2")
		os.Exit(1)
	}

	// Mutating the caller slice does not affect the bundle's stored authorities
	input[0] = cert2
	if !bundle.HasX509Authority(cert1) {
		fmt.Fprintln(os.Stderr, "expected bundle to copy authorities slice and retain cert1")
		os.Exit(1)
	}

	// Empty / nil authorities slice creates an empty bundle for the trust domain
	emptyBundle := x509bundle.FromX509Authorities(td, nil)
	if !emptyBundle.Empty() || len(emptyBundle.X509Authorities()) != 0 {
		fmt.Fprintln(os.Stderr, "expected empty bundle when nil authorities slice passed")
		os.Exit(1)
	}
	if emptyBundle.TrustDomain() != td {
		fmt.Fprintf(os.Stderr, "expected trust domain %v on empty bundle, got %v\n", td, emptyBundle.TrustDomain())
		os.Exit(1)
	}
}