github.com/spiffe/go-spiffe/v2 v2.6.0: x509bundle.NewSet

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify github.com/spiffe/go-spiffe/v2/bundle/x509bundle.NewSet in pkg:golang/github.com/spiffe/go-spiffe/v2@v2.6.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/github.com/spiffe/go-spiffe/v2@v2.6.0
Demonstrate these symbols/APIs:
  - github.com/spiffe/go-spiffe/v2/bundle/x509bundle.NewSet

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:566a752283396b5fb92752a31f4245f76ae461f23807e83602ae889fcd4ae255","contract":["x509bundle.NewSet() with no arguments returns a non-nil *x509bundle.Set with Len() == 0","x509bundle.NewSet(b1, b2) initializes a set containing both bundles keyed by their spiffeid.TrustDomain","Set.Get and Set.GetX509BundleForTrustDomain return the matching *x509bundle.Bundle for each added trust domain","x509bundle.NewSet with multiple bundles sharing the same trust domain retains the later bundle and deduplicates Set.Len() to 1"],"goal":"verify github.com/spiffe/go-spiffe/v2/bundle/x509bundle.NewSet in pkg:golang/github.com/spiffe/go-spiffe/v2@v2.6.0","kind":"HOW","packages":["pkg:golang/github.com/spiffe/go-spiffe/v2@v2.6.0"],"schemaVersion":1,"symbols":["github.com/spiffe/go-spiffe/v2/bundle/x509bundle.NewSet"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/github.com/spiffe/go-spiffe/v2@v2.6.0"],"schemaVersion":1,"subject":"pkg:golang/github.com/spiffe/go-spiffe/v2@v2.6.0","symbols":["github.com/spiffe/go-spiffe/v2/bundle/x509bundle.NewSet"],"verifierAdapter":"golang@1"}

module example.com/sample

go 1.26.6

require github.com/spiffe/go-spiffe/v2 v2.6.0

github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/go-jose/go-jose/v4 v4.1.2 h1:TK/7NqRQZfgAh+Td8AlsrvtPoUyiHh0LqVvokh+1vHI=
github.com/go-jose/go-jose/v4 v4.1.2/go.mod h1:22cg9HWM1pOlnRiY+9cQYJ9XHmya1bYW8OeDM6Ku6Oo=
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
github.com/spiffe/go-spiffe/v2 v2.6.0 h1:l+DolpxNWYgruGQVV0xsfeya3CsC7m8iBzDnMpsbLuo=
github.com/spiffe/go-spiffe/v2 v2.6.0/go.mod h1:gm2SeUoMZEtpnzPNs2Csc0D/gX33k1xIx7lEzqblHEs=
github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
golang.org/x/crypto v0.39.0 h1:SHs+kF4LP+f+p14esP5jAoDpHU8Gu/v9lFRK6IT5imM=
golang.org/x/crypto v0.39.0/go.mod h1:L+Xg3Wf6HoL4Bn4238Z6ft6KfEpN0tJGo53AAPC632U=
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

{
  "schemaVersion": 1,
  "goal": "verify github.com/spiffe/go-spiffe/v2/bundle/x509bundle.NewSet in pkg:golang/github.com/spiffe/go-spiffe/v2@v2.6.0",
  "kind": "HOW",
  "packages": [
    "pkg:golang/github.com/spiffe/go-spiffe/v2@v2.6.0"
  ],
  "symbols": [
    "github.com/spiffe/go-spiffe/v2/bundle/x509bundle.NewSet"
  ]
}

package main

import (
	"crypto/x509"
	"fmt"
	"os"

	"github.com/spiffe/go-spiffe/v2/bundle/x509bundle"
	"github.com/spiffe/go-spiffe/v2/spiffeid"
)

func main() {
	emptySet := x509bundle.NewSet()
	if emptySet == nil || emptySet.Len() != 0 {
		fmt.Fprintf(os.Stderr, "expected empty set length 0, got %v\n", emptySet)
		os.Exit(1)
	}

	td1, err := spiffeid.TrustDomainFromString("example.com")
	if err != nil {
		fmt.Fprintf(os.Stderr, "unexpected trust domain error: %v\n", err)
		os.Exit(1)
	}
	td2, err := spiffeid.TrustDomainFromString("localhost")
	if err != nil {
		fmt.Fprintf(os.Stderr, "unexpected trust domain error: %v\n", err)
		os.Exit(1)
	}

	cert1 := &x509.Certificate{Raw: []byte{0x30, 0x03, 0x02, 0x01, 0x01}}
	cert2 := &x509.Certificate{Raw: []byte{0x30, 0x03, 0x02, 0x01, 0x02}}

	b1 := x509bundle.FromX509Authorities(td1, []*x509.Certificate{cert1})
	b2 := x509bundle.FromX509Authorities(td2, []*x509.Certificate{cert2})

	set := x509bundle.NewSet(b1, b2)
	if set.Len() != 2 {
		fmt.Fprintf(os.Stderr, "expected set length 2, got %d\n", set.Len())
		os.Exit(1)
	}
	if !set.Has(td1) || !set.Has(td2) {
		fmt.Fprintln(os.Stderr, "expected set to contain both trust domains")
		os.Exit(1)
	}

	got1, ok := set.Get(td1)
	if !ok || !got1.Equal(b1) {
		fmt.Fprintln(os.Stderr, "expected Get(td1) to equal b1")
		os.Exit(1)
	}

	got2, err := set.GetX509BundleForTrustDomain(td2)
	if err != nil || !got2.Equal(b2) {
		fmt.Fprintf(os.Stderr, "expected GetX509BundleForTrustDomain(td2) to equal b2, err=%v\n", err)
		os.Exit(1)
	}

	b1Replacement := x509bundle.FromX509Authorities(td1, []*x509.Certificate{cert2})
	dedupSet := x509bundle.NewSet(b1, b1Replacement)
	if dedupSet.Len() != 1 {
		fmt.Fprintf(os.Stderr, "expected deduplicated set length 1, got %d\n", dedupSet.Len())
		os.Exit(1)
	}
	gotDedup, ok := dedupSet.Get(td1)
	if !ok || !gotDedup.Equal(b1Replacement) {
		fmt.Fprintln(os.Stderr, "expected later bundle for same trust domain to overwrite earlier bundle")
		os.Exit(1)
	}
}