go.step.sm/crypto v0.43.1: keyutil.GenerateDefaultSigner

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify go.step.sm/crypto/keyutil.GenerateDefaultSigner in pkg:golang/go.step.sm/crypto@v0.43.1
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/go.step.sm/crypto@v0.43.1
Demonstrate these symbols/APIs:
  - go.step.sm/crypto/keyutil.GenerateDefaultSigner

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:54d3da55af58ceb487d91f8de82d0ff2a752e1e0e8923b43b472ad4d13a8a95a","contract":["keyutil.GenerateDefaultSigner generates a default ECDSA P-256 private key implementing crypto.Signer.","keyutil.GenerateDefaultSigner returns a signer whose Public method returns an *ecdsa.PublicKey with the P-256 elliptic curve.","keyutil.GenerateDefaultSigner produces a signer capable of signing SHA-256 digests verifiable via ecdsa.VerifyASN1.","keyutil.GenerateDefaultSigner produces distinct cryptographic key pairs on subsequent invocations."],"goal":"verify go.step.sm/crypto/keyutil.GenerateDefaultSigner in pkg:golang/go.step.sm/crypto@v0.43.1","kind":"HOW","packages":["pkg:golang/go.step.sm/crypto@v0.43.1"],"schemaVersion":1,"symbols":["go.step.sm/crypto/keyutil.GenerateDefaultSigner"]},"contractCommand":["go","test","./..."],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","executionContext":"go","language":"go","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","runtime":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/go.step.sm/crypto@v0.43.1"],"schemaVersion":1,"subject":"pkg:golang/go.step.sm/crypto@v0.43.1","symbols":["go.step.sm/crypto/keyutil.GenerateDefaultSigner"],"verifierAdapter":"golang@1"}

module example.com/generatedefaultsigner

go 1.22.0

require go.step.sm/crypto v0.43.1

require (
	filippo.io/edwards25519 v1.1.0 // indirect
	github.com/pkg/errors v0.9.1 // indirect
	golang.org/x/crypto v0.19.0 // indirect
	golang.org/x/sys v0.17.0 // indirect
)

filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
github.com/smallstep/assert v0.0.0-20200723003110-82e2b9b3b262 h1:unQFBIznI+VYD1/1fApl1A+9VcBk+9dcqGfnePY87LY=
github.com/smallstep/assert v0.0.0-20200723003110-82e2b9b3b262/go.mod h1:MyOHs9Po2fbM1LHej6sBUT8ozbxmMOFG+E+rx/GSGuc=
go.step.sm/crypto v0.43.1 h1:18Z/M49SnFDPXvFbfoN/ugE1i0J7phLWARhSQs/XSDI=
go.step.sm/crypto v0.43.1/go.mod h1:9n90D/SWjH1hTyQn1hgviUGyK8YRv743S8UZHYbt4BU=
golang.org/x/crypto v0.19.0 h1:ENy+Az/9Y1vSrlrvBSyna3PITt4tiZLf7sgCjZBX7Wo=
golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
golang.org/x/sys v0.17.0 h1:25cE3gD+tdBA7lp7QfhuV+rJiE9YXTcS3VG1SqssI/Y=
golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
golang.org/x/term v0.17.0 h1:mkTF7LCd6WGJNL3K1Ad7kwxNfYAW6a8a8QqtMblp/4U=
golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=

package generatedefaultsigner_test

import (
	"bytes"
	"crypto"
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"crypto/sha256"
	"testing"

	"go.step.sm/crypto/keyutil"
)

func TestGenerateDefaultSigner_TypeAndCurve(t *testing.T) {
	signer, err := keyutil.GenerateDefaultSigner()
	if err != nil {
		t.Fatalf("GenerateDefaultSigner() failed: %v", err)
	}
	if signer == nil {
		t.Fatal("expected non-nil signer")
	}

	ecKey, ok := signer.(*ecdsa.PrivateKey)
	if !ok {
		t.Fatalf("expected *ecdsa.PrivateKey, got %T", signer)
	}

	if ecKey.Curve != elliptic.P256() {
		t.Errorf("expected curve P-256, got %v", ecKey.Curve.Params().Name)
	}
}

func TestGenerateDefaultSigner_PublicKey(t *testing.T) {
	signer, err := keyutil.GenerateDefaultSigner()
	if err != nil {
		t.Fatalf("GenerateDefaultSigner() failed: %v", err)
	}

	pub := signer.Public()
	if pub == nil {
		t.Fatal("expected non-nil public key")
	}

	ecPub, ok := pub.(*ecdsa.PublicKey)
	if !ok {
		t.Fatalf("expected *ecdsa.PublicKey, got %T", pub)
	}

	if ecPub.Curve != elliptic.P256() {
		t.Errorf("expected curve P-256 for public key, got %v", ecPub.Curve.Params().Name)
	}
}

func TestGenerateDefaultSigner_SignAndVerify(t *testing.T) {
	signer, err := keyutil.GenerateDefaultSigner()
	if err != nil {
		t.Fatalf("GenerateDefaultSigner() failed: %v", err)
	}

	ecPub, ok := signer.Public().(*ecdsa.PublicKey)
	if !ok {
		t.Fatalf("expected *ecdsa.PublicKey, got %T", signer.Public())
	}

	message := []byte("test message for default signer verification")
	digest := sha256.Sum256(message)

	sig, err := signer.Sign(rand.Reader, digest[:], crypto.SHA256)
	if err != nil {
		t.Fatalf("Sign failed: %v", err)
	}
	if len(sig) == 0 {
		t.Fatal("expected non-empty signature")
	}

	if !ecdsa.VerifyASN1(ecPub, digest[:], sig) {
		t.Error("ECDSA signature verification failed against public key")
	}
}

func TestGenerateDefaultSigner_Uniqueness(t *testing.T) {
	signer1, err := keyutil.GenerateDefaultSigner()
	if err != nil {
		t.Fatalf("GenerateDefaultSigner() 1 failed: %v", err)
	}

	signer2, err := keyutil.GenerateDefaultSigner()
	if err != nil {
		t.Fatalf("GenerateDefaultSigner() 2 failed: %v", err)
	}

	key1 := signer1.(*ecdsa.PrivateKey)
	key2 := signer2.(*ecdsa.PrivateKey)

	if key1.D.Cmp(key2.D) == 0 {
		t.Error("expected two consecutive calls to generate distinct private keys")
	}

	if bytes.Equal(key1.X.Bytes(), key2.X.Bytes()) && bytes.Equal(key1.Y.Bytes(), key2.Y.Bytes()) {
		t.Error("expected two consecutive calls to generate distinct public keys")
	}
}

{
  "schemaVersion": 1,
  "goal": "verify go.step.sm/crypto/keyutil.GenerateDefaultSigner in pkg:golang/go.step.sm/crypto@v0.43.1",
  "kind": "HOW",
  "packages": [
    "pkg:golang/go.step.sm/crypto@v0.43.1"
  ],
  "symbols": [
    "go.step.sm/crypto/keyutil.GenerateDefaultSigner"
  ]
}