CodeSampleX

Exemplo

go.step.sm/crypto v0.44.6: minica.Sign

Amostra verificada para golang go.step.sm/crypto v0.44.6: minica.Sign. O contrato rodou em go 1.26 · linux alpine/x64 · docker e passou.

sha256:b6888a6294b69bb88bc910619445b0f1596c137d0a2d57ea36423739084400e4

Esta rede oferece uma coisa: uma amostra que compila. Ela a executou em um sandbox e guardou o recibo assinado. Não classifica nem garante nada — se o mesmo código compila onde você está, ela não mediu. Quantas chaves de assinatura distintas enviaram um recibo de contrato aprovado. Uma é só o autor; mais de uma significa que outra pessoa também o compilou. Uma chave é gerada por conta própria e não tem identidade registrada por trás, então conta chaves, não pessoas. MIT-0

Evidência de execução

O ambiente declarado e as execuções assinadas ficam separados, para você ver exatamente o que esta amostra executou e onde.

Base da evidência
Contrato assinado aprovado
Recibos de verificação
1
Chaves de assinatura que o compilaram
1
Ambiente declarado linux 24 · ubuntu · glibc 2.39 x64 go

Ambientes das execuções de verificação

Ambiente Contrato Etapas Execução
go 1.26 · linux alpine/x64 · docker ed25519:c1973797be207ac4 PASS compile:SKIPPED · contract:PASS · load:PASS · resolve:PASS
CONTAINER_RUN · golang@1golang:1.26-alpine@sha256:28d89ee9cc0f…		 2026-08-27

Caso

HOW
Objetivo
verify go.step.sm/crypto/minica.Sign in pkg:golang/go.step.sm/crypto@v0.44.6
Pacotes
Símbolos
  • go.step.sm/crypto/minica.Sign
Criado
2026-08-27T14:03:24Z

Contrato

  1. minica.New initializes a new MiniCA with default Root and Intermediate CA certificates and signers
  2. minica.New with minica.WithName configures Root and Intermediate CA Subject CommonNames with custom prefix
  3. minica.CA.Sign signs an X.509 certificate template and automatically populates NotBefore, NotAfter, SerialNumber, and SubjectKeyId
  4. minica.CA.Sign preserves explicit SerialNumber and validity period when provided in certificate template
  5. minica.CA.Sign sets AuthorityKeyId matching the intermediate CA SubjectKeyId and Issuer matching intermediate CA Subject
  6. x509 certificate signed by minica.CA.Sign verifies successfully against intermediate and root CA certificate pools
  7. minica.CA.Sign signs certificate templates with RSA public keys
  8. minica.CA.Sign returns an error when given an invalid certificate template with a nil public key

Arquivos

  • PROMPT.md
  • csx.json
  • go.mod
  • go.sum
  • main.go
  • spec.json
  • test/contract.go

Baixar o artefato de código-fonte (tar.gz)

Código-fonte

PROMPT.md
Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify go.step.sm/crypto/minica.Sign in pkg:golang/go.step.sm/crypto@v0.44.6
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/go.step.sm/crypto@v0.44.6
Demonstrate these symbols/APIs:
  - go.step.sm/crypto/minica.Sign
Constraints:
  - executionContext: node
Required runtime conditions:
  - ecosystem: npm
  - language: javascript
  - moduleSystem: cjs
  - packageManager: npm@10.9.8
  - runtime: node@22.23.2

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.
csx.json
{"case":{"caseId":"case:sha256:229d20bf704fb254edaa42b582e5703ba17fec69b2a254a6ee7f2bfdfc0fc0f2","contract":["minica.New initializes a new MiniCA with default Root and Intermediate CA certificates and signers","minica.New with minica.WithName configures Root and Intermediate CA Subject CommonNames with custom prefix","minica.CA.Sign signs an X.509 certificate template and automatically populates NotBefore, NotAfter, SerialNumber, and SubjectKeyId","minica.CA.Sign preserves explicit SerialNumber and validity period when provided in certificate template","minica.CA.Sign sets AuthorityKeyId matching the intermediate CA SubjectKeyId and Issuer matching intermediate CA Subject","x509 certificate signed by minica.CA.Sign verifies successfully against intermediate and root CA certificate pools","minica.CA.Sign signs certificate templates with RSA public keys","minica.CA.Sign returns an error when given an invalid certificate template with a nil public key"],"goal":"verify go.step.sm/crypto/minica.Sign in pkg:golang/go.step.sm/crypto@v0.44.6","kind":"HOW","packages":["pkg:golang/go.step.sm/crypto@v0.44.6"],"schemaVersion":1,"symbols":["go.step.sm/crypto/minica.Sign"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/go.step.sm/crypto@v0.44.6"],"schemaVersion":1,"subject":"pkg:golang/go.step.sm/crypto@v0.44.6","symbols":["go.step.sm/crypto/minica.Sign"],"verifierAdapter":"golang@1"}
go.mod
module sample

go 1.22

require go.step.sm/crypto v0.44.6

require (
	filippo.io/edwards25519 v1.1.0 // indirect
	github.com/Masterminds/goutils v1.1.1 // indirect
	github.com/Masterminds/semver/v3 v3.2.0 // indirect
	github.com/Masterminds/sprig/v3 v3.2.3 // indirect
	github.com/google/uuid v1.6.0 // indirect
	github.com/huandu/xstrings v1.3.3 // indirect
	github.com/imdario/mergo v0.3.12 // indirect
	github.com/mitchellh/copystructure v1.2.0 // indirect
	github.com/mitchellh/reflectwalk v1.0.2 // indirect
	github.com/pkg/errors v0.9.1 // indirect
	github.com/shopspring/decimal v1.2.0 // indirect
	github.com/spf13/cast v1.4.1 // indirect
	golang.org/x/crypto v0.22.0 // indirect
	golang.org/x/net v0.24.0 // indirect
	golang.org/x/sys v0.19.0 // indirect
	golang.org/x/text v0.14.0 // indirect
)
go.sum
filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
github.com/Masterminds/semver/v3 v3.2.0 h1:3MEsd0SM6jqZojhjLWWeBY+Kcjy9i6MQAeY7YgDP83g=
github.com/Masterminds/semver/v3 v3.2.0/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
github.com/Masterminds/sprig/v3 v3.2.3 h1:eL2fZNezLomi0uOLqjQoN6BfsDD+fyLtgbJMAj9n6YA=
github.com/Masterminds/sprig/v3 v3.2.3/go.mod h1:rXcFaZ2zZbLRJv/xSysmlgIM1u11eBaRMhvYXJNkGuM=
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
github.com/huandu/xstrings v1.3.3 h1:/Gcsuc1x8JVbJ9/rlye4xZnVAbEkGauT8lbebqcQws4=
github.com/huandu/xstrings v1.3.3/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
github.com/imdario/mergo v0.3.11/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
github.com/imdario/mergo v0.3.12 h1:b6R2BslTbIEToALKP7LxUvijTsNI9TAe80pLWN2g/HU=
github.com/imdario/mergo v0.3.12/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
github.com/mitchellh/copystructure v1.0.0/go.mod h1:SNtv71yrdKgLRyLFxmLdkAbkKEFWgYaq1OVrnRcwhnw=
github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
github.com/mitchellh/reflectwalk v1.0.0/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
github.com/shopspring/decimal v1.2.0 h1:abSATXmQEYyShuxI4/vyW3tV1MrKAJzCZ/0zLUXYbsQ=
github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
github.com/smallstep/assert v0.0.0-20200723003110-82e2b9b3b262 h1:unQFBIznI+VYD1/1fApl1A+9VcBk+9dcqGfnePY87LY=
github.com/smallstep/assert v0.0.0-20200723003110-82e2b9b3b262/go.mod h1:MyOHs9Po2fbM1LHej6sBUT8ozbxmMOFG+E+rx/GSGuc=
github.com/spf13/cast v1.3.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
github.com/spf13/cast v1.4.1 h1:s0hze+J0196ZfEMTs80N7UlFt0BDuQ7Q+JDnHiMWKdA=
github.com/spf13/cast v1.4.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
go.step.sm/crypto v0.44.6 h1:vQg8ujce7fNXDO8EWdriSz+ZSJpYnNh22QrFtRjdyoY=
go.step.sm/crypto v0.44.6/go.mod h1:oKRO4jaf2MaCohJDN+/8ShImkvIgUKfJxxy87gqsnXs=
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
golang.org/x/crypto v0.22.0 h1:g1v0xeRhjcugydODzvb3mEM9SQ0HGp9s/nh3COQ/C30=
golang.org/x/crypto v0.22.0/go.mod h1:vr6Su+7cTlO45qkww3VDJlzDn0ctJvRgYbC2NvXHt+M=
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
golang.org/x/net v0.24.0 h1:1PcaxkF854Fu3+lvBIx5SYn9wRlBzzcnHZSiaFFAb0w=
golang.org/x/net v0.24.0/go.mod h1:2Q7sJY5mzlzWjKtYUEXSlBWCdyaioyXzRB2RtU8KVE8=
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.19.0 h1:q5f1RH2jigJ1MoAWp2KTp3gm5zAGFUTarQZ5U386+4o=
golang.org/x/sys v0.19.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
golang.org/x/term v0.19.0 h1:+ThwsDv+tYfnJFhF4L8jITxu1tdTWRTZpdsWgEgjL6Q=
golang.org/x/term v0.19.0/go.mod h1:2CuTdWZ7KHSQwUzKva0cbMg6q2DMI3Mmxp+gKJbskEk=
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
gopkg.in/yaml.v2 v2.3.0 h1:clyUAQHOM3G0M3f5vQj7LuJrETvjVot3Z5el9nffUtU=
gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
main.go
package main

import (
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"crypto/x509"
	"crypto/x509/pkix"
	"fmt"
	"net"

	"go.step.sm/crypto/minica"
)

func main() {
	ca, err := minica.New(minica.WithName("Example"))
	if err != nil {
		fmt.Printf("failed to initialize CA: %v\n", err)
		return
	}

	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		fmt.Printf("failed to generate key: %v\n", err)
		return
	}

	tmpl := &x509.Certificate{
		Subject: pkix.Name{
			CommonName: "service.example.internal",
		},
		DNSNames:    []string{"service.example.internal"},
		IPAddresses: []net.IP{net.ParseIP("127.0.0.1")},
		PublicKey:   key.Public(),
	}

	cert, err := ca.Sign(tmpl)
	if err != nil {
		fmt.Printf("failed to sign certificate: %v\n", err)
		return
	}

	roots := x509.NewCertPool()
	roots.AddCert(ca.Root)
	intermediates := x509.NewCertPool()
	intermediates.AddCert(ca.Intermediate)

	opts := x509.VerifyOptions{
		Roots:         roots,
		Intermediates: intermediates,
		DNSName:       "service.example.internal",
	}

	if _, err := cert.Verify(opts); err != nil {
		fmt.Printf("certificate verification failed: %v\n", err)
		return
	}

	fmt.Printf("Successfully signed and verified certificate for %s\n", cert.Subject.CommonName)
}
spec.json
{
  "schemaVersion": 1,
  "goal": "verify go.step.sm/crypto/minica.Sign in pkg:golang/go.step.sm/crypto@v0.44.6",
  "kind": "HOW",
  "packages": [
    "pkg:golang/go.step.sm/crypto@v0.44.6"
  ],
  "symbols": [
    "go.step.sm/crypto/minica.Sign"
  ],
  "constraints": {
    "executionContext": "node"
  },
  "runtimeConditions": {
    "ecosystem": "npm",
    "language": "javascript",
    "moduleSystem": "cjs",
    "packageManager": "npm@10.9.8",
    "runtime": "node@22.23.2"
  }
}
test/contract.go
package main

import (
	"bytes"
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"crypto/rsa"
	"crypto/x509"
	"crypto/x509/pkix"
	"fmt"
	"math/big"
	"net"
	"os"
	"time"

	"go.step.sm/crypto/minica"
)

func main() {
	// Assertion 1: minica.New initializes a new MiniCA with default Root and Intermediate CA certificates and signers
	{
		ca, err := minica.New()
		if err != nil {
			fmt.Fprintf(os.Stderr, "Contract 1 failed: minica.New error: %v\n", err)
			os.Exit(1)
		}
		if ca.Root == nil || ca.Intermediate == nil || ca.Signer == nil || ca.RootSigner == nil {
			fmt.Fprintf(os.Stderr, "Contract 1 failed: nil CA certificates or signers\n")
			os.Exit(1)
		}
		if ca.Root.Subject.CommonName != "MiniCA Root CA" {
			fmt.Fprintf(os.Stderr, "Contract 1 failed: unexpected default Root CN: %s\n", ca.Root.Subject.CommonName)
			os.Exit(1)
		}
		if ca.Intermediate.Subject.CommonName != "MiniCA Intermediate CA" {
			fmt.Fprintf(os.Stderr, "Contract 1 failed: unexpected default Intermediate CN: %s\n", ca.Intermediate.Subject.CommonName)
			os.Exit(1)
		}
	}

	// Assertion 2: minica.New with minica.WithName configures Root and Intermediate CA Subject CommonNames with custom prefix
	var ca *minica.CA
	{
		var err error
		ca, err = minica.New(minica.WithName("TestPKI"))
		if err != nil {
			fmt.Fprintf(os.Stderr, "Contract 2 failed: minica.New with name error: %v\n", err)
			os.Exit(1)
		}
		if ca.Root.Subject.CommonName != "TestPKI Root CA" {
			fmt.Fprintf(os.Stderr, "Contract 2 failed: unexpected named Root CN: %s\n", ca.Root.Subject.CommonName)
			os.Exit(1)
		}
		if ca.Intermediate.Subject.CommonName != "TestPKI Intermediate CA" {
			fmt.Fprintf(os.Stderr, "Contract 2 failed: unexpected named Intermediate CN: %s\n", ca.Intermediate.Subject.CommonName)
			os.Exit(1)
		}
	}

	ecKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		fmt.Fprintf(os.Stderr, "Setup error: failed to generate ECDSA key: %v\n", err)
		os.Exit(1)
	}

	var signedCert *x509.Certificate

	// Assertion 3: minica.CA.Sign signs an X.509 certificate template and automatically populates NotBefore, NotAfter, SerialNumber, and SubjectKeyId
	{
		beforeTime := time.Now().Add(-1 * time.Second)
		tmpl := &x509.Certificate{
			Subject: pkix.Name{
				CommonName: "server.example.internal",
			},
			DNSNames:    []string{"server.example.internal"},
			IPAddresses: []net.IP{net.ParseIP("192.168.1.10")},
			PublicKey:   ecKey.Public(),
		}
		signedCert, err = ca.Sign(tmpl)
		if err != nil {
			fmt.Fprintf(os.Stderr, "Contract 3 failed: ca.Sign error: %v\n", err)
			os.Exit(1)
		}
		if signedCert.SerialNumber == nil || signedCert.SerialNumber.Sign() <= 0 {
			fmt.Fprintf(os.Stderr, "Contract 3 failed: SerialNumber not generated or non-positive\n")
			os.Exit(1)
		}
		if signedCert.NotBefore.Before(beforeTime) || signedCert.NotBefore.After(time.Now().Add(5*time.Second)) {
			fmt.Fprintf(os.Stderr, "Contract 3 failed: NotBefore not set to current time\n")
			os.Exit(1)
		}
		expectedNotAfter := signedCert.NotBefore.Add(24 * time.Hour)
		if !signedCert.NotAfter.Equal(expectedNotAfter) {
			fmt.Fprintf(os.Stderr, "Contract 3 failed: NotAfter (%v) expected to be 24h after NotBefore (%v)\n", signedCert.NotAfter, expectedNotAfter)
			os.Exit(1)
		}
		if len(signedCert.SubjectKeyId) == 0 {
			fmt.Fprintf(os.Stderr, "Contract 3 failed: SubjectKeyId empty\n")
			os.Exit(1)
		}
		if signedCert.Subject.CommonName != "server.example.internal" {
			fmt.Fprintf(os.Stderr, "Contract 3 failed: CommonName mismatch\n")
			os.Exit(1)
		}
	}

	// Assertion 4: minica.CA.Sign preserves explicit SerialNumber and validity period when provided in certificate template
	{
		customSerial := big.NewInt(778899)
		customNotBefore := time.Now().Add(-2 * time.Hour).Truncate(time.Second)
		customNotAfter := customNotBefore.Add(72 * time.Hour)
		tmpl := &x509.Certificate{
			SerialNumber: customSerial,
			NotBefore:    customNotBefore,
			NotAfter:     customNotAfter,
			Subject: pkix.Name{
				CommonName: "custom.example.internal",
			},
			PublicKey: ecKey.Public(),
		}
		customCert, err := ca.Sign(tmpl)
		if err != nil {
			fmt.Fprintf(os.Stderr, "Contract 4 failed: ca.Sign error: %v\n", err)
			os.Exit(1)
		}
		if customCert.SerialNumber.Cmp(customSerial) != 0 {
			fmt.Fprintf(os.Stderr, "Contract 4 failed: SerialNumber not preserved, got %v want %v\n", customCert.SerialNumber, customSerial)
			os.Exit(1)
		}
		if !customCert.NotBefore.Equal(customNotBefore) {
			fmt.Fprintf(os.Stderr, "Contract 4 failed: NotBefore not preserved, got %v want %v\n", customCert.NotBefore, customNotBefore)
			os.Exit(1)
		}
		if !customCert.NotAfter.Equal(customNotAfter) {
			fmt.Fprintf(os.Stderr, "Contract 4 failed: NotAfter not preserved, got %v want %v\n", customCert.NotAfter, customNotAfter)
			os.Exit(1)
		}
	}

	// Assertion 5: minica.CA.Sign sets AuthorityKeyId matching the intermediate CA SubjectKeyId and Issuer matching intermediate CA Subject
	{
		if !bytes.Equal(signedCert.AuthorityKeyId, ca.Intermediate.SubjectKeyId) {
			fmt.Fprintf(os.Stderr, "Contract 5 failed: AuthorityKeyId (%x) does not match intermediate SubjectKeyId (%x)\n", signedCert.AuthorityKeyId, ca.Intermediate.SubjectKeyId)
			os.Exit(1)
		}
		if signedCert.Issuer.CommonName != ca.Intermediate.Subject.CommonName {
			fmt.Fprintf(os.Stderr, "Contract 5 failed: Issuer CommonName (%s) does not match intermediate (%s)\n", signedCert.Issuer.CommonName, ca.Intermediate.Subject.CommonName)
			os.Exit(1)
		}
	}

	// Assertion 6: x509 certificate signed by minica.CA.Sign verifies successfully against intermediate and root CA certificate pools
	{
		roots := x509.NewCertPool()
		roots.AddCert(ca.Root)
		intermediates := x509.NewCertPool()
		intermediates.AddCert(ca.Intermediate)

		opts := x509.VerifyOptions{
			Roots:         roots,
			Intermediates: intermediates,
			DNSName:       "server.example.internal",
		}
		chains, err := signedCert.Verify(opts)
		if err != nil {
			fmt.Fprintf(os.Stderr, "Contract 6 failed: certificate verification error: %v\n", err)
			os.Exit(1)
		}
		if len(chains) == 0 || len(chains[0]) != 3 {
			fmt.Fprintf(os.Stderr, "Contract 6 failed: expected chain depth 3 (cert -> intermediate -> root), got %d chains\n", len(chains))
			os.Exit(1)
		}
	}

	// Assertion 7: minica.CA.Sign signs certificate templates with RSA public keys
	{
		rsaKey, err := rsa.GenerateKey(rand.Reader, 2048)
		if err != nil {
			fmt.Fprintf(os.Stderr, "Contract 7 setup error: RSA key generation failed: %v\n", err)
			os.Exit(1)
		}
		rsaTmpl := &x509.Certificate{
			Subject: pkix.Name{
				CommonName: "rsa.example.internal",
			},
			PublicKey: rsaKey.Public(),
		}
		rsaCert, err := ca.Sign(rsaTmpl)
		if err != nil {
			fmt.Fprintf(os.Stderr, "Contract 7 failed: ca.Sign with RSA key error: %v\n", err)
			os.Exit(1)
		}
		if rsaCert.Subject.CommonName != "rsa.example.internal" {
			fmt.Fprintf(os.Stderr, "Contract 7 failed: RSA cert CommonName mismatch\n")
			os.Exit(1)
		}
	}

	// Assertion 8: minica.CA.Sign returns an error when given an invalid certificate template with a nil public key
	{
		nilKeyTmpl := &x509.Certificate{
			Subject: pkix.Name{
				CommonName: "nilkey.example.internal",
			},
			PublicKey: nil,
		}
		_, err := ca.Sign(nilKeyTmpl)
		if err == nil {
			fmt.Fprintf(os.Stderr, "Contract 8 failed: expected error when signing template with nil PublicKey, got nil\n")
			os.Exit(1)
		}
	}

	fmt.Println("All contract assertions passed.")
}

Seeder de origem

anônimo