go.step.sm/crypto v0.44.6: pemutil.ParseKey, pemutil.Serialize

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify go.step.sm/crypto/pemutil.Serialize in pkg:golang/go.step.sm/crypto@v0.44.6
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/go.step.sm/crypto@v0.44.6
Demonstrate these symbols/APIs:
  - go.step.sm/crypto/pemutil.ParseKey
  - go.step.sm/crypto/pemutil.Serialize

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:aa199fa989e8c5301ed25ba6c9a72fe61c0c906096db7807e323e0d814e55655","contract":["pemutil.Serialize serializes ECDSA private key to PEM block with type \"EC PRIVATE KEY\"","pemutil.Serialize serializes RSA private key to PEM block with type \"RSA PRIVATE KEY\"","pemutil.Serialize serializes Ed25519 private key to PKCS#8 PEM block with type \"PRIVATE KEY\"","pemutil.Serialize serializes public keys to PEM block with type \"PUBLIC KEY\"","pemutil.Serialize encrypts private key with password when given pemutil.WithPassword option","pemutil.ParseKey parses unencrypted and password-protected PEM encoded private and public keys","pemutil.ParseKey returns an error when decrypting with an incorrect password","pemutil.Serialize returns an error when given a nil key"],"goal":"verify go.step.sm/crypto/pemutil.Serialize in pkg:golang/go.step.sm/crypto@v0.44.6","kind":"HOW","packages":["pkg:golang/go.step.sm/crypto@v0.44.6"],"schemaVersion":1,"symbols":["go.step.sm/crypto/pemutil.ParseKey","go.step.sm/crypto/pemutil.Serialize"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/go.step.sm/crypto@v0.44.6"],"schemaVersion":1,"subject":"pkg:golang/go.step.sm/crypto@v0.44.6","symbols":["go.step.sm/crypto/pemutil.ParseKey","go.step.sm/crypto/pemutil.Serialize"],"verifierAdapter":"golang@1"}

module example.com/sample

go 1.26.6

require go.step.sm/crypto v0.44.6

require (
	filippo.io/edwards25519 v1.1.0 // indirect
	github.com/pkg/errors v0.9.1 // indirect
	golang.org/x/crypto v0.22.0 // indirect
	golang.org/x/sys v0.19.0 // indirect
)

filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
github.com/smallstep/assert v0.0.0-20200723003110-82e2b9b3b262 h1:unQFBIznI+VYD1/1fApl1A+9VcBk+9dcqGfnePY87LY=
github.com/smallstep/assert v0.0.0-20200723003110-82e2b9b3b262/go.mod h1:MyOHs9Po2fbM1LHej6sBUT8ozbxmMOFG+E+rx/GSGuc=
go.step.sm/crypto v0.44.6 h1:vQg8ujce7fNXDO8EWdriSz+ZSJpYnNh22QrFtRjdyoY=
go.step.sm/crypto v0.44.6/go.mod h1:oKRO4jaf2MaCohJDN+/8ShImkvIgUKfJxxy87gqsnXs=
golang.org/x/crypto v0.22.0 h1:g1v0xeRhjcugydODzvb3mEM9SQ0HGp9s/nh3COQ/C30=
golang.org/x/crypto v0.22.0/go.mod h1:vr6Su+7cTlO45qkww3VDJlzDn0ctJvRgYbC2NvXHt+M=
golang.org/x/sys v0.19.0 h1:q5f1RH2jigJ1MoAWp2KTp3gm5zAGFUTarQZ5U386+4o=
golang.org/x/sys v0.19.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
golang.org/x/term v0.19.0 h1:+ThwsDv+tYfnJFhF4L8jITxu1tdTWRTZpdsWgEgjL6Q=
golang.org/x/term v0.19.0/go.mod h1:2CuTdWZ7KHSQwUzKva0cbMg6q2DMI3Mmxp+gKJbskEk=

package main

import (
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"encoding/pem"
	"fmt"
	"log"

	"go.step.sm/crypto/pemutil"
)

func main() {
	// Generate an ECDSA private key
	privKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		log.Fatalf("failed to generate private key: %v", err)
	}

	// Serialize the private key to a PEM block
	block, err := pemutil.Serialize(privKey)
	if err != nil {
		log.Fatalf("failed to serialize private key: %v", err)
	}

	// Encode to PEM formatted bytes
	pemBytes := pem.EncodeToMemory(block)

	// Parse the PEM bytes back into a private key
	parsedKey, err := pemutil.ParseKey(pemBytes)
	if err != nil {
		log.Fatalf("failed to parse PEM key: %v", err)
	}

	if _, ok := parsedKey.(*ecdsa.PrivateKey); !ok {
		log.Fatalf("unexpected parsed key type: %T", parsedKey)
	}

	fmt.Printf("Successfully serialized and parsed %s key\n", block.Type)
}

{
  "schemaVersion": 1,
  "goal": "verify go.step.sm/crypto/pemutil.Serialize in pkg:golang/go.step.sm/crypto@v0.44.6",
  "kind": "HOW",
  "packages": [
    "pkg:golang/go.step.sm/crypto@v0.44.6"
  ],
  "symbols": [
    "go.step.sm/crypto/pemutil.ParseKey",
    "go.step.sm/crypto/pemutil.Serialize"
  ]
}

package main

import (
	"crypto/ecdsa"
	"crypto/ed25519"
	"crypto/elliptic"
	"crypto/rand"
	"crypto/rsa"
	"encoding/pem"
	"fmt"
	"os"

	"go.step.sm/crypto/pemutil"
)

func main() {
	// 1. pemutil.Serialize serializes ECDSA private key to PEM block with type "EC PRIVATE KEY"
	ecPriv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		fmt.Fprintf(os.Stderr, "failed to generate EC key: %v\n", err)
		os.Exit(1)
	}
	ecBlock, err := pemutil.Serialize(ecPriv)
	if err != nil || ecBlock == nil || ecBlock.Type != "EC PRIVATE KEY" {
		fmt.Fprintf(os.Stderr, "Serialize(ecPriv) failed: %v\n", err)
		os.Exit(1)
	}

	// 2. pemutil.Serialize serializes RSA private key to PEM block with type "RSA PRIVATE KEY"
	rsaPriv, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		fmt.Fprintf(os.Stderr, "failed to generate RSA key: %v\n", err)
		os.Exit(1)
	}
	rsaBlock, err := pemutil.Serialize(rsaPriv)
	if err != nil || rsaBlock == nil || rsaBlock.Type != "RSA PRIVATE KEY" {
		fmt.Fprintf(os.Stderr, "Serialize(rsaPriv) failed: %v\n", err)
		os.Exit(1)
	}

	// 3. pemutil.Serialize serializes Ed25519 private key to PKCS#8 PEM block with type "PRIVATE KEY"
	edPub, edPriv, err := ed25519.GenerateKey(rand.Reader)
	if err != nil {
		fmt.Fprintf(os.Stderr, "failed to generate Ed25519 key: %v\n", err)
		os.Exit(1)
	}
	edBlock, err := pemutil.Serialize(edPriv)
	if err != nil || edBlock == nil || edBlock.Type != "PRIVATE KEY" {
		fmt.Fprintf(os.Stderr, "Serialize(edPriv) failed: %v\n", err)
		os.Exit(1)
	}

	// 4. pemutil.Serialize serializes public keys to PEM block with type "PUBLIC KEY"
	pubBlock, err := pemutil.Serialize(edPub)
	if err != nil || pubBlock == nil || pubBlock.Type != "PUBLIC KEY" {
		fmt.Fprintf(os.Stderr, "Serialize(edPub) failed: %v\n", err)
		os.Exit(1)
	}
	ecPubBlock, err := pemutil.Serialize(&ecPriv.PublicKey)
	if err != nil || ecPubBlock == nil || ecPubBlock.Type != "PUBLIC KEY" {
		fmt.Fprintf(os.Stderr, "Serialize(ecPub) failed: %v\n", err)
		os.Exit(1)
	}

	// 5. pemutil.Serialize encrypts private key with password when given pemutil.WithPassword option
	encBlock, err := pemutil.Serialize(rsaPriv, pemutil.WithPassword([]byte("testpassword123")))
	if err != nil || encBlock == nil || encBlock.Type != "RSA PRIVATE KEY" {
		fmt.Fprintf(os.Stderr, "Serialize with password failed: %v\n", err)
		os.Exit(1)
	}

	// 6. pemutil.ParseKey parses unencrypted and password-protected PEM encoded private and public keys
	ecParsed, err := pemutil.ParseKey(pem.EncodeToMemory(ecBlock))
	if err != nil {
		fmt.Fprintf(os.Stderr, "ParseKey(ecBlock) failed: %v\n", err)
		os.Exit(1)
	}
	if _, ok := ecParsed.(*ecdsa.PrivateKey); !ok {
		fmt.Fprintf(os.Stderr, "ParseKey(ecBlock) returned %T, expected *ecdsa.PrivateKey\n", ecParsed)
		os.Exit(1)
	}

	rsaParsed, err := pemutil.ParseKey(pem.EncodeToMemory(rsaBlock))
	if err != nil {
		fmt.Fprintf(os.Stderr, "ParseKey(rsaBlock) failed: %v\n", err)
		os.Exit(1)
	}
	if _, ok := rsaParsed.(*rsa.PrivateKey); !ok {
		fmt.Fprintf(os.Stderr, "ParseKey(rsaBlock) returned %T, expected *rsa.PrivateKey\n", rsaParsed)
		os.Exit(1)
	}

	edParsed, err := pemutil.ParseKey(pem.EncodeToMemory(edBlock))
	if err != nil {
		fmt.Fprintf(os.Stderr, "ParseKey(edBlock) failed: %v\n", err)
		os.Exit(1)
	}
	if _, ok := edParsed.(ed25519.PrivateKey); !ok {
		fmt.Fprintf(os.Stderr, "ParseKey(edBlock) returned %T, expected ed25519.PrivateKey\n", edParsed)
		os.Exit(1)
	}

	pubParsed, err := pemutil.ParseKey(pem.EncodeToMemory(pubBlock))
	if err != nil {
		fmt.Fprintf(os.Stderr, "ParseKey(pubBlock) failed: %v\n", err)
		os.Exit(1)
	}
	if _, ok := pubParsed.(ed25519.PublicKey); !ok {
		fmt.Fprintf(os.Stderr, "ParseKey(pubBlock) returned %T, expected ed25519.PublicKey\n", pubParsed)
		os.Exit(1)
	}

	encParsed, err := pemutil.ParseKey(pem.EncodeToMemory(encBlock), pemutil.WithPassword([]byte("testpassword123")))
	if err != nil {
		fmt.Fprintf(os.Stderr, "ParseKey with password failed: %v\n", err)
		os.Exit(1)
	}
	if _, ok := encParsed.(*rsa.PrivateKey); !ok {
		fmt.Fprintf(os.Stderr, "ParseKey with password returned %T, expected *rsa.PrivateKey\n", encParsed)
		os.Exit(1)
	}

	// 7. pemutil.ParseKey returns an error when decrypting with an incorrect password
	if _, err := pemutil.ParseKey(pem.EncodeToMemory(encBlock), pemutil.WithPassword([]byte("wrongpassword"))); err == nil {
		fmt.Fprintf(os.Stderr, "ParseKey with wrong password expected error, got nil\n")
		os.Exit(1)
	}

	// 8. pemutil.Serialize returns an error when given a nil key
	if _, err := pemutil.Serialize(nil); err == nil {
		fmt.Fprintf(os.Stderr, "Serialize(nil) expected error, got nil\n")
		os.Exit(1)
	}

	fmt.Println("All contract assertions passed.")
}