go.step.sm/crypto v0.81.0: minica

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify go.step.sm/crypto/minica in pkg:golang/go.step.sm/crypto@v0.81.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/go.step.sm/crypto@v0.81.0
Demonstrate these symbols/APIs:
  - go.step.sm/crypto/minica

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:8a99a76c5c8d330a08745a780b1b3f5677f2d364403f1988a3d96780468dc489","contract":["minica.New initializes a CA with valid root and intermediate CA certificates and signers","minica.New with minica.WithName sets custom common name on root and intermediate certificates","CA.Sign signs an X.509 certificate template with intermediate CA as issuer and verifiable against root and intermediate pool","CA.SignCSR signs an X.509 certificate request and applies SignOption modifiers","CA.SignSSH signs an SSH certificate template with valid serial, nonce, and SSH user/host signer"],"goal":"verify go.step.sm/crypto/minica in pkg:golang/go.step.sm/crypto@v0.81.0","kind":"HOW","packages":["pkg:golang/go.step.sm/crypto@v0.81.0"],"schemaVersion":1,"symbols":["go.step.sm/crypto/minica"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/go.step.sm/crypto@v0.81.0"],"schemaVersion":1,"subject":"pkg:golang/go.step.sm/crypto@v0.81.0","symbols":["go.step.sm/crypto/minica"],"verifierAdapter":"golang@1"}

module sample

go 1.26.6

require (
	go.step.sm/crypto v0.81.0
	golang.org/x/crypto v0.50.0
)

require (
	dario.cat/mergo v1.0.1 // indirect
	filippo.io/edwards25519 v1.2.0 // indirect
	github.com/Masterminds/goutils v1.1.1 // indirect
	github.com/Masterminds/semver/v3 v3.3.0 // indirect
	github.com/Masterminds/sprig/v3 v3.3.0 // indirect
	github.com/go-jose/go-jose/v3 v3.0.5 // indirect
	github.com/google/uuid v1.6.0 // indirect
	github.com/huandu/xstrings v1.5.0 // indirect
	github.com/mitchellh/copystructure v1.2.0 // indirect
	github.com/mitchellh/reflectwalk v1.0.2 // indirect
	github.com/pkg/errors v0.9.1 // indirect
	github.com/shopspring/decimal v1.4.0 // indirect
	github.com/spf13/cast v1.7.0 // indirect
	golang.org/x/net v0.53.0 // indirect
	golang.org/x/sys v0.44.0 // indirect
	golang.org/x/text v0.36.0 // indirect
)

dario.cat/mergo v1.0.1 h1:Ra4+bf83h2ztPIQYNP99R6m+Y7KfnARDfID+a+vLl4s=
dario.cat/mergo v1.0.1/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
filippo.io/edwards25519 v1.2.0 h1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=
filippo.io/edwards25519 v1.2.0/go.mod h1:xzAOLCNug/yB62zG1bQ8uziwrIqIuxhctzJT18Q77mc=
github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
github.com/Masterminds/semver/v3 v3.3.0 h1:B8LGeaivUe71a5qox1ICM/JLl0NqZSW5CHyL+hmvYS0=
github.com/Masterminds/semver/v3 v3.3.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
github.com/Masterminds/sprig/v3 v3.3.0 h1:mQh0Yrg1XPo6vjYXgtf5OtijNAKJRNcTdOOGZe3tPhs=
github.com/Masterminds/sprig/v3 v3.3.0/go.mod h1:Zy1iXRYNqNLUolqCpL4uhk6SHUMAOSCzdgBfDb35Lz0=
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
github.com/go-jose/go-jose/v3 v3.0.5 h1:BLLJWbC4nMZOfuPVxoZIxeYsn6Nl2r1fITaJ78UQlVQ=
github.com/go-jose/go-jose/v3 v3.0.5/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=
github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
github.com/huandu/xstrings v1.5.0 h1:2ag3IFq9ZDANvthTwTiqSSZLjDc+BedvHPAp5tJy2TI=
github.com/huandu/xstrings v1.5.0/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
github.com/shopspring/decimal v1.4.0 h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp81k=
github.com/shopspring/decimal v1.4.0/go.mod h1:gawqmDU56v4yIKSwfBSFip1HdCCXN8/+DMd9qYNcwME=
github.com/spf13/cast v1.7.0 h1:ntdiHjuueXFgm5nzDRdOS4yfT43P5Fnud6DH50rz/7w=
github.com/spf13/cast v1.7.0/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
go.step.sm/crypto v0.81.0 h1:e+ouzpNt3Xm4dp7HGXhgYB5y4iFik3vh3phHKWmvugU=
go.step.sm/crypto v0.81.0/go.mod h1:fsTizqQeASjTXnbv9O00XtRlIuXRkCdoRiJNyXGQujc=
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=
golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY=
golang.org/x/term v0.42.0/go.mod h1:Dq/D+snpsbazcBG5+F9Q1n2rXV8Ma+71xEjTRufARgY=
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

package main

import (
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"crypto/x509"
	"crypto/x509/pkix"
	"fmt"
	"math/big"
	"net"
	"os"
	"time"

	"go.step.sm/crypto/minica"
	"golang.org/x/crypto/ssh"
)

func main() {
	// 1. Create a default MiniCA
	ca, err := minica.New()
	if err != nil {
		fmt.Fprintf(os.Stderr, "failed to create default minica: %v\n", err)
		os.Exit(1)
	}

	fmt.Printf("Default Root Subject: %s\n", ca.Root.Subject.CommonName)
	fmt.Printf("Default Intermediate Subject: %s\n", ca.Intermediate.Subject.CommonName)
	fmt.Printf("Root is CA: %v, Intermediate is CA: %v\n", ca.Root.IsCA, ca.Intermediate.IsCA)

	// 2. Create MiniCA with custom name
	customCA, err := minica.New(minica.WithName("Example CA"))
	if err != nil {
		fmt.Fprintf(os.Stderr, "failed to create named minica: %v\n", err)
		os.Exit(1)
	}
	fmt.Printf("Named Root Subject: %s\n", customCA.Root.Subject.CommonName)
	fmt.Printf("Named Intermediate Subject: %s\n", customCA.Intermediate.Subject.CommonName)

	// 3. Sign an X.509 certificate template
	leafKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		fmt.Fprintf(os.Stderr, "failed to generate leaf key: %v\n", err)
		os.Exit(1)
	}

	template := &x509.Certificate{
		SerialNumber: big.NewInt(1),
		Subject: pkix.Name{
			CommonName: "localhost",
		},
		DNSNames:    []string{"localhost", "example.com"},
		IPAddresses: []net.IP{net.ParseIP("127.0.0.1")},
		NotBefore:   time.Now().Add(-1 * time.Minute),
		NotAfter:    time.Now().Add(24 * time.Hour),
		PublicKey:   leafKey.Public(),
	}

	leafCert, err := ca.Sign(template)
	if err != nil {
		fmt.Fprintf(os.Stderr, "failed to sign cert: %v\n", err)
		os.Exit(1)
	}
	fmt.Printf("Signed Leaf Subject: %s, Issuer: %s\n", leafCert.Subject.CommonName, leafCert.Issuer.CommonName)

	// 4. Verify the certificate chain
	roots := x509.NewCertPool()
	roots.AddCert(ca.Root)
	intermediates := x509.NewCertPool()
	intermediates.AddCert(ca.Intermediate)

	opts := x509.VerifyOptions{
		Roots:         roots,
		Intermediates: intermediates,
		DNSName:       "localhost",
	}

	if _, err := leafCert.Verify(opts); err != nil {
		fmt.Fprintf(os.Stderr, "failed to verify leaf cert: %v\n", err)
		os.Exit(1)
	}
	fmt.Println("Leaf certificate successfully verified against CA chain!")

	// 5. Sign a CSR with SignOption modifier
	csrKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		fmt.Fprintf(os.Stderr, "failed to generate csr key: %v\n", err)
		os.Exit(1)
	}

	csrTemplate := &x509.CertificateRequest{
		Subject: pkix.Name{
			CommonName: "app.internal.example.com",
		},
		DNSNames: []string{"app.internal.example.com"},
	}
	csrDER, err := x509.CreateCertificateRequest(rand.Reader, csrTemplate, csrKey)
	if err != nil {
		fmt.Fprintf(os.Stderr, "failed to create CSR: %v\n", err)
		os.Exit(1)
	}
	csr, err := x509.ParseCertificateRequest(csrDER)
	if err != nil {
		fmt.Fprintf(os.Stderr, "failed to parse CSR: %v\n", err)
		os.Exit(1)
	}

	csrCert, err := ca.SignCSR(csr, minica.WithModifyFunc(func(c *x509.Certificate) error {
		c.Subject.Organization = []string{"Example Org"}
		return nil
	}))
	if err != nil {
		fmt.Fprintf(os.Stderr, "failed to sign CSR: %v\n", err)
		os.Exit(1)
	}
	fmt.Printf("Signed CSR Subject: %s, Org: %v\n", csrCert.Subject.CommonName, csrCert.Subject.Organization)

	// 6. Sign an SSH Certificate
	userKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		fmt.Fprintf(os.Stderr, "failed to generate ssh user key: %v\n", err)
		os.Exit(1)
	}
	sshPub, err := ssh.NewPublicKey(userKey.Public())
	if err != nil {
		fmt.Fprintf(os.Stderr, "failed to create ssh public key: %v\n", err)
		os.Exit(1)
	}

	sshCertTemplate := &ssh.Certificate{
		Key:             sshPub,
		CertType:        ssh.UserCert,
		KeyId:           "user-key",
		ValidPrincipals: []string{"alice"},
	}
	sshCert, err := ca.SignSSH(sshCertTemplate)
	if err != nil {
		fmt.Fprintf(os.Stderr, "failed to sign SSH certificate: %v\n", err)
		os.Exit(1)
	}
	fmt.Printf("Signed SSH Cert KeyId: %s, Principals: %v, Serial: %d\n", sshCert.KeyId, sshCert.ValidPrincipals, sshCert.Serial)
}

{
  "schemaVersion": 1,
  "goal": "verify go.step.sm/crypto/minica in pkg:golang/go.step.sm/crypto@v0.81.0",
  "kind": "HOW",
  "packages": [
    "pkg:golang/go.step.sm/crypto@v0.81.0"
  ],
  "symbols": [
    "go.step.sm/crypto/minica"
  ]
}

package main

import (
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"crypto/x509"
	"crypto/x509/pkix"
	"fmt"
	"math/big"
	"net"
	"os"
	"reflect"
	"time"

	"go.step.sm/crypto/minica"
	"golang.org/x/crypto/ssh"
)

func main() {
	if err := runContract(); err != nil {
		fmt.Fprintf(os.Stderr, "Contract verification failed: %v\n", err)
		os.Exit(1)
	}
	fmt.Println("All go.step.sm/crypto/minica contract assertions passed.")
}

func runContract() error {
	// Assertion 1: minica.New initializes a CA with valid root and intermediate CA certificates and signers
	ca, err := minica.New()
	if err != nil {
		return fmt.Errorf("minica.New() failed: %w", err)
	}
	if ca.Root == nil || !ca.Root.IsCA || !ca.Root.BasicConstraintsValid {
		return fmt.Errorf("expected valid Root CA certificate")
	}
	if ca.Intermediate == nil || !ca.Intermediate.IsCA || !ca.Intermediate.BasicConstraintsValid {
		return fmt.Errorf("expected valid Intermediate CA certificate")
	}
	if ca.Root.Subject.CommonName != "MiniCA Root CA" {
		return fmt.Errorf("expected root CommonName 'MiniCA Root CA', got %q", ca.Root.Subject.CommonName)
	}
	if ca.Intermediate.Subject.CommonName != "MiniCA Intermediate CA" {
		return fmt.Errorf("expected intermediate CommonName 'MiniCA Intermediate CA', got %q", ca.Intermediate.Subject.CommonName)
	}
	if ca.RootSigner == nil || ca.Signer == nil {
		return fmt.Errorf("expected non-nil RootSigner and Signer")
	}
	if ca.SSHHostSigner == nil || ca.SSHUserSigner == nil {
		return fmt.Errorf("expected non-nil SSHHostSigner and SSHUserSigner")
	}

	// Assertion 2: minica.New with minica.WithName sets custom common name on root and intermediate certificates
	customCA, err := minica.New(minica.WithName("Test Org CA"))
	if err != nil {
		return fmt.Errorf("minica.New(minica.WithName) failed: %w", err)
	}
	if customCA.Root.Subject.CommonName != "Test Org CA Root CA" {
		return fmt.Errorf("expected custom root CommonName 'Test Org CA Root CA', got %q", customCA.Root.Subject.CommonName)
	}
	if customCA.Intermediate.Subject.CommonName != "Test Org CA Intermediate CA" {
		return fmt.Errorf("expected custom intermediate CommonName 'Test Org CA Intermediate CA', got %q", customCA.Intermediate.Subject.CommonName)
	}

	// Assertion 3: CA.Sign signs an X.509 certificate template with intermediate CA as issuer and verifiable against root and intermediate pool
	leafKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		return fmt.Errorf("failed to generate leaf key: %w", err)
	}

	template := &x509.Certificate{
		SerialNumber: big.NewInt(100),
		Subject: pkix.Name{
			CommonName: "app.internal.example.com",
		},
		DNSNames:    []string{"app.internal.example.com", "localhost"},
		IPAddresses: []net.IP{net.ParseIP("127.0.0.1")},
		NotBefore:   time.Now().Add(-1 * time.Minute),
		NotAfter:    time.Now().Add(1 * time.Hour),
		PublicKey:   leafKey.Public(),
	}

	signedCert, err := ca.Sign(template)
	if err != nil {
		return fmt.Errorf("ca.Sign failed: %w", err)
	}
	if signedCert.Issuer.CommonName != ca.Intermediate.Subject.CommonName {
		return fmt.Errorf("expected issuer CommonName %q, got %q", ca.Intermediate.Subject.CommonName, signedCert.Issuer.CommonName)
	}
	if signedCert.Subject.CommonName != template.Subject.CommonName {
		return fmt.Errorf("expected subject CommonName %q, got %q", template.Subject.CommonName, signedCert.Subject.CommonName)
	}

	roots := x509.NewCertPool()
	roots.AddCert(ca.Root)
	intermediates := x509.NewCertPool()
	intermediates.AddCert(ca.Intermediate)

	verifyOpts := x509.VerifyOptions{
		Roots:         roots,
		Intermediates: intermediates,
		DNSName:       "app.internal.example.com",
	}
	if _, err := signedCert.Verify(verifyOpts); err != nil {
		return fmt.Errorf("signed cert verification failed: %w", err)
	}

	// Assertion 4: CA.SignCSR signs an X.509 certificate request and applies SignOption modifiers
	csrKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		return fmt.Errorf("failed to generate csr key: %w", err)
	}

	csrTemplate := &x509.CertificateRequest{
		Subject: pkix.Name{
			CommonName: "service.internal.example.com",
		},
		DNSNames: []string{"service.internal.example.com"},
	}
	csrDER, err := x509.CreateCertificateRequest(rand.Reader, csrTemplate, csrKey)
	if err != nil {
		return fmt.Errorf("failed to create CSR: %w", err)
	}
	csr, err := x509.ParseCertificateRequest(csrDER)
	if err != nil {
		return fmt.Errorf("failed to parse CSR: %w", err)
	}

	csrCert, err := ca.SignCSR(csr, minica.WithModifyFunc(func(c *x509.Certificate) error {
		c.Subject.Organization = []string{"Contoso"}
		return nil
	}))
	if err != nil {
		return fmt.Errorf("ca.SignCSR failed: %w", err)
	}
	if csrCert.Subject.CommonName != csrTemplate.Subject.CommonName {
		return fmt.Errorf("expected CSR cert subject CommonName %q, got %q", csrTemplate.Subject.CommonName, csrCert.Subject.CommonName)
	}
	if !reflect.DeepEqual(csrCert.DNSNames, csrTemplate.DNSNames) {
		return fmt.Errorf("expected CSR cert DNSNames %v, got %v", csrTemplate.DNSNames, csrCert.DNSNames)
	}
	if len(csrCert.Subject.Organization) != 1 || csrCert.Subject.Organization[0] != "Contoso" {
		return fmt.Errorf("expected CSR cert organization ['Contoso'], got %v", csrCert.Subject.Organization)
	}

	csrVerifyOpts := x509.VerifyOptions{
		Roots:         roots,
		Intermediates: intermediates,
		DNSName:       "service.internal.example.com",
	}
	if _, err := csrCert.Verify(csrVerifyOpts); err != nil {
		return fmt.Errorf("CSR cert verification failed: %w", err)
	}

	// Assertion 5: CA.SignSSH signs an SSH certificate template with valid serial, nonce, and SSH user/host signer
	userKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		return fmt.Errorf("failed to generate user key: %w", err)
	}
	sshPub, err := ssh.NewPublicKey(userKey.Public())
	if err != nil {
		return fmt.Errorf("failed to create ssh pub key: %w", err)
	}

	sshTemplate := &ssh.Certificate{
		Key:             sshPub,
		CertType:        ssh.UserCert,
		KeyId:           "user@example.com",
		ValidPrincipals: []string{"developer"},
	}

	sshCert, err := ca.SignSSH(sshTemplate)
	if err != nil {
		return fmt.Errorf("ca.SignSSH failed: %w", err)
	}
	if sshCert.Serial == 0 {
		return fmt.Errorf("expected non-zero serial number on SSH cert")
	}
	if len(sshCert.Nonce) == 0 {
		return fmt.Errorf("expected auto-populated nonce on SSH cert")
	}
	if sshCert.Signature == nil {
		return fmt.Errorf("expected non-nil signature on SSH cert")
	}
	if sshCert.SignatureKey == nil {
		return fmt.Errorf("expected non-nil SignatureKey on SSH cert")
	}

	return nil
}