go.step.sm/crypto v0.89.0

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify pkg:golang/go.step.sm/crypto@v0.89.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/go.step.sm/crypto@v0.89.0

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:b9d62eb8d8d6b98a5f477f29b6e0f294bbcefddcb05820a83c08f55745d4f8b0","contract":["fingerprint.New generates lowercase hex-encoded SHA-256 fingerprint for input data with HexFingerprint","fingerprint.Fingerprint encodes precomputed digest using Base64Fingerprint with standard padding","fingerprint.Fingerprint encodes precomputed digest using Base64URLFingerprint with URL-safe characters","fingerprint.Fingerprint encodes precomputed digest using Base64RawFingerprint and Base64RawURLFingerprint without padding","fingerprint.Fingerprint encodes precomputed digest into visual emoji representation using EmojiFingerprint","fingerprint.New returns an error when an unavailable hash algorithm is requested","fingerprint.New returns an error and fingerprint.Fingerprint returns empty string for unknown encoding values"],"goal":"verify pkg:golang/go.step.sm/crypto@v0.89.0","kind":"HOW","packages":["pkg:golang/go.step.sm/crypto@v0.89.0"],"schemaVersion":1},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/go.step.sm/crypto@v0.89.0"],"schemaVersion":1,"subject":"pkg:golang/go.step.sm/crypto@v0.89.0","verifierAdapter":"golang@1"}

module example.com/sample

go 1.26.6

require go.step.sm/crypto v0.89.0

go.step.sm/crypto v0.89.0 h1:NPxryE+cZ4XDwXOQY2U6Gu+mOzOihuRLPIsX7WtPzZM=
go.step.sm/crypto v0.89.0/go.mod h1:IEgE6DndnYojbDyHU7eYXpwWzpu4ftkouw7nyI6jsxg=

package main

import (
	"crypto"
	_ "crypto/sha256"
	"fmt"
	"log"

	"go.step.sm/crypto/fingerprint"
)

func main() {
	certData := []byte("example-x509-certificate-payload")

	hexFP, err := fingerprint.New(certData, crypto.SHA256, fingerprint.HexFingerprint)
	if err != nil {
		log.Fatalf("failed to generate hex fingerprint: %v", err)
	}
	fmt.Printf("Hex Fingerprint: %s\n", hexFP)

	digest := []byte{
		0x38, 0x01, 0x16, 0x21, 0xec, 0xdc, 0xc2, 0x17,
		0x2e, 0x93, 0x3a, 0x1e, 0xf2, 0x31, 0x7e, 0xfc,
		0x53, 0x5a, 0x16, 0x1c, 0x00, 0x33, 0x3a, 0xee,
		0x3f, 0x84, 0xab, 0xfa, 0xb4, 0xe6, 0x40, 0xbf,
	}

	b64 := fingerprint.Fingerprint(digest, fingerprint.Base64Fingerprint)
	fmt.Printf("Base64: %s\n", b64)

	b64URL := fingerprint.Fingerprint(digest, fingerprint.Base64URLFingerprint)
	fmt.Printf("Base64URL: %s\n", b64URL)

	b64Raw := fingerprint.Fingerprint(digest, fingerprint.Base64RawFingerprint)
	fmt.Printf("Base64Raw: %s\n", b64Raw)

	b64RawURL := fingerprint.Fingerprint(digest, fingerprint.Base64RawURLFingerprint)
	fmt.Printf("Base64RawURL: %s\n", b64RawURL)

	emojiFP := fingerprint.Fingerprint(digest, fingerprint.EmojiFingerprint)
	fmt.Printf("Emoji Fingerprint: %s\n", emojiFP)
}

{
  "schemaVersion": 1,
  "goal": "verify pkg:golang/go.step.sm/crypto@v0.89.0",
  "kind": "HOW",
  "packages": [
    "pkg:golang/go.step.sm/crypto@v0.89.0"
  ]
}

package main

import (
	"crypto"
	_ "crypto/sha256"
	"fmt"
	"os"
	"strings"

	"go.step.sm/crypto/fingerprint"
)

func main() {
	if err := runContract(); err != nil {
		fmt.Fprintf(os.Stderr, "Contract verification failed: %v\n", err)
		os.Exit(1)
	}
	fmt.Println("All contract assertions passed.")
}

func runContract() error {
	sampleData := []byte("Lorem ipsum dolor sit amet")

	// Assertion 1: fingerprint.New generates lowercase hex-encoded SHA-256 fingerprint for input data with HexFingerprint
	hexFP, err := fingerprint.New(sampleData, crypto.SHA256, fingerprint.HexFingerprint)
	if err != nil {
		return fmt.Errorf("fingerprint.New(HexFingerprint) failed: %w", err)
	}
	expectedHex := "16aba5393ad72c0041f5600ad3c2c52ec437a2f0c7fc08fadfc3c0fe9641d7a3"
	if hexFP != expectedHex {
		return fmt.Errorf("hex fingerprint mismatch: got %q, want %q", hexFP, expectedHex)
	}
	if hexFP != strings.ToLower(hexFP) {
		return fmt.Errorf("hex fingerprint is not lowercase: %q", hexFP)
	}

	digest := []byte{
		0x38, 0x01, 0x16, 0x21, 0xec, 0xdc, 0xc2, 0x17,
		0x2e, 0x93, 0x3a, 0x1e, 0xf2, 0x31, 0x7e, 0xfc,
		0x53, 0x5a, 0x16, 0x1c, 0x00, 0x33, 0x3a, 0xee,
		0x3f, 0x84, 0xab, 0xfa, 0xb4, 0xe6, 0x40, 0xbf,
	}

	// Assertion 2: fingerprint.Fingerprint encodes precomputed digest using Base64Fingerprint with standard padding
	b64 := fingerprint.Fingerprint(digest, fingerprint.Base64Fingerprint)
	expectedB64 := "OAEWIezcwhcukzoe8jF+/FNaFhwAMzruP4Sr+rTmQL8="
	if b64 != expectedB64 {
		return fmt.Errorf("Base64Fingerprint mismatch: got %q, want %q", b64, expectedB64)
	}

	// Assertion 3: fingerprint.Fingerprint encodes precomputed digest using Base64URLFingerprint with URL-safe characters
	b64URL := fingerprint.Fingerprint(digest, fingerprint.Base64URLFingerprint)
	expectedB64URL := "OAEWIezcwhcukzoe8jF-_FNaFhwAMzruP4Sr-rTmQL8="
	if b64URL != expectedB64URL {
		return fmt.Errorf("Base64URLFingerprint mismatch: got %q, want %q", b64URL, expectedB64URL)
	}

	// Assertion 4: fingerprint.Fingerprint encodes precomputed digest using Base64RawFingerprint and Base64RawURLFingerprint without padding
	b64Raw := fingerprint.Fingerprint(digest, fingerprint.Base64RawFingerprint)
	expectedB64Raw := "OAEWIezcwhcukzoe8jF+/FNaFhwAMzruP4Sr+rTmQL8"
	if b64Raw != expectedB64Raw {
		return fmt.Errorf("Base64RawFingerprint mismatch: got %q, want %q", b64Raw, expectedB64Raw)
	}
	if strings.HasSuffix(b64Raw, "=") {
		return fmt.Errorf("Base64RawFingerprint should not have padding: %q", b64Raw)
	}

	b64RawURL := fingerprint.Fingerprint(digest, fingerprint.Base64RawURLFingerprint)
	expectedB64RawURL := "OAEWIezcwhcukzoe8jF-_FNaFhwAMzruP4Sr-rTmQL8"
	if b64RawURL != expectedB64RawURL {
		return fmt.Errorf("Base64RawURLFingerprint mismatch: got %q, want %q", b64RawURL, expectedB64RawURL)
	}
	if strings.HasSuffix(b64RawURL, "=") {
		return fmt.Errorf("Base64RawURLFingerprint should not have padding: %q", b64RawURL)
	}

	// Assertion 5: fingerprint.Fingerprint encodes precomputed digest into visual emoji representation using EmojiFingerprint
	emojiFP := fingerprint.Fingerprint(digest, fingerprint.EmojiFingerprint)
	expectedEmoji := "💨🎱🌼📆🎠🎉🎿🚙🍪🌊♦️💡✌️🐮🔒❌🖕😬🌼👦👍👑♦️🇬🇧👂🔬📌♿🚀🚜🍆🐑"
	if emojiFP != expectedEmoji {
		return fmt.Errorf("EmojiFingerprint mismatch: got %q, want %q", emojiFP, expectedEmoji)
	}

	// Assertion 6: fingerprint.New returns an error when an unavailable hash algorithm is requested
	unavailableHash := crypto.Hash(9999)
	if _, err := fingerprint.New(sampleData, unavailableHash, fingerprint.HexFingerprint); err == nil {
		return fmt.Errorf("fingerprint.New should return error for unavailable hash algorithm")
	}

	// Assertion 7: fingerprint.New returns an error and fingerprint.Fingerprint returns empty string for unknown encoding values
	unknownEncoding := fingerprint.Encoding(9999)
	if _, err := fingerprint.New(sampleData, crypto.SHA256, unknownEncoding); err == nil {
		return fmt.Errorf("fingerprint.New should return error for unknown encoding")
	}
	if got := fingerprint.Fingerprint(digest, unknownEncoding); got != "" {
		return fmt.Errorf("fingerprint.Fingerprint should return empty string for unknown encoding, got %q", got)
	}

	return nil
}