go.step.sm/crypto v0.89.0: pemutil

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify pkg:golang/go.step.sm/crypto@v0.89.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/go.step.sm/crypto@v0.89.0
Demonstrate these symbols/APIs:
  - go.step.sm/crypto/pemutil

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:6d1ae9d54de8f1508701e383d8e01e03c662e551c239675a858d329152700034","contract":["pemutil.Serialize serializes ECDSA, RSA, and Ed25519 private and public keys to PEM blocks that round-trip through pemutil.ParseKey and pemutil.Parse","pemutil.Serialize with pemutil.WithPassword produces password-encrypted PEM blocks that pemutil.ParseKey decrypts with the matching password and rejects with invalid passwords","pemutil.ParseCertificate parses an X.509 certificate from PEM data and pemutil.ParseCertificateBundle parses multiple PEM certificates into a certificate slice","pemutil.Parse and pemutil.ParseCertificate return errors when provided with malformed or empty PEM bytes"],"goal":"verify pkg:golang/go.step.sm/crypto@v0.89.0","kind":"HOW","packages":["pkg:golang/go.step.sm/crypto@v0.89.0"],"schemaVersion":1,"symbols":["go.step.sm/crypto/pemutil"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/go.step.sm/crypto@v0.89.0"],"schemaVersion":1,"subject":"pkg:golang/go.step.sm/crypto@v0.89.0","symbols":["go.step.sm/crypto/pemutil"],"verifierAdapter":"golang@1"}

module example.com/sample

go 1.26.6

require go.step.sm/crypto v0.89.0

require (
	filippo.io/edwards25519 v1.2.0 // indirect
	github.com/pkg/errors v0.9.1 // indirect
	golang.org/x/crypto v0.54.0 // indirect
	golang.org/x/sys v0.47.0 // indirect
)

filippo.io/edwards25519 v1.2.0 h1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=
filippo.io/edwards25519 v1.2.0/go.mod h1:xzAOLCNug/yB62zG1bQ8uziwrIqIuxhctzJT18Q77mc=
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
go.step.sm/crypto v0.89.0 h1:NPxryE+cZ4XDwXOQY2U6Gu+mOzOihuRLPIsX7WtPzZM=
go.step.sm/crypto v0.89.0/go.mod h1:IEgE6DndnYojbDyHU7eYXpwWzpu4ftkouw7nyI6jsxg=
golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

package main

import (
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"encoding/pem"
	"fmt"
	"os"

	"go.step.sm/crypto/pemutil"
)

func main() {
	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		fmt.Fprintf(os.Stderr, "failed to generate key: %v\n", err)
		os.Exit(1)
	}

	block, err := pemutil.Serialize(key)
	if err != nil {
		fmt.Fprintf(os.Stderr, "failed to serialize key: %v\n", err)
		os.Exit(1)
	}

	pemBytes := pem.EncodeToMemory(block)
	parsed, err := pemutil.ParseKey(pemBytes)
	if err != nil {
		fmt.Fprintf(os.Stderr, "failed to parse key: %v\n", err)
		os.Exit(1)
	}

	if _, ok := parsed.(*ecdsa.PrivateKey); !ok {
		fmt.Fprintf(os.Stderr, "parsed key type mismatch\n")
		os.Exit(1)
	}

	fmt.Println("pemutil sample executed successfully")
}

{
  "schemaVersion": 1,
  "goal": "verify pkg:golang/go.step.sm/crypto@v0.89.0",
  "kind": "HOW",
  "packages": [
    "pkg:golang/go.step.sm/crypto@v0.89.0"
  ],
  "symbols": [
    "go.step.sm/crypto/pemutil"
  ]
}

package main

import (
	"crypto/ecdsa"
	"crypto/ed25519"
	"crypto/elliptic"
	"crypto/rand"
	"crypto/rsa"
	"crypto/x509"
	"crypto/x509/pkix"
	"encoding/pem"
	"fmt"
	"math/big"
	"os"
	"time"

	"go.step.sm/crypto/pemutil"
)

func main() {
	if err := runContract(); err != nil {
		fmt.Fprintf(os.Stderr, "Contract verification failed: %v\n", err)
		os.Exit(1)
	}
	fmt.Println("All pemutil contract assertions passed.")
}

func runContract() error {
	// Assertion 1: Serialize and parse ECDSA, RSA, Ed25519 keys (private and public)
	if err := testKeysRoundtrip(); err != nil {
		return fmt.Errorf("keys roundtrip failed: %w", err)
	}

	// Assertion 2: Password-encrypted PEM serialization and parsing
	if err := testEncryptedKeys(); err != nil {
		return fmt.Errorf("encrypted keys failed: %w", err)
	}

	// Assertion 3: Parse certificate and certificate bundle
	if err := testCertificates(); err != nil {
		return fmt.Errorf("certificates failed: %w", err)
	}

	// Assertion 4: Error handling on malformed/empty PEM
	if err := testErrorHandling(); err != nil {
		return fmt.Errorf("error handling failed: %w", err)
	}

	return nil
}

func testKeysRoundtrip() error {
	// 1. ECDSA P-256
	ecKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		return fmt.Errorf("failed to generate ecdsa key: %w", err)
	}
	ecBlock, err := pemutil.Serialize(ecKey)
	if err != nil {
		return fmt.Errorf("pemutil.Serialize(ecdsa) failed: %w", err)
	}
	parsedEC, err := pemutil.ParseKey(pem.EncodeToMemory(ecBlock))
	if err != nil {
		return fmt.Errorf("pemutil.ParseKey(ecdsa) failed: %w", err)
	}
	parsedECKey, ok := parsedEC.(*ecdsa.PrivateKey)
	if !ok || !parsedECKey.Equal(ecKey) {
		return fmt.Errorf("ecdsa key mismatch after parse")
	}

	// 2. RSA 2048
	rsaKey, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		return fmt.Errorf("failed to generate rsa key: %w", err)
	}
	rsaBlock, err := pemutil.Serialize(rsaKey)
	if err != nil {
		return fmt.Errorf("pemutil.Serialize(rsa) failed: %w", err)
	}
	parsedRSA, err := pemutil.ParseKey(pem.EncodeToMemory(rsaBlock))
	if err != nil {
		return fmt.Errorf("pemutil.ParseKey(rsa) failed: %w", err)
	}
	parsedRSAKey, ok := parsedRSA.(*rsa.PrivateKey)
	if !ok || !parsedRSAKey.Equal(rsaKey) {
		return fmt.Errorf("rsa key mismatch after parse")
	}

	// 3. Ed25519 Private Key
	pub, priv, err := ed25519.GenerateKey(rand.Reader)
	if err != nil {
		return fmt.Errorf("failed to generate ed25519 key: %w", err)
	}
	edBlock, err := pemutil.Serialize(priv)
	if err != nil {
		return fmt.Errorf("pemutil.Serialize(ed25519) failed: %w", err)
	}
	parsedEd, err := pemutil.ParseKey(pem.EncodeToMemory(edBlock))
	if err != nil {
		return fmt.Errorf("pemutil.ParseKey(ed25519) failed: %w", err)
	}
	parsedEdKey, ok := parsedEd.(ed25519.PrivateKey)
	if !ok || !parsedEdKey.Equal(priv) {
		return fmt.Errorf("ed25519 key mismatch after parse")
	}

	// 4. Ed25519 Public Key
	pubBlock, err := pemutil.Serialize(pub)
	if err != nil {
		return fmt.Errorf("pemutil.Serialize(ed25519 public) failed: %w", err)
	}
	parsedPub, err := pemutil.Parse(pem.EncodeToMemory(pubBlock))
	if err != nil {
		return fmt.Errorf("pemutil.Parse(ed25519 public) failed: %w", err)
	}
	parsedEdPub, ok := parsedPub.(ed25519.PublicKey)
	if !ok || !parsedEdPub.Equal(pub) {
		return fmt.Errorf("ed25519 public key mismatch after parse")
	}

	return nil
}

func testEncryptedKeys() error {
	ecKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		return fmt.Errorf("failed to generate key: %w", err)
	}

	password := []byte("sample-verification-secret")
	encBlock, err := pemutil.Serialize(ecKey, pemutil.WithPassword(password))
	if err != nil {
		return fmt.Errorf("pemutil.Serialize with password failed: %w", err)
	}
	encPEM := pem.EncodeToMemory(encBlock)

	// Valid password decryption
	decKey, err := pemutil.ParseKey(encPEM, pemutil.WithPassword(password))
	if err != nil {
		return fmt.Errorf("pemutil.ParseKey with password failed: %w", err)
	}
	decECKey, ok := decKey.(*ecdsa.PrivateKey)
	if !ok || !decECKey.Equal(ecKey) {
		return fmt.Errorf("decrypted key mismatch")
	}

	// Wrong password must fail
	if _, err := pemutil.ParseKey(encPEM, pemutil.WithPassword([]byte("wrong-password"))); err == nil {
		return fmt.Errorf("expected error with wrong password, got nil")
	}

	// Missing password must fail
	if _, err := pemutil.ParseKey(encPEM); err == nil {
		return fmt.Errorf("expected error without password, got nil")
	}

	return nil
}

func testCertificates() error {
	priv, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		return fmt.Errorf("failed to generate key: %w", err)
	}

	tmpl := &x509.Certificate{
		SerialNumber: big.NewInt(100),
		Subject: pkix.Name{
			CommonName: "Sample Certificate",
		},
		NotBefore:             time.Now().Add(-1 * time.Hour),
		NotAfter:              time.Now().Add(24 * time.Hour),
		BasicConstraintsValid: true,
		IsCA:                  true,
	}

	derBytes, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &priv.PublicKey, priv)
	if err != nil {
		return fmt.Errorf("failed to create certificate: %w", err)
	}

	certBlock := &pem.Block{
		Type:  "CERTIFICATE",
		Bytes: derBytes,
	}
	certPEM := pem.EncodeToMemory(certBlock)

	// Parse single certificate
	cert, err := pemutil.ParseCertificate(certPEM)
	if err != nil {
		return fmt.Errorf("pemutil.ParseCertificate failed: %w", err)
	}
	if cert.Subject.CommonName != "Sample Certificate" {
		return fmt.Errorf("unexpected subject common name: %s", cert.Subject.CommonName)
	}

	// Parse certificate bundle (2 certs)
	bundlePEM := append(certPEM, certPEM...)
	bundle, err := pemutil.ParseCertificateBundle(bundlePEM)
	if err != nil {
		return fmt.Errorf("pemutil.ParseCertificateBundle failed: %w", err)
	}
	if len(bundle) != 2 {
		return fmt.Errorf("expected bundle length 2, got %d", len(bundle))
	}

	return nil
}

func testErrorHandling() error {
	malformed := []byte("-----BEGIN CERTIFICATE-----\nINVALID\n-----END CERTIFICATE-----")
	if _, err := pemutil.ParseCertificate(malformed); err == nil {
		return fmt.Errorf("expected error for malformed certificate, got nil")
	}

	if _, err := pemutil.Parse([]byte("")); err == nil {
		return fmt.Errorf("expected error for empty bytes, got nil")
	}

	return nil
}