Exemplo

go.step.sm/linkedca v0.20.1: NewContextWithAdmin, AdminFromContext, MustAdminFromContext

Amostra verificada para golang go.step.sm/linkedca v0.20.1: NewContextWithAdmin, AdminFromContext, MustAdminFromContext. O contrato rodou em go 1.26 · linux…

sha256:2de57a962bfe88b76a90f03290836a3f7b94d19e65bda9c97ecd80829aaea55b

MIT-0

Evidência de execução

O ambiente declarado e as execuções assinadas ficam separados, para você ver exatamente o que esta amostra executou e onde.

Base da evidência: Contrato assinado aprovado
Recibos de verificação: 2
Chaves de assinatura que o compilaram: 1

Ambiente declarado go 1.26 linux 24 · ubuntu · glibc 2.39 x64 go 1.26 go go 1

Ambientes das execuções de verificação

Ambiente	Contrato	Etapas	Execução
go 1.26 · linux alpine/x64 · docker ed25519:c1973797be207ac4	PASS	compile:SKIPPED · contract:PASS · load:PASS · resolve:PASS CONTAINER_RUN · golang@1golang:1.26-alpine@sha256:28d89ee9cc0f…	2026-08-23
go 1.26 · linux debian/x64 · docker ed25519:c1973797be207ac4	FAIL	compile:SKIPPED · contract:FAIL · load:SKIPPED · resolve:PASS CONTAINER_RUN · golang@1golang:1.26@sha256:e30143be198a…	2026-09-08

Caso

HOW

Objetivo: verify pkg:golang/go.step.sm/linkedca@v0.20.1
Pacotes: go.step.sm/linkedca v0.20.1
Símbolos: go.step.sm/linkedca.NewContextWithAdmin
go.step.sm/linkedca.AdminFromContext
go.step.sm/linkedca.MustAdminFromContext
go.step.sm/linkedca.NewContextWithProvisioner
go.step.sm/linkedca.ProvisionerFromContext
go.step.sm/linkedca.MustProvisionerFromContext
go.step.sm/linkedca.NewContextWithExternalAccountKey
go.step.sm/linkedca.ExternalAccountKeyFromContext
go.step.sm/linkedca.MustExternalAccountKeyFromContext
go.step.sm/linkedca.Policy.Deduplicate
Ambiente: go 1.26.6
Criado: 2026-08-23T16:39:32Z

Contrato

NewContextWithAdmin attaches an Admin to context and AdminFromContext or MustAdminFromContext retrieves it
NewContextWithProvisioner attaches a Provisioner to context and ProvisionerFromContext or MustProvisionerFromContext retrieves it
NewContextWithExternalAccountKey attaches an EABKey to context and ExternalAccountKeyFromContext or MustExternalAccountKeyFromContext retrieves it
Policy.Deduplicate removes duplicate DNS, IP, email, URI, common name, and principal entries while preserving order

Arquivos

PROMPT.md
contract_test.go
csx.json
go.mod
go.sum
spec.json

Baixar o artefato de código-fonte (tar.gz)

Código-fonte

PROMPT.md

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify pkg:golang/go.step.sm/linkedca@v0.20.1
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/go.step.sm/linkedca@v0.20.1
Constraints:
  - executionContext: node
Required runtime conditions:
  - ecosystem: npm
  - language: javascript
  - moduleSystem: cjs
  - packageManager: npm@10.9.8
  - runtime: node@22.23.2

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

contract_test.go

package sample_test

import (
	"context"
	"reflect"
	"testing"

	"go.step.sm/linkedca"
)

func TestContextAdmin(t *testing.T) {
	ctx := context.Background()

	// 1. Initially empty context
	if admin, ok := linkedca.AdminFromContext(ctx); ok || admin != nil {
		t.Fatalf("expected no admin in empty context, got %+v", admin)
	}

	// 2. Set Admin in context
	expectedAdmin := &linkedca.Admin{
		Id:          "admin-123",
		AuthorityId: "auth-456",
		Subject:     "admin@example.com",
		Type:        linkedca.Admin_SUPER_ADMIN,
	}
	ctxWithAdmin := linkedca.NewContextWithAdmin(ctx, expectedAdmin)

	gotAdmin, ok := linkedca.AdminFromContext(ctxWithAdmin)
	if !ok || gotAdmin == nil {
		t.Fatalf("AdminFromContext returned ok=%v, admin=%+v", ok, gotAdmin)
	}
	if gotAdmin.Id != expectedAdmin.Id || gotAdmin.Subject != expectedAdmin.Subject || gotAdmin.Type != expectedAdmin.Type {
		t.Fatalf("AdminFromContext mismatch: got %+v, want %+v", gotAdmin, expectedAdmin)
	}

	// 3. MustAdminFromContext
	mustAdmin := linkedca.MustAdminFromContext(ctxWithAdmin)
	if mustAdmin != expectedAdmin {
		t.Fatalf("MustAdminFromContext returned %+v, want %+v", mustAdmin, expectedAdmin)
	}

	// 4. MustAdminFromContext panics on nil
	defer func() {
		if r := recover(); r == nil {
			t.Fatal("expected MustAdminFromContext to panic on context without Admin")
		}
	}()
	_ = linkedca.MustAdminFromContext(ctx)
}

func TestContextProvisioner(t *testing.T) {
	ctx := context.Background()

	// 1. Initially empty context
	if prov, ok := linkedca.ProvisionerFromContext(ctx); ok || prov != nil {
		t.Fatalf("expected no provisioner in empty context, got %+v", prov)
	}

	// 2. Set Provisioner in context
	expectedProv := &linkedca.Provisioner{
		Id:          "prov-789",
		AuthorityId: "auth-456",
		Name:        "acme-provisioner",
		Type:        linkedca.Provisioner_ACME,
	}
	ctxWithProv := linkedca.NewContextWithProvisioner(ctx, expectedProv)

	gotProv, ok := linkedca.ProvisionerFromContext(ctxWithProv)
	if !ok || gotProv == nil {
		t.Fatalf("ProvisionerFromContext returned ok=%v, prov=%+v", ok, gotProv)
	}
	if gotProv.Id != expectedProv.Id || gotProv.Name != expectedProv.Name || gotProv.Type != expectedProv.Type {
		t.Fatalf("ProvisionerFromContext mismatch: got %+v, want %+v", gotProv, expectedProv)
	}

	// 3. MustProvisionerFromContext
	mustProv := linkedca.MustProvisionerFromContext(ctxWithProv)
	if mustProv != expectedProv {
		t.Fatalf("MustProvisionerFromContext returned %+v, want %+v", mustProv, expectedProv)
	}

	// 4. MustProvisionerFromContext panics on nil
	defer func() {
		if r := recover(); r == nil {
			t.Fatal("expected MustProvisionerFromContext to panic on context without Provisioner")
		}
	}()
	_ = linkedca.MustProvisionerFromContext(ctx)
}

func TestContextExternalAccountKey(t *testing.T) {
	ctx := context.Background()

	// 1. Initially empty context
	if key, ok := linkedca.ExternalAccountKeyFromContext(ctx); ok || key != nil {
		t.Fatalf("expected no EABKey in empty context, got %+v", key)
	}

	// 2. Set EABKey in context
	expectedKey := &linkedca.EABKey{
		Id:          "key-001",
		Provisioner: "acme-provisioner",
		Reference:   "ref-001",
		Account:     "acct-xyz",
		HmacKey:     []byte("test-secret-key"),
	}
	ctxWithKey := linkedca.NewContextWithExternalAccountKey(ctx, expectedKey)

	gotKey, ok := linkedca.ExternalAccountKeyFromContext(ctxWithKey)
	if !ok || gotKey == nil {
		t.Fatalf("ExternalAccountKeyFromContext returned ok=%v, key=%+v", ok, gotKey)
	}
	if gotKey.Id != expectedKey.Id || gotKey.Provisioner != expectedKey.Provisioner || gotKey.Account != expectedKey.Account {
		t.Fatalf("ExternalAccountKeyFromContext mismatch: got %+v, want %+v", gotKey, expectedKey)
	}

	// 3. MustExternalAccountKeyFromContext
	mustKey := linkedca.MustExternalAccountKeyFromContext(ctxWithKey)
	if mustKey != expectedKey {
		t.Fatalf("MustExternalAccountKeyFromContext returned %+v, want %+v", mustKey, expectedKey)
	}

	// 4. MustExternalAccountKeyFromContext panics on nil
	defer func() {
		if r := recover(); r == nil {
			t.Fatal("expected MustExternalAccountKeyFromContext to panic on context without EABKey")
		}
	}()
	_ = linkedca.MustExternalAccountKeyFromContext(ctx)
}

func TestPolicyDeduplicate(t *testing.T) {
	// 1. Nil policy handles safely without panic
	var nilPolicy *linkedca.Policy
	nilPolicy.Deduplicate()

	// 2. X509 and SSH policy deduplication
	policy := &linkedca.Policy{
		X509: &linkedca.X509Policy{
			Allow: &linkedca.X509Names{
				Dns:         []string{"example.com", "foo.example.com", "example.com", "bar.example.com"},
				Ips:         []string{"192.0.2.1", "192.0.2.2", "192.0.2.1"},
				Emails:      []string{"user@example.com", "admin@example.com", "user@example.com"},
				Uris:        []string{"urn:uuid:1", "urn:uuid:2", "urn:uuid:1"},
				CommonNames: []string{"test-cn", "test-cn", "other-cn"},
			},
			Deny: &linkedca.X509Names{
				Dns:         []string{"blocked.com", "blocked.com"},
				Ips:         []string{"10.0.0.1", "10.0.0.1"},
				Emails:      []string{"bad@example.com", "bad@example.com"},
				Uris:        []string{"urn:blocked", "urn:blocked"},
				CommonNames: []string{"bad-cn", "bad-cn"},
			},
		},
		Ssh: &linkedca.SSHPolicy{
			Host: &linkedca.SSHHostPolicy{
				Allow: &linkedca.SSHHostNames{
					Dns:        []string{"host1.example.com", "host2.example.com", "host1.example.com"},
					Ips:        []string{"10.1.1.1", "10.1.1.1"},
					Principals: []string{"host-p1", "host-p1"},
				},
				Deny: &linkedca.SSHHostNames{
					Dns:        []string{"deny-host", "deny-host"},
					Ips:        []string{"10.2.2.2", "10.2.2.2"},
					Principals: []string{"deny-p1", "deny-p1"},
				},
			},
			User: &linkedca.SSHUserPolicy{
				Allow: &linkedca.SSHUserNames{
					Emails:     []string{"alice@example.com", "bob@example.com", "alice@example.com"},
					Principals: []string{"root", "root", "ubuntu"},
				},
				Deny: &linkedca.SSHUserNames{
					Emails:     []string{"eve@example.com", "eve@example.com"},
					Principals: []string{"guest", "guest"},
				},
			},
		},
	}

	policy.Deduplicate()

	// Verify X509 Allow deduplication
	if expected := []string{"example.com", "foo.example.com", "bar.example.com"}; !reflect.DeepEqual(policy.X509.Allow.Dns, expected) {
		t.Fatalf("X509 Allow DNS deduplication failed: got %v, want %v", policy.X509.Allow.Dns, expected)
	}
	if expected := []string{"192.0.2.1", "192.0.2.2"}; !reflect.DeepEqual(policy.X509.Allow.Ips, expected) {
		t.Fatalf("X509 Allow IPs deduplication failed: got %v, want %v", policy.X509.Allow.Ips, expected)
	}
	if expected := []string{"user@example.com", "admin@example.com"}; !reflect.DeepEqual(policy.X509.Allow.Emails, expected) {
		t.Fatalf("X509 Allow Emails deduplication failed: got %v, want %v", policy.X509.Allow.Emails, expected)
	}
	if expected := []string{"urn:uuid:1", "urn:uuid:2"}; !reflect.DeepEqual(policy.X509.Allow.Uris, expected) {
		t.Fatalf("X509 Allow URIs deduplication failed: got %v, want %v", policy.X509.Allow.Uris, expected)
	}
	if expected := []string{"test-cn", "other-cn"}; !reflect.DeepEqual(policy.X509.Allow.CommonNames, expected) {
		t.Fatalf("X509 Allow CommonNames deduplication failed: got %v, want %v", policy.X509.Allow.CommonNames, expected)
	}

	// Verify SSH Host Allow deduplication
	if expected := []string{"host1.example.com", "host2.example.com"}; !reflect.DeepEqual(policy.Ssh.Host.Allow.Dns, expected) {
		t.Fatalf("SSH Host Allow DNS deduplication failed: got %v, want %v", policy.Ssh.Host.Allow.Dns, expected)
	}
	// Verify SSH User Allow deduplication
	if expected := []string{"alice@example.com", "bob@example.com"}; !reflect.DeepEqual(policy.Ssh.User.Allow.Emails, expected) {
		t.Fatalf("SSH User Allow Emails deduplication failed: got %v, want %v", policy.Ssh.User.Allow.Emails, expected)
	}
	if expected := []string{"root", "ubuntu"}; !reflect.DeepEqual(policy.Ssh.User.Allow.Principals, expected) {
		t.Fatalf("SSH User Allow Principals deduplication failed: got %v, want %v", policy.Ssh.User.Allow.Principals, expected)
	}
}

csx.json

{"case":{"caseId":"case:sha256:f60fbffe01c6fb14093655f289875cdcad79bcb08bb4a14cd0d89dda983bbfd5","contract":["NewContextWithAdmin attaches an Admin to context and AdminFromContext or MustAdminFromContext retrieves it","NewContextWithProvisioner attaches a Provisioner to context and ProvisionerFromContext or MustProvisionerFromContext retrieves it","NewContextWithExternalAccountKey attaches an EABKey to context and ExternalAccountKeyFromContext or MustExternalAccountKeyFromContext retrieves it","Policy.Deduplicate removes duplicate DNS, IP, email, URI, common name, and principal entries while preserving order"],"goal":"verify pkg:golang/go.step.sm/linkedca@v0.20.1","kind":"HOW","packages":["pkg:golang/go.step.sm/linkedca@v0.20.1"],"schemaVersion":1,"symbols":["go.step.sm/linkedca.NewContextWithAdmin","go.step.sm/linkedca.AdminFromContext","go.step.sm/linkedca.MustAdminFromContext","go.step.sm/linkedca.NewContextWithProvisioner","go.step.sm/linkedca.ProvisionerFromContext","go.step.sm/linkedca.MustProvisionerFromContext","go.step.sm/linkedca.NewContextWithExternalAccountKey","go.step.sm/linkedca.ExternalAccountKeyFromContext","go.step.sm/linkedca.MustExternalAccountKeyFromContext","go.step.sm/linkedca.Policy.Deduplicate"]},"contractCommand":["go","test","-v","./..."],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","language":"go","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","packageManagerVersion":"1.26.6","runtime":"go","runtimeVersion":"1.26.6","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/go.step.sm/linkedca@v0.20.1"],"schemaVersion":1,"subject":"pkg:golang/go.step.sm/linkedca@v0.20.1","symbols":["go.step.sm/linkedca.NewContextWithAdmin","go.step.sm/linkedca.AdminFromContext","go.step.sm/linkedca.MustAdminFromContext","go.step.sm/linkedca.NewContextWithProvisioner","go.step.sm/linkedca.ProvisionerFromContext","go.step.sm/linkedca.MustProvisionerFromContext","go.step.sm/linkedca.NewContextWithExternalAccountKey","go.step.sm/linkedca.ExternalAccountKeyFromContext","go.step.sm/linkedca.MustExternalAccountKeyFromContext","go.step.sm/linkedca.Policy.Deduplicate"],"verifierAdapter":"golang@1"}

go.mod

module sample

go 1.22

require go.step.sm/linkedca v0.20.1

require (
	github.com/golang/protobuf v1.5.3 // indirect
	golang.org/x/net v0.12.0 // indirect
	golang.org/x/sys v0.10.0 // indirect
	golang.org/x/text v0.11.0 // indirect
	google.golang.org/genproto/googleapis/rpc v0.0.0-20230711160842-782d3b101e98 // indirect
	google.golang.org/grpc v1.58.1 // indirect
	google.golang.org/protobuf v1.31.0 // indirect
)

go.sum

github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
go.step.sm/linkedca v0.20.1 h1:bHDn1+UG1NgRrERkWbbCiAIvv4lD5NOFaswPDTyO5vU=
go.step.sm/linkedca v0.20.1/go.mod h1:Vaq4+Umtjh7DLFI1KuIxeo598vfBzgSYZUjgVJ7Syxw=
golang.org/x/net v0.12.0 h1:cfawfvKITfUsFCeJIHJrbSxpeu/E81khclypR0GVT50=
golang.org/x/net v0.12.0/go.mod h1:zEVYFnQC7m/vmpQFELhcD1EWkZlX69l4oqgmer6hfKA=
golang.org/x/sys v0.10.0 h1:SqMFp9UcQJZa+pmYuAKjd9xq1f0j5rLcDIk0mj4qAsA=
golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/text v0.11.0 h1:LAntKIrcmeSKERyiOh0XMV39LXS8IE9UL2yP7+f5ij4=
golang.org/x/text v0.11.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
google.golang.org/genproto/googleapis/rpc v0.0.0-20230711160842-782d3b101e98 h1:bVf09lpb+OJbByTj913DRJioFFAjf/ZGxEz7MajTp2U=
google.golang.org/genproto/googleapis/rpc v0.0.0-20230711160842-782d3b101e98/go.mod h1:TUfxEVdsvPg18p6AslUXFoLdpED4oBnGwyqk3dV1XzM=
google.golang.org/grpc v1.58.1 h1:OL+Vz23DTtrrldqHK49FUOPHyY75rvFqJfXC84NYW58=
google.golang.org/grpc v1.58.1/go.mod h1:tgX3ZQDlNJGU96V6yHh1T/JeoBQ2TXdr43YbYSsCJk0=
google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
google.golang.org/protobuf v1.31.0 h1:g0LDEJHgrBl9N9r17Ru3sqWhkIx2NB67okBHPwC7hs8=
google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

spec.json

{
  "schemaVersion": 1,
  "goal": "verify pkg:golang/go.step.sm/linkedca@v0.20.1",
  "kind": "HOW",
  "packages": [
    "pkg:golang/go.step.sm/linkedca@v0.20.1"
  ],
  "constraints": {
    "executionContext": "node"
  },
  "runtimeConditions": {
    "ecosystem": "npm",
    "language": "javascript",
    "moduleSystem": "cjs",
    "packageManager": "npm@10.9.8",
    "runtime": "node@22.23.2"
  }
}

Seeder de origem

anônimo