This document provides guidelines for AI agents working on the certinfo-go codebase.
go build -o certinfo ./main.gogo install ./main.gogo run ./main.go <command> <args>go test ./... -vgo test ./pkg/certificate -v
go test ./pkg/privatekey -vgo test ./pkg/certificate -run TestParseRSACertificate -v
go test -run TestParseECDSACertificate ./...go test ./... -covergo test -v ./pkg/certificate/parser_test.go ./pkg/certificate/parser.go- Group imports: standard library first, then third-party packages
- Use blank line between import groups
- Example:
import ( "bytes" "crypto/ecdsa" "crypto/elliptic" "crypto/rsa" "crypto/x509" "encoding/pem" "fmt" "os" "path/filepath" "github.com/spf13/cobra" )
- Packages: lowercase, single word or short phrase (e.g.,
certificate,privatekey,utils,cmd) - Types: PascalCase, descriptive (e.g.,
CertificateInfo,KeySummary,OutputFormat) - Functions: PascalCase, verb-first for operations (e.g.,
ParseCertificate,SummarizeDirectory) - Variables: camelCase, clear and concise (e.g.,
filePath,parseErr,keyBytes) - Constants: PascalCase for exported, camelCase for unexported (e.g.,
FormatTable,FormatJSON) - Interfaces: Single-method interfaces named after the action (e.g.,
Reader,Writer) or with -er suffix (e.g.,Parser)
- Return errors to callers; don't log and continue
- Use
fmt.Errorffor formatted error messages:fmt.Errorf("no PEM data found in %s", filePath) - Check errors immediately after calls
- Use
if err != nil { return nil, err }pattern - For test failures requiring immediate exit:
t.Fatalf("message: %v", err) - For test assertions:
t.Errorf("expected X, got %s", actual)
- Use structs for data containers (e.g.,
CertificateInfo,KeySummary) - Use type aliases for constants (e.g.,
type OutputFormat string) - Export only types and functions that need to be accessed from other packages
- Keep fields flat in structs; avoid nested structures for simple data
- Keep functions focused on single responsibility
- Prefer returning
(*Type, error)for parsing/creation functions - Helper functions should be unexported (lowercase) unless needed externally
- Use named return values sparingly (only when improves clarity)
- One main type per file when possible
- Related functionality in same package
- Tests in
<file>_test.goalongside implementation - Package structure:
cmd/- CLI command handlers (Cobra): root, cert, dir, key, keydirpkg/certificate/- Certificate parsing (parser.go) and analysis (analyzer.go)pkg/privatekey/- Private key parsing (parser.go)pkg/pem/- PEM format handling (pem.go)pkg/utils/- Shared output formatting utilities (output.go)
- Use
gofmt(default Go formatter) - No comments on exported functions unless documenting behavior
- Avoid commented-out code
- Use tabs for indentation (gofmt default)
See guidelines in @.ai/testing_guidelines.md
- Root command in
cmd/root.go - Subcommands:
cert,dir,key,keydirin separate files - Global flags defined in
cmd/root.go(format,recursive) - Use
cobra.Command.Execute()pattern with error handling andos.Exit(1)
- Use
text/tabwriterfor table output - JSON output via
encoding/json.MarshalIndent - Format selection via
OutputFormattype (FormatTable,FormatJSON) - Consistent field ordering in struct definitions and output
- EKU (Extended Key Usage) displayed only in detailed certificate output (
certcommand), not in summary tables
Prioritize standard library and golang.org/x/ packages for system and terminal handling to minimize supply-chain risks.
- Language: Go 1.25
- Module:
github.com/marco-introini/certinfo - Dependencies:
github.com/spf13/cobra v1.8.0for CLI - Purpose: CLI tool to analyze X.509 certificates and private keys
- Features: Parse RSA, ECDSA, Ed25519, Ed448 keys; support PEM/DER formats; directory scanning; table and JSON output; 42+ tests
main.go- Entry point that callscmd.Execute()cmd/- CLI command handlers (Cobra)root.go- Root command with global flags (format,recursive)cert.go- Single certificate analysisdir.go- Directory certificate scanningkey.go- Private key analysiskeydir.go- Directory private key scanning
pkg/certificate/- Certificate parsing and analysisparser.go- X.509 certificate parsinganalyzer.go- Certificate analysis (expiration, status)
pkg/privatekey/- Private key parsingparser.go- RSA, EC, Ed25519, Ed448 key parsing
pkg/pem/- PEM format handlingpem.go- PEM block detection and decoding
pkg/utils/- Shared utilitiesoutput.go- Table and JSON output formatting
Located in test_certs/ with organized subdirectories:
traditional/rsa/- RSA 2048, 3072, 4096traditional/ecdsa/- P-256, P-384, P-521, Ed25519, Ed448selfsigned/- Self-signed certificatesexpired/- Expired certificatessan-types/- SAN extensionsclient/- Client certificates (mTLS)wildcard/- Wildcard certificates