github.com/flynn/noise v1.0.0: HashSHA256

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify github.com/flynn/noise.HashSHA256 in pkg:golang/github.com/flynn/noise@v1.0.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/github.com/flynn/noise@v1.0.0
Demonstrate these symbols/APIs:
  - github.com/flynn/noise.HashSHA256

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:617074411ab37b94a96d30710fa7cce677a0b8cd742366038cabbe7555ae59a6","contract":["noise.HashSHA256.HashName returns \"SHA256\"","noise.HashSHA256.Hash returns a 32-byte cryptographic hash matching standard SHA-256","noise.NewCipherSuite integrates noise.HashSHA256 with suite name containing \"SHA256\"","noise.NewHandshakeState with noise.HashSHA256 completes an NN handshake and encrypts transport messages"],"goal":"verify github.com/flynn/noise.HashSHA256 in pkg:golang/github.com/flynn/noise@v1.0.0","kind":"HOW","packages":["pkg:golang/github.com/flynn/noise@v1.0.0"],"schemaVersion":1,"symbols":["github.com/flynn/noise.HashSHA256"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/github.com/flynn/noise@v1.0.0"],"schemaVersion":1,"subject":"pkg:golang/github.com/flynn/noise@v1.0.0","symbols":["github.com/flynn/noise.HashSHA256"],"verifierAdapter":"golang@1"}

module example.com/sample

go 1.22.0

require github.com/flynn/noise v1.0.0

require (
	golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2 // indirect
	golang.org/x/sys v0.0.0-20201119102817-f84b799fce68 // indirect
)

github.com/flynn/noise v1.0.0 h1:DlTHqmzmvcEiKj+4RYo/imoswx/4r6iBlCMfVtrMXpQ=
github.com/flynn/noise v1.0.0/go.mod h1:xbMo+0i6+IGbYdJhF31t2eR1BIU0CYc12+BNAKwUTag=
github.com/kr/pretty v0.2.1 h1:Fmg33tUaq4/8ym9TJN1x7sLJnHVwhP33CNkpYV/7rwI=
github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2 h1:It14KIkyBFYkHkwZ7k45minvA9aorojkyjGk9KJ5B/w=
golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
golang.org/x/sys v0.0.0-20201119102817-f84b799fce68 h1:nxC68pudNYkKU6jWhgrqdreuFiOQWj1Fs7T3VrH4Pjw=
golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=

package main

import (
	"bytes"
	"crypto/sha256"
	"fmt"
	"os"

	"github.com/flynn/noise"
)

func main() {
	hashFn := noise.HashSHA256
	fmt.Printf("Noise hash function: %s\n", hashFn.HashName())

	h := hashFn.Hash()
	data := []byte("CodeSampleX noise verification")
	h.Write(data)
	digest := h.Sum(nil)
	expected := sha256.Sum256(data)
	if !bytes.Equal(digest, expected[:]) {
		fmt.Fprintf(os.Stderr, "hash mismatch\n")
		os.Exit(1)
	}

	suite := noise.NewCipherSuite(noise.DH25519, noise.CipherChaChaPoly, hashFn)
	fmt.Printf("Cipher suite: %s\n", string(suite.Name()))

	initiator, err := noise.NewHandshakeState(noise.Config{
		CipherSuite: suite,
		Pattern:     noise.HandshakeNN,
		Initiator:   true,
	})
	if err != nil {
		fmt.Fprintf(os.Stderr, "initiator init failed: %v\n", err)
		os.Exit(1)
	}

	responder, err := noise.NewHandshakeState(noise.Config{
		CipherSuite: suite,
		Pattern:     noise.HandshakeNN,
		Initiator:   false,
	})
	if err != nil {
		fmt.Fprintf(os.Stderr, "responder init failed: %v\n", err)
		os.Exit(1)
	}

	msg1, _, _, err := initiator.WriteMessage(nil, []byte("client-hello"))
	if err != nil {
		fmt.Fprintf(os.Stderr, "initiator write message 1 failed: %v\n", err)
		os.Exit(1)
	}
	payload1, _, _, err := responder.ReadMessage(nil, msg1)
	if err != nil || string(payload1) != "client-hello" {
		fmt.Fprintf(os.Stderr, "responder read message 1 failed: %v\n", err)
		os.Exit(1)
	}

	msg2, respSend, respRecv, err := responder.WriteMessage(nil, []byte("server-hello"))
	if err != nil {
		fmt.Fprintf(os.Stderr, "responder write message 2 failed: %v\n", err)
		os.Exit(1)
	}
	payload2, initRecv, initSend, err := initiator.ReadMessage(nil, msg2)
	if err != nil || string(payload2) != "server-hello" {
		fmt.Fprintf(os.Stderr, "initiator read message 2 failed: %v\n", err)
		os.Exit(1)
	}

	ciphertext, err := initSend.Encrypt(nil, nil, []byte("secure message"))
	if err != nil {
		fmt.Fprintf(os.Stderr, "encryption failed: %v\n", err)
		os.Exit(1)
	}

	plaintext, err := respRecv.Decrypt(nil, nil, ciphertext)
	if err != nil || string(plaintext) != "secure message" {
		fmt.Fprintf(os.Stderr, "decryption failed: %v\n", err)
		os.Exit(1)
	}

	_ = respSend
	_ = initRecv
	fmt.Printf("Handshake completed, decrypted message: %s\n", string(plaintext))
}

{
  "schemaVersion": 1,
  "goal": "verify github.com/flynn/noise.HashSHA256 in pkg:golang/github.com/flynn/noise@v1.0.0",
  "kind": "HOW",
  "packages": [
    "pkg:golang/github.com/flynn/noise@v1.0.0"
  ],
  "symbols": [
    "github.com/flynn/noise.HashSHA256"
  ]
}

package main

import (
	"bytes"
	"crypto/sha256"
	"fmt"
	"os"

	"github.com/flynn/noise"
)

func main() {
	// Assertion 1: noise.HashSHA256.HashName returns "SHA256"
	hashName := noise.HashSHA256.HashName()
	if hashName != "SHA256" {
		fmt.Fprintf(os.Stderr, "FAIL: expected HashName 'SHA256', got %q\n", hashName)
		os.Exit(1)
	}

	// Assertion 2: noise.HashSHA256.Hash returns a 32-byte cryptographic hash matching standard SHA-256
	h := noise.HashSHA256.Hash()
	if h == nil {
		fmt.Fprintf(os.Stderr, "FAIL: Hash() returned nil\n")
		os.Exit(1)
	}
	if h.Size() != 32 {
		fmt.Fprintf(os.Stderr, "FAIL: expected hash size 32, got %d\n", h.Size())
		os.Exit(1)
	}
	if h.BlockSize() != 64 {
		fmt.Fprintf(os.Stderr, "FAIL: expected block size 64, got %d\n", h.BlockSize())
		os.Exit(1)
	}

	sampleData := []byte("verification payload for noise.HashSHA256 contract")
	h.Write(sampleData)
	digest := h.Sum(nil)
	expectedDigest := sha256.Sum256(sampleData)
	if !bytes.Equal(digest, expectedDigest[:]) {
		fmt.Fprintf(os.Stderr, "FAIL: digest mismatch: got %x, want %x\n", digest, expectedDigest)
		os.Exit(1)
	}

	// Assertion 3: noise.NewCipherSuite integrates noise.HashSHA256 with suite name containing "SHA256"
	suite := noise.NewCipherSuite(noise.DH25519, noise.CipherChaChaPoly, noise.HashSHA256)
	if suite == nil {
		fmt.Fprintf(os.Stderr, "FAIL: NewCipherSuite returned nil\n")
		os.Exit(1)
	}
	if suite.HashName() != "SHA256" {
		fmt.Fprintf(os.Stderr, "FAIL: suite HashName mismatch: got %q, want 'SHA256'\n", suite.HashName())
		os.Exit(1)
	}
	suiteName := string(suite.Name())
	if suiteName != "25519_ChaChaPoly_SHA256" {
		fmt.Fprintf(os.Stderr, "FAIL: suite Name mismatch: got %q, want '25519_ChaChaPoly_SHA256'\n", suiteName)
		os.Exit(1)
	}

	// Assertion 4: noise.NewHandshakeState with noise.HashSHA256 completes an NN handshake and encrypts transport messages
	initHs, err := noise.NewHandshakeState(noise.Config{
		CipherSuite: suite,
		Pattern:     noise.HandshakeNN,
		Initiator:   true,
	})
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: initiator NewHandshakeState failed: %v\n", err)
		os.Exit(1)
	}
	respHs, err := noise.NewHandshakeState(noise.Config{
		CipherSuite: suite,
		Pattern:     noise.HandshakeNN,
		Initiator:   false,
	})
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: responder NewHandshakeState failed: %v\n", err)
		os.Exit(1)
	}

	handshakeMsg1, _, _, err := initHs.WriteMessage(nil, []byte("initiator-handshake-data"))
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: initiator WriteMessage failed: %v\n", err)
		os.Exit(1)
	}
	payload1, _, _, err := respHs.ReadMessage(nil, handshakeMsg1)
	if err != nil || !bytes.Equal(payload1, []byte("initiator-handshake-data")) {
		fmt.Fprintf(os.Stderr, "FAIL: responder ReadMessage failed or payload mismatch\n")
		os.Exit(1)
	}

	handshakeMsg2, respSend, respRecv, err := respHs.WriteMessage(nil, []byte("responder-handshake-data"))
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: responder WriteMessage failed: %v\n", err)
		os.Exit(1)
	}
	if respSend == nil || respRecv == nil {
		fmt.Fprintf(os.Stderr, "FAIL: responder cipher states are nil\n")
		os.Exit(1)
	}

	payload2, initRecv, initSend, err := initHs.ReadMessage(nil, handshakeMsg2)
	if err != nil || !bytes.Equal(payload2, []byte("responder-handshake-data")) {
		fmt.Fprintf(os.Stderr, "FAIL: initiator ReadMessage failed or payload mismatch\n")
		os.Exit(1)
	}
	if initSend == nil || initRecv == nil {
		fmt.Fprintf(os.Stderr, "FAIL: initiator cipher states are nil\n")
		os.Exit(1)
	}

	transportMsg := []byte("encrypted transport payload verified under SHA256 suite")
	ciphertext, err := initSend.Encrypt(nil, nil, transportMsg)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: initSend.Encrypt failed: %v\n", err)
		os.Exit(1)
	}
	if bytes.Equal(ciphertext, transportMsg) {
		fmt.Fprintf(os.Stderr, "FAIL: ciphertext matches plaintext\n")
		os.Exit(1)
	}

	plaintext, err := respRecv.Decrypt(nil, nil, ciphertext)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: respRecv.Decrypt failed: %v\n", err)
		os.Exit(1)
	}
	if !bytes.Equal(plaintext, transportMsg) {
		fmt.Fprintf(os.Stderr, "FAIL: decrypted plaintext mismatch: got %q, want %q\n", plaintext, transportMsg)
		os.Exit(1)
	}

	_ = respSend
	_ = initRecv

	fmt.Println("PASS: verify github.com/flynn/noise.HashSHA256 contract passed")
}