github.com/jackc/pgpassfile v1.0.0: parse pgpass file and find password

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: parse pgpass file and find password
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/github.com/jackc/pgpassfile@v1.0.0
Demonstrate these symbols/APIs:
  - pgpassfile.FindPassword
  - pgpassfile.ParsePassfile

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:8b250322173bb094249fecc9f645efafacf3b1375827afb785e1bf3d1675b193","contract":["pgpassfile.ParsePassfile parses valid pgpass formatted stream from an io.Reader","pgpassfile.FindPassword matches exact connection parameters to retrieve password","pgpassfile.FindPassword matches wildcard entries in pgpass definitions","pgpassfile.FindPassword returns empty string when no matching entry exists"],"goal":"parse pgpass file and find password","kind":"HOW","packages":["pkg:golang/github.com/jackc/pgpassfile@v1.0.0"],"schemaVersion":1,"symbols":["pgpassfile.FindPassword","pgpassfile.ParsePassfile"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","ecosystem":"golang","os":"windows","osVersionBucket":"11","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/github.com/jackc/pgpassfile@v1.0.0"],"schemaVersion":1,"symbols":["pgpassfile.FindPassword","pgpassfile.ParsePassfile"],"verifierAdapter":"golang@1"}

module sample

go 1.26.5

require github.com/jackc/pgpassfile v1.0.0

github.com/davecgh/go-spew v1.1.0 h1:ZDRjVQ15GmhC3fiQ8ni8+OwkZQO4DARzQgrnXU1Liz8=
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
github.com/stretchr/testify v1.3.0 h1:TivCn/peBQ7UY8ooIcPgZFpTNSz0Q2U6UrFlUfqbe0Q=
github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=

package main

import (
	"fmt"
	"io"
	"strings"

	"github.com/jackc/pgpassfile"
)

// ParsePassfileContent parses pgpass file content from an io.Reader into a Passfile.
func ParsePassfileContent(r io.Reader) (*pgpassfile.Passfile, error) {
	return pgpassfile.ParsePassfile(r)
}

// FindPassword retrieves a password matching the given connection parameters.
func FindPassword(pf *pgpassfile.Passfile, hostname, port, database, username string) string {
	return pf.FindPassword(hostname, port, database, username)
}

func main() {
	raw := "localhost:5432:appdb:dbuser:secretpassword\n"
	pf, err := ParsePassfileContent(strings.NewReader(raw))
	if err != nil {
		fmt.Printf("failed to parse passfile: %v\n", err)
		return
	}

	pass := FindPassword(pf, "localhost", "5432", "appdb", "dbuser")
	fmt.Printf("Found password: %s\n", pass)
}

{
  "schemaVersion": 1,
  "goal": "parse pgpass file and find password",
  "kind": "HOW",
  "packages": [
    "pkg:golang/github.com/jackc/pgpassfile@v1.0.0"
  ],
  "symbols": [
    "pgpassfile.FindPassword",
    "pgpassfile.ParsePassfile"
  ]
}

package main

import (
	"fmt"
	"os"
	"strings"

	"github.com/jackc/pgpassfile"
)

func assertEqual(name, actual, expected string) {
	if actual != expected {
		fmt.Fprintf(os.Stderr, "Assertion failed for %s: got %q, expected %q\n", name, actual, expected)
		os.Exit(1)
	}
}

func main() {
	passfileData := `# pgpass test configuration
localhost:5432:testdb:alice:aliceSecret
db.example.com:5432:proddb:bob:bobSecurePass
*:5432:*:backupuser:wildcardSecret
localhost:*:*:readonly:roPassword
escaped\:host:5432:special\:db:user:pass\:with\:colons
`

	pf, err := pgpassfile.ParsePassfile(strings.NewReader(passfileData))
	if err != nil {
		fmt.Fprintf(os.Stderr, "Failed to parse passfile: %v\n", err)
		os.Exit(1)
	}

	// pgpassfile.ParsePassfile parses valid pgpass formatted stream from an io.Reader
	if pf == nil {
		fmt.Fprintf(os.Stderr, "Expected non-nil Passfile instance\n")
		os.Exit(1)
	}

	// pgpassfile.FindPassword matches exact connection parameters to retrieve password
	assertEqual("exact match alice", pf.FindPassword("localhost", "5432", "testdb", "alice"), "aliceSecret")
	assertEqual("exact match bob", pf.FindPassword("db.example.com", "5432", "proddb", "bob"), "bobSecurePass")

	// pgpassfile.FindPassword matches wildcard entries in pgpass definitions
	assertEqual("wildcard match backupuser", pf.FindPassword("anyhost.example.com", "5432", "randomdb", "backupuser"), "wildcardSecret")
	assertEqual("wildcard port/db match readonly", pf.FindPassword("localhost", "5433", "otherdb", "readonly"), "roPassword")

	// pgpassfile.FindPassword handles escaped colons in fields
	assertEqual("escaped colon fields", pf.FindPassword("escaped:host", "5432", "special:db", "user"), "pass:with:colons")

	// pgpassfile.FindPassword returns empty string when no matching entry exists
	assertEqual("no match", pf.FindPassword("localhost", "5432", "testdb", "unknown"), "")

	fmt.Println("All contract assertions passed successfully.")
}