golang.org/x/crypto v0.0.0-20220525230936-793ad666bf5e: bcrypt.ErrMismatchedHashAndPassword

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify golang.org/x/crypto/bcrypt.ErrMismatchedHashAndPassword in pkg:golang/golang.org/x/crypto@v0.0.0-20220525230936-793ad666bf5e
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/golang.org/x/crypto@v0.0.0-20220525230936-793ad666bf5e
Demonstrate these symbols/APIs:
  - golang.org/x/crypto/bcrypt.ErrMismatchedHashAndPassword

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:d00ec0ce79984589488cbf0166b29386926f4dac98947c0d3ae850dd1208970d","contract":["bcrypt.CompareHashAndPassword returns ErrMismatchedHashAndPassword when password differs from hashed secret","errors.Is matches ErrMismatchedHashAndPassword on mismatched password error","bcrypt.ErrMismatchedHashAndPassword.Error() returns 'crypto/bcrypt: hashedPassword is not the hash of the given password'","bcrypt.CompareHashAndPassword returns ErrMismatchedHashAndPassword for an empty password against a non-empty secret hash","bcrypt.CompareHashAndPassword returns nil when the password matches the hash"],"goal":"verify golang.org/x/crypto/bcrypt.ErrMismatchedHashAndPassword in pkg:golang/golang.org/x/crypto@v0.0.0-20220525230936-793ad666bf5e","kind":"HOW","packages":["pkg:golang/golang.org/x/crypto@v0.0.0-20220525230936-793ad666bf5e"],"schemaVersion":1,"symbols":["golang.org/x/crypto/bcrypt.ErrMismatchedHashAndPassword"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/golang.org/x/crypto@v0.0.0-20220525230936-793ad666bf5e"],"schemaVersion":1,"subject":"pkg:golang/golang.org/x/crypto@v0.0.0-20220525230936-793ad666bf5e","symbols":["golang.org/x/crypto/bcrypt.ErrMismatchedHashAndPassword"],"verifierAdapter":"golang@1"}

module example.com/sample

go 1.20

require golang.org/x/crypto v0.0.0-20220525230936-793ad666bf5e

golang.org/x/crypto v0.0.0-20220525230936-793ad666bf5e h1:T8NU3HyQ8ClP4SEE+KbFlg6n0NhuTsN4MyznaarGsZM=
golang.org/x/crypto v0.0.0-20220525230936-793ad666bf5e/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=

package main

import (
	"errors"
	"fmt"
	"log"

	"golang.org/x/crypto/bcrypt"
)

func main() {
	secret := []byte("expected-passphrase")
	incorrect := []byte("unexpected-passphrase")

	hashed, err := bcrypt.GenerateFromPassword(secret, bcrypt.MinCost)
	if err != nil {
		log.Fatalf("generate hash failed: %v", err)
	}

	if err := bcrypt.CompareHashAndPassword(hashed, incorrect); !errors.Is(err, bcrypt.ErrMismatchedHashAndPassword) {
		log.Fatalf("expected ErrMismatchedHashAndPassword, got: %v", err)
	}

	if err := bcrypt.CompareHashAndPassword(hashed, secret); err != nil {
		log.Fatalf("expected nil on matching password, got: %v", err)
	}

	fmt.Println(bcrypt.ErrMismatchedHashAndPassword.Error())
}

{
  "schemaVersion": 1,
  "goal": "verify golang.org/x/crypto/bcrypt.ErrMismatchedHashAndPassword in pkg:golang/golang.org/x/crypto@v0.0.0-20220525230936-793ad666bf5e",
  "kind": "HOW",
  "packages": [
    "pkg:golang/golang.org/x/crypto@v0.0.0-20220525230936-793ad666bf5e"
  ],
  "symbols": [
    "golang.org/x/crypto/bcrypt.ErrMismatchedHashAndPassword"
  ]
}

package main

import (
	"errors"
	"fmt"
	"os"

	"golang.org/x/crypto/bcrypt"
)

func main() {
	validSecret := []byte("alpha-secret-value")
	invalidSecret := []byte("beta-secret-value")

	digest, err := bcrypt.GenerateFromPassword(validSecret, bcrypt.MinCost)
	if err != nil {
		fmt.Fprintf(os.Stderr, "GenerateFromPassword failed: %v\n", err)
		os.Exit(1)
	}

	// 1. CompareHashAndPassword returns ErrMismatchedHashAndPassword when password differs from hashed secret
	mismatchErr := bcrypt.CompareHashAndPassword(digest, invalidSecret)
	if mismatchErr != bcrypt.ErrMismatchedHashAndPassword {
		fmt.Fprintf(os.Stderr, "expected direct equality with ErrMismatchedHashAndPassword, got %v\n", mismatchErr)
		os.Exit(1)
	}

	// 2. errors.Is matches ErrMismatchedHashAndPassword on mismatched password error
	if !errors.Is(mismatchErr, bcrypt.ErrMismatchedHashAndPassword) {
		fmt.Fprintf(os.Stderr, "expected errors.Is to match ErrMismatchedHashAndPassword\n")
		os.Exit(1)
	}

	// 3. ErrMismatchedHashAndPassword.Error() returns the canonical bcrypt mismatch string
	const wantMsg = "crypto/bcrypt: hashedPassword is not the hash of the given password"
	if got := bcrypt.ErrMismatchedHashAndPassword.Error(); got != wantMsg {
		fmt.Fprintf(os.Stderr, "unexpected Error() string: got %q, want %q\n", got, wantMsg)
		os.Exit(1)
	}

	// 4. CompareHashAndPassword returns ErrMismatchedHashAndPassword for an empty password against a non-empty secret hash
	if err := bcrypt.CompareHashAndPassword(digest, nil); !errors.Is(err, bcrypt.ErrMismatchedHashAndPassword) {
		fmt.Fprintf(os.Stderr, "expected ErrMismatchedHashAndPassword for empty password, got %v\n", err)
		os.Exit(1)
	}

	// 5. CompareHashAndPassword returns nil when the password matches the hash
	if err := bcrypt.CompareHashAndPassword(digest, validSecret); err != nil {
		fmt.Fprintf(os.Stderr, "expected nil for matching password, got %v\n", err)
		os.Exit(1)
	}

	fmt.Println("contract ok")
}