golang.org/x/crypto v0.21.0: bcrypt.Cost

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify golang.org/x/crypto/bcrypt.Cost in pkg:golang/golang.org/x/crypto@v0.21.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/golang.org/x/crypto@v0.21.0
Demonstrate these symbols/APIs:
  - golang.org/x/crypto/bcrypt.Cost

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:22b27c541c1e6f9c70a922ecd025ca6e1560de32481cc3b158c21d98952e52c7","contract":["bcrypt.Cost returns the integer cost value extracted from a valid bcrypt hash","bcrypt.Cost returns MinCost when inspecting a hash generated with MinCost","bcrypt.Cost returns DefaultCost when inspecting a hash generated with DefaultCost","bcrypt.Cost returns an error when given an invalid or truncated hash","bcrypt.Cost returns an error when given an empty or nil byte slice"],"goal":"verify golang.org/x/crypto/bcrypt.Cost in pkg:golang/golang.org/x/crypto@v0.21.0","kind":"HOW","packages":["pkg:golang/golang.org/x/crypto@v0.21.0"],"schemaVersion":1,"symbols":["golang.org/x/crypto/bcrypt.Cost"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","language":"go","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","packageManagerVersion":"1.26.6","runtime":"go","runtimeVersion":"1.26.6","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/golang.org/x/crypto@v0.21.0"],"schemaVersion":1,"subject":"pkg:golang/golang.org/x/crypto@v0.21.0","symbols":["golang.org/x/crypto/bcrypt.Cost"],"verifierAdapter":"golang@1"}

module example.com/sample

go 1.22

require golang.org/x/crypto v0.21.0

golang.org/x/crypto v0.21.0 h1:X31++rzVUdKhX5sWmSOFZxx8UW/ldWx55cbf08iNAMA=
golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOMs=

package main

import (
	"fmt"
	"log"

	"golang.org/x/crypto/bcrypt"
)

func main() {
	password := []byte("example-secret-pass")

	// Generate a bcrypt hash using MinCost
	hash, err := bcrypt.GenerateFromPassword(password, bcrypt.MinCost)
	if err != nil {
		log.Fatalf("failed to generate bcrypt hash: %v", err)
	}

	// Extract hashing cost using bcrypt.Cost
	cost, err := bcrypt.Cost(hash)
	if err != nil {
		log.Fatalf("failed to extract cost from hash: %v", err)
	}

	fmt.Printf("Extracted bcrypt cost: %d (MinCost: %d)\n", cost, bcrypt.MinCost)
}

{
  "schemaVersion": 1,
  "goal": "verify golang.org/x/crypto/bcrypt.Cost in pkg:golang/golang.org/x/crypto@v0.21.0",
  "kind": "HOW",
  "packages": [
    "pkg:golang/golang.org/x/crypto@v0.21.0"
  ],
  "symbols": [
    "golang.org/x/crypto/bcrypt.Cost"
  ]
}

package main

import (
	"fmt"
	"os"

	"golang.org/x/crypto/bcrypt"
)

func main() {
	password := []byte("contract-test-password")

	// 1. bcrypt.Cost returns the integer cost value extracted from a valid bcrypt hash
	hashMin, err := bcrypt.GenerateFromPassword(password, bcrypt.MinCost)
	if err != nil {
		fmt.Fprintf(os.Stderr, "bcrypt.GenerateFromPassword failed: %v\n", err)
		os.Exit(1)
	}
	cost, err := bcrypt.Cost(hashMin)
	if err != nil {
		fmt.Fprintf(os.Stderr, "bcrypt.Cost returned unexpected error: %v\n", err)
		os.Exit(1)
	}

	// 2. bcrypt.Cost returns MinCost when inspecting a hash generated with MinCost
	if cost != bcrypt.MinCost {
		fmt.Fprintf(os.Stderr, "bcrypt.Cost mismatch: got %d, want %d\n", cost, bcrypt.MinCost)
		os.Exit(1)
	}

	// 3. bcrypt.Cost returns DefaultCost when inspecting a hash generated with DefaultCost
	hashDefault, err := bcrypt.GenerateFromPassword(password, bcrypt.DefaultCost)
	if err != nil {
		fmt.Fprintf(os.Stderr, "bcrypt.GenerateFromPassword with DefaultCost failed: %v\n", err)
		os.Exit(1)
	}
	costDefault, err := bcrypt.Cost(hashDefault)
	if err != nil {
		fmt.Fprintf(os.Stderr, "bcrypt.Cost failed for DefaultCost hash: %v\n", err)
		os.Exit(1)
	}
	if costDefault != bcrypt.DefaultCost {
		fmt.Fprintf(os.Stderr, "bcrypt.Cost mismatch for DefaultCost: got %d, want %d\n", costDefault, bcrypt.DefaultCost)
		os.Exit(1)
	}

	// 4. bcrypt.Cost returns an error when given an invalid or truncated hash
	invalidHash := []byte("not-a-valid-bcrypt-hash")
	if _, err := bcrypt.Cost(invalidHash); err == nil {
		fmt.Fprintf(os.Stderr, "expected error for invalid hash, got nil\n")
		os.Exit(1)
	}

	// 5. bcrypt.Cost returns an error when given an empty or nil byte slice
	if _, err := bcrypt.Cost(nil); err == nil {
		fmt.Fprintf(os.Stderr, "expected error for nil hash, got nil\n")
		os.Exit(1)
	}
	if _, err := bcrypt.Cost([]byte{}); err == nil {
		fmt.Fprintf(os.Stderr, "expected error for empty hash, got nil\n")
		os.Exit(1)
	}

	fmt.Println("All contract assertions passed.")
}