golang.org/x/crypto v0.27.0: bcrypt.ErrMismatchedHashAndPassword

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify golang.org/x/crypto/bcrypt.ErrMismatchedHashAndPassword in pkg:golang/golang.org/x/crypto@v0.27.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/golang.org/x/crypto@v0.27.0
Demonstrate these symbols/APIs:
  - golang.org/x/crypto/bcrypt.ErrMismatchedHashAndPassword

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:5e848bf66093830ee2d4e77012b0c75830f7b491bd977019543ebb844f6d135d","contract":["bcrypt.CompareHashAndPassword returns ErrMismatchedHashAndPassword when password does not match hash","errors.Is identifies ErrMismatchedHashAndPassword from CompareHashAndPassword error","bcrypt.ErrMismatchedHashAndPassword error message equals 'crypto/bcrypt: hashedPassword is not the hash of the given password'","bcrypt.CompareHashAndPassword returns ErrMismatchedHashAndPassword for empty password against non-empty hash","bcrypt.CompareHashAndPassword returns ErrMismatchedHashAndPassword when hash payload is corrupted","bcrypt.CompareHashAndPassword returns nil for matching password and does not match ErrMismatchedHashAndPassword"],"goal":"verify golang.org/x/crypto/bcrypt.ErrMismatchedHashAndPassword in pkg:golang/golang.org/x/crypto@v0.27.0","kind":"HOW","packages":["pkg:golang/golang.org/x/crypto@v0.27.0"],"schemaVersion":1,"symbols":["golang.org/x/crypto/bcrypt.ErrMismatchedHashAndPassword"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/golang.org/x/crypto@v0.27.0"],"schemaVersion":1,"subject":"pkg:golang/golang.org/x/crypto@v0.27.0","symbols":["golang.org/x/crypto/bcrypt.ErrMismatchedHashAndPassword"],"verifierAdapter":"golang@1"}

module example.com/sample

go 1.23

require golang.org/x/crypto v0.27.0

golang.org/x/crypto v0.27.0 h1:GXm2NjJrPaiv/h1tb2UH8QfgC/hOf/+z0p6PT8o1w7A=
golang.org/x/crypto v0.27.0/go.mod h1:1Xngt8kV6Dvbssa53Ziq6Eqn0HqbZi5Z6R0ZpwQzt70=

package main

import (
	"errors"
	"fmt"
	"log"

	"golang.org/x/crypto/bcrypt"
)

func main() {
	password := []byte("correct-password")
	wrongPassword := []byte("wrong-password")

	// Generate bcrypt hash
	hash, err := bcrypt.GenerateFromPassword(password, bcrypt.DefaultCost)
	if err != nil {
		log.Fatalf("failed to generate password hash: %v", err)
	}

	// Compare with incorrect password to demonstrate ErrMismatchedHashAndPassword
	err = bcrypt.CompareHashAndPassword(hash, wrongPassword)
	if err != nil {
		if errors.Is(err, bcrypt.ErrMismatchedHashAndPassword) {
			fmt.Println("Password mismatch detected successfully via ErrMismatchedHashAndPassword")
		} else {
			log.Fatalf("unexpected error during password comparison: %v", err)
		}
	}

	// Verify matching password returns nil
	if err := bcrypt.CompareHashAndPassword(hash, password); err != nil {
		log.Fatalf("unexpected error for matching password: %v", err)
	}
	fmt.Println("Password verified successfully")
}

{
  "schemaVersion": 1,
  "goal": "verify golang.org/x/crypto/bcrypt.ErrMismatchedHashAndPassword in pkg:golang/golang.org/x/crypto@v0.27.0",
  "kind": "HOW",
  "packages": [
    "pkg:golang/golang.org/x/crypto@v0.27.0"
  ],
  "symbols": [
    "golang.org/x/crypto/bcrypt.ErrMismatchedHashAndPassword"
  ]
}

package main

import (
	"errors"
	"fmt"
	"os"

	"golang.org/x/crypto/bcrypt"
)

func main() {
	password := []byte("contract-test-password")
	wrongPassword := []byte("mismatched-test-password")

	hash, err := bcrypt.GenerateFromPassword(password, bcrypt.MinCost)
	if err != nil {
		fmt.Fprintf(os.Stderr, "setup failed: %v\n", err)
		os.Exit(1)
	}

	// 1. bcrypt.CompareHashAndPassword returns ErrMismatchedHashAndPassword when password does not match hash
	errMismatch := bcrypt.CompareHashAndPassword(hash, wrongPassword)
	if errMismatch == nil || !errors.Is(errMismatch, bcrypt.ErrMismatchedHashAndPassword) {
		fmt.Fprintf(os.Stderr, "assertion 1 failed: expected ErrMismatchedHashAndPassword, got %v\n", errMismatch)
		os.Exit(1)
	}

	// 2. errors.Is identifies ErrMismatchedHashAndPassword from CompareHashAndPassword error
	if !errors.Is(errMismatch, bcrypt.ErrMismatchedHashAndPassword) {
		fmt.Fprintf(os.Stderr, "assertion 2 failed: errors.Is failed to identify ErrMismatchedHashAndPassword\n")
		os.Exit(1)
	}

	// 3. bcrypt.ErrMismatchedHashAndPassword error message equals 'crypto/bcrypt: hashedPassword is not the hash of the given password'
	expectedMsg := "crypto/bcrypt: hashedPassword is not the hash of the given password"
	if bcrypt.ErrMismatchedHashAndPassword.Error() != expectedMsg {
		fmt.Fprintf(os.Stderr, "assertion 3 failed: expected %q, got %q\n", expectedMsg, bcrypt.ErrMismatchedHashAndPassword.Error())
		os.Exit(1)
	}

	// 4. bcrypt.CompareHashAndPassword returns ErrMismatchedHashAndPassword for empty password against non-empty hash
	emptyErr := bcrypt.CompareHashAndPassword(hash, []byte(""))
	if !errors.Is(emptyErr, bcrypt.ErrMismatchedHashAndPassword) {
		fmt.Fprintf(os.Stderr, "assertion 4 failed: expected ErrMismatchedHashAndPassword, got %v\n", emptyErr)
		os.Exit(1)
	}

	// 5. bcrypt.CompareHashAndPassword returns ErrMismatchedHashAndPassword when hash payload is corrupted
	corruptedHash := make([]byte, len(hash))
	copy(corruptedHash, hash)
	if corruptedHash[len(corruptedHash)-1] == 'a' {
		corruptedHash[len(corruptedHash)-1] = 'b'
	} else {
		corruptedHash[len(corruptedHash)-1] = 'a'
	}
	corruptedErr := bcrypt.CompareHashAndPassword(corruptedHash, password)
	if !errors.Is(corruptedErr, bcrypt.ErrMismatchedHashAndPassword) {
		fmt.Fprintf(os.Stderr, "assertion 5 failed: expected ErrMismatchedHashAndPassword, got %v\n", corruptedErr)
		os.Exit(1)
	}

	// 6. bcrypt.CompareHashAndPassword returns nil for matching password and does not match ErrMismatchedHashAndPassword
	matchErr := bcrypt.CompareHashAndPassword(hash, password)
	if matchErr != nil {
		fmt.Fprintf(os.Stderr, "assertion 6 failed: expected nil for matching password, got %v\n", matchErr)
		os.Exit(1)
	}
	if errors.Is(matchErr, bcrypt.ErrMismatchedHashAndPassword) {
		fmt.Fprintf(os.Stderr, "assertion 6 failed: nil should not match ErrMismatchedHashAndPassword\n")
		os.Exit(1)
	}

	fmt.Println("All contract assertions passed.")
}