golang.org/x/crypto v0.37.0: bcrypt.ErrPasswordTooLong

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify golang.org/x/crypto/bcrypt.ErrPasswordTooLong in pkg:golang/golang.org/x/crypto@v0.37.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/golang.org/x/crypto@v0.37.0
Demonstrate these symbols/APIs:
  - golang.org/x/crypto/bcrypt.ErrPasswordTooLong

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:6ad6d1cde21fa1557712c152e937fda2fb37c0e6da29a480401c921293a10045","contract":["bcrypt.GenerateFromPassword returns ErrPasswordTooLong when password exceeds 72 bytes","bcrypt.GenerateFromPassword returns ErrPasswordTooLong for 100-byte password","bcrypt.GenerateFromPassword succeeds for password of exactly 72 bytes","bcrypt.GenerateFromPassword succeeds for password of 71 bytes","bcrypt.ErrPasswordTooLong matches errors.Is","bcrypt.ErrPasswordTooLong error string equals \"bcrypt: password length exceeds 72 bytes\""],"goal":"verify golang.org/x/crypto/bcrypt.ErrPasswordTooLong in pkg:golang/golang.org/x/crypto@v0.37.0","kind":"HOW","packages":["pkg:golang/golang.org/x/crypto@v0.37.0"],"schemaVersion":1,"symbols":["golang.org/x/crypto/bcrypt.ErrPasswordTooLong"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/golang.org/x/crypto@v0.37.0"],"schemaVersion":1,"subject":"pkg:golang/golang.org/x/crypto@v0.37.0","symbols":["golang.org/x/crypto/bcrypt.ErrPasswordTooLong"],"verifierAdapter":"golang@1"}

module example.com/sample

go 1.26.0

require golang.org/x/crypto v0.37.0

golang.org/x/crypto v0.37.0 h1:kJNSjF/Xp7kU0iB2Z+9viTPMW4EqqsrywMXLJOOsXSE=
golang.org/x/crypto v0.37.0/go.mod h1:vg+k43peMZ0pUMhYmVAWysMK35e6ioLh3wB8ZCAfbVc=

package main

import (
	"bytes"
	"errors"
	"fmt"
	"log"

	"golang.org/x/crypto/bcrypt"
)

func main() {
	// bcrypt passwords have a maximum length limit of 72 bytes.
	validPassword := bytes.Repeat([]byte("a"), 72)
	hash, err := bcrypt.GenerateFromPassword(validPassword, bcrypt.MinCost)
	if err != nil {
		log.Fatalf("failed to hash 72-byte password: %v", err)
	}
	fmt.Printf("Successfully hashed 72-byte password, hash length: %d\n", len(hash))

	// Passwords exceeding 72 bytes return ErrPasswordTooLong.
	longPassword := bytes.Repeat([]byte("a"), 73)
	_, err = bcrypt.GenerateFromPassword(longPassword, bcrypt.MinCost)
	if errors.Is(err, bcrypt.ErrPasswordTooLong) {
		fmt.Printf("Correctly rejected password exceeding 72 bytes with: %v\n", err)
	} else {
		log.Fatalf("expected ErrPasswordTooLong, got %v", err)
	}
}

{
  "schemaVersion": 1,
  "goal": "verify golang.org/x/crypto/bcrypt.ErrPasswordTooLong in pkg:golang/golang.org/x/crypto@v0.37.0",
  "kind": "HOW",
  "packages": [
    "pkg:golang/golang.org/x/crypto@v0.37.0"
  ],
  "symbols": [
    "golang.org/x/crypto/bcrypt.ErrPasswordTooLong"
  ]
}

package main

import (
	"bytes"
	"errors"
	"fmt"
	"os"

	"golang.org/x/crypto/bcrypt"
)

func main() {
	// 1. bcrypt.GenerateFromPassword returns ErrPasswordTooLong when password exceeds 72 bytes
	pw73 := bytes.Repeat([]byte("x"), 73)
	_, err := bcrypt.GenerateFromPassword(pw73, bcrypt.MinCost)
	if !errors.Is(err, bcrypt.ErrPasswordTooLong) {
		fmt.Fprintf(os.Stderr, "assertion 1 failed: expected ErrPasswordTooLong, got %v\n", err)
		os.Exit(1)
	}

	// 2. bcrypt.GenerateFromPassword returns ErrPasswordTooLong for 100-byte password
	pw100 := bytes.Repeat([]byte("y"), 100)
	_, err = bcrypt.GenerateFromPassword(pw100, bcrypt.MinCost)
	if !errors.Is(err, bcrypt.ErrPasswordTooLong) {
		fmt.Fprintf(os.Stderr, "assertion 2 failed: expected ErrPasswordTooLong, got %v\n", err)
		os.Exit(1)
	}

	// 3. bcrypt.GenerateFromPassword succeeds for password of exactly 72 bytes
	pw72 := bytes.Repeat([]byte("z"), 72)
	hash72, err := bcrypt.GenerateFromPassword(pw72, bcrypt.MinCost)
	if err != nil {
		fmt.Fprintf(os.Stderr, "assertion 3 failed: expected nil error for 72-byte password, got %v\n", err)
		os.Exit(1)
	}
	if err := bcrypt.CompareHashAndPassword(hash72, pw72); err != nil {
		fmt.Fprintf(os.Stderr, "assertion 3 verification failed: %v\n", err)
		os.Exit(1)
	}

	// 4. bcrypt.GenerateFromPassword succeeds for password of 71 bytes
	pw71 := bytes.Repeat([]byte("w"), 71)
	hash71, err := bcrypt.GenerateFromPassword(pw71, bcrypt.MinCost)
	if err != nil {
		fmt.Fprintf(os.Stderr, "assertion 4 failed: expected nil error for 71-byte password, got %v\n", err)
		os.Exit(1)
	}
	if err := bcrypt.CompareHashAndPassword(hash71, pw71); err != nil {
		fmt.Fprintf(os.Stderr, "assertion 4 verification failed: %v\n", err)
		os.Exit(1)
	}

	// 5. bcrypt.ErrPasswordTooLong matches errors.Is
	if !errors.Is(bcrypt.ErrPasswordTooLong, bcrypt.ErrPasswordTooLong) {
		fmt.Fprintf(os.Stderr, "assertion 5 failed: errors.Is did not match ErrPasswordTooLong\n")
		os.Exit(1)
	}

	// 6. bcrypt.ErrPasswordTooLong error string equals "bcrypt: password length exceeds 72 bytes"
	expectedMsg := "bcrypt: password length exceeds 72 bytes"
	if bcrypt.ErrPasswordTooLong.Error() != expectedMsg {
		fmt.Fprintf(os.Stderr, "assertion 6 failed: expected %q, got %q\n", expectedMsg, bcrypt.ErrPasswordTooLong.Error())
		os.Exit(1)
	}

	fmt.Println("All contract assertions passed.")
}