golang.org/x/crypto v0.48.0: bcrypt.DefaultCost

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify golang.org/x/crypto/bcrypt.DefaultCost in pkg:golang/golang.org/x/crypto@v0.48.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/golang.org/x/crypto@v0.48.0
Demonstrate these symbols/APIs:
  - golang.org/x/crypto/bcrypt.DefaultCost

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:faace6b774bf0619a96ce617dbb50be87141d03fa67687d6b57e32b326b5f6a0","contract":["bcrypt.DefaultCost equals 10 and satisfies MinCost and MaxCost bounds","bcrypt.GenerateFromPassword succeeds using bcrypt.DefaultCost and Cost reports DefaultCost","bcrypt.GenerateFromPassword with cost below MinCost falls back to DefaultCost","bcrypt.CompareHashAndPassword validates matching password hashed with DefaultCost"],"goal":"verify golang.org/x/crypto/bcrypt.DefaultCost in pkg:golang/golang.org/x/crypto@v0.48.0","kind":"HOW","packages":["pkg:golang/golang.org/x/crypto@v0.48.0"],"schemaVersion":1,"symbols":["golang.org/x/crypto/bcrypt.DefaultCost"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/golang.org/x/crypto@v0.48.0"],"schemaVersion":1,"subject":"pkg:golang/golang.org/x/crypto@v0.48.0","symbols":["golang.org/x/crypto/bcrypt.DefaultCost"],"verifierAdapter":"golang@1"}

module sample

go 1.26.6

require golang.org/x/crypto v0.48.0

golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=
golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos=

package main

import (
	"fmt"

	"golang.org/x/crypto/bcrypt"
)

// HashPassword hashes a plain text password using bcrypt with DefaultCost.
func HashPassword(password string) ([]byte, error) {
	return bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
}

// CheckPasswordHash compares a bcrypt hashed password with its plain text equivalent.
func CheckPasswordHash(password string, hash []byte) bool {
	err := bcrypt.CompareHashAndPassword(hash, []byte(password))
	return err == nil
}

func main() {
	password := "sample-password"
	hash, err := HashPassword(password)
	if err != nil {
		fmt.Printf("Error hashing password: %v\n", err)
		return
	}

	cost, err := bcrypt.Cost(hash)
	if err != nil {
		fmt.Printf("Error reading hash cost: %v\n", err)
		return
	}

	match := CheckPasswordHash(password, hash)
	fmt.Printf("Cost: %d (DefaultCost: %d), Match: %t\n", cost, bcrypt.DefaultCost, match)
}

{
  "schemaVersion": 1,
  "goal": "verify golang.org/x/crypto/bcrypt.DefaultCost in pkg:golang/golang.org/x/crypto@v0.48.0",
  "kind": "HOW",
  "packages": [
    "pkg:golang/golang.org/x/crypto@v0.48.0"
  ],
  "symbols": [
    "golang.org/x/crypto/bcrypt.DefaultCost"
  ]
}

package main

import (
	"fmt"
	"os"

	"golang.org/x/crypto/bcrypt"
)

func main() {
	// 1. bcrypt.DefaultCost equals 10 and satisfies MinCost and MaxCost bounds
	{
		if bcrypt.DefaultCost != 10 {
			fmt.Fprintf(os.Stderr, "FAIL: expected DefaultCost to be 10, got %d\n", bcrypt.DefaultCost)
			os.Exit(1)
		}
		if bcrypt.DefaultCost < bcrypt.MinCost || bcrypt.DefaultCost > bcrypt.MaxCost {
			fmt.Fprintf(os.Stderr, "FAIL: DefaultCost %d is outside [%d, %d]\n", bcrypt.DefaultCost, bcrypt.MinCost, bcrypt.MaxCost)
			os.Exit(1)
		}
	}

	// 2. bcrypt.GenerateFromPassword succeeds using bcrypt.DefaultCost and Cost reports DefaultCost
	{
		password := []byte("secure-sample-pass-1234")
		hash, err := bcrypt.GenerateFromPassword(password, bcrypt.DefaultCost)
		if err != nil {
			fmt.Fprintf(os.Stderr, "FAIL: GenerateFromPassword with DefaultCost failed: %v\n", err)
			os.Exit(1)
		}
		cost, err := bcrypt.Cost(hash)
		if err != nil {
			fmt.Fprintf(os.Stderr, "FAIL: Cost failed: %v\n", err)
			os.Exit(1)
		}
		if cost != bcrypt.DefaultCost {
			fmt.Fprintf(os.Stderr, "FAIL: expected Cost %d, got %d\n", bcrypt.DefaultCost, cost)
			os.Exit(1)
		}
	}

	// 3. bcrypt.GenerateFromPassword with cost below MinCost falls back to DefaultCost
	{
		password := []byte("secure-sample-pass-1234")
		hashZero, err := bcrypt.GenerateFromPassword(password, 0)
		if err != nil {
			fmt.Fprintf(os.Stderr, "FAIL: GenerateFromPassword with cost 0 failed: %v\n", err)
			os.Exit(1)
		}
		costZero, err := bcrypt.Cost(hashZero)
		if err != nil {
			fmt.Fprintf(os.Stderr, "FAIL: Cost failed for zero cost: %v\n", err)
			os.Exit(1)
		}
		if costZero != bcrypt.DefaultCost {
			fmt.Fprintf(os.Stderr, "FAIL: expected fallback to DefaultCost %d, got %d\n", bcrypt.DefaultCost, costZero)
			os.Exit(1)
		}
	}

	// 4. bcrypt.CompareHashAndPassword validates matching password hashed with DefaultCost
	{
		password := []byte("secure-sample-pass-1234")
		hash, err := bcrypt.GenerateFromPassword(password, bcrypt.DefaultCost)
		if err != nil {
			fmt.Fprintf(os.Stderr, "FAIL: GenerateFromPassword failed: %v\n", err)
			os.Exit(1)
		}
		if err := bcrypt.CompareHashAndPassword(hash, password); err != nil {
			fmt.Fprintf(os.Stderr, "FAIL: CompareHashAndPassword returned error for matching password: %v\n", err)
			os.Exit(1)
		}
		wrongPassword := []byte("incorrect-sample-pass")
		if err := bcrypt.CompareHashAndPassword(hash, wrongPassword); err == nil {
			fmt.Fprintf(os.Stderr, "FAIL: CompareHashAndPassword expected error for mismatched password\n")
			os.Exit(1)
		}
	}

	fmt.Println("PASS: all contract assertions passed")
}