golang.org/x/crypto v0.58.0: bcrypt.GenerateFromPassword

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify golang.org/x/crypto/bcrypt.GenerateFromPassword in pkg:golang/golang.org/x/crypto@v0.58.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/golang.org/x/crypto@v0.58.0
Demonstrate these symbols/APIs:
  - golang.org/x/crypto/bcrypt.GenerateFromPassword

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:9f64fb6759f10d48b08453d647722531590ffb1ae3e13d3eba1c1192680c8792","contract":["bcrypt.GenerateFromPassword generates a 60-byte $2a$ bcrypt hash with MinCost","bcrypt.GenerateFromPassword with cost less than MinCost automatically defaults to DefaultCost","bcrypt.GenerateFromPassword generates distinct hashes for identical passwords due to random salt","bcrypt.GenerateFromPassword accepts 72-byte passwords and rejects passwords exceeding 72 bytes with ErrPasswordTooLong","bcrypt.GenerateFromPassword rejects cost exceeding MaxCost with InvalidCostError","bcrypt.CompareHashAndPassword verifies matching password and returns ErrMismatchedHashAndPassword on mismatch"],"goal":"verify golang.org/x/crypto/bcrypt.GenerateFromPassword in pkg:golang/golang.org/x/crypto@v0.58.0","kind":"HOW","packages":["pkg:golang/golang.org/x/crypto@v0.58.0"],"schemaVersion":1,"symbols":["golang.org/x/crypto/bcrypt.GenerateFromPassword"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/golang.org/x/crypto@v0.58.0"],"schemaVersion":1,"subject":"pkg:golang/golang.org/x/crypto@v0.58.0","symbols":["golang.org/x/crypto/bcrypt.GenerateFromPassword"],"verifierAdapter":"golang@1"}

module example.com/sample

go 1.26.0

require golang.org/x/crypto v0.58.0

golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=

package main

import (
	"bytes"
	"fmt"
	"log"

	"golang.org/x/crypto/bcrypt"
)

func main() {
	password := []byte("example-password")

	hash, err := bcrypt.GenerateFromPassword(password, bcrypt.MinCost)
	if err != nil {
		log.Fatalf("GenerateFromPassword failed: %v", err)
	}
	fmt.Printf("Generated hash: %s\n", hash)

	if !bytes.HasPrefix(hash, []byte("$2a$")) {
		log.Fatalf("Unexpected hash prefix: %s", hash)
	}

	if err := bcrypt.CompareHashAndPassword(hash, password); err != nil {
		log.Fatalf("CompareHashAndPassword failed: %v", err)
	}
	fmt.Println("Password verified successfully.")
}

{
  "schemaVersion": 1,
  "goal": "verify golang.org/x/crypto/bcrypt.GenerateFromPassword in pkg:golang/golang.org/x/crypto@v0.58.0",
  "kind": "HOW",
  "packages": [
    "pkg:golang/golang.org/x/crypto@v0.58.0"
  ],
  "symbols": [
    "golang.org/x/crypto/bcrypt.GenerateFromPassword"
  ]
}

package main

import (
	"bytes"
	"errors"
	"fmt"
	"os"

	"golang.org/x/crypto/bcrypt"
)

func main() {
	password := []byte("sample-secret-password")

	// 1. bcrypt.GenerateFromPassword generates a 60-byte $2a$ bcrypt hash with MinCost
	hashMin, err := bcrypt.GenerateFromPassword(password, bcrypt.MinCost)
	if err != nil {
		fmt.Fprintf(os.Stderr, "bcrypt.GenerateFromPassword failed with MinCost: %v\n", err)
		os.Exit(1)
	}
	if !bytes.HasPrefix(hashMin, []byte("$2a$04$")) || len(hashMin) != 60 {
		fmt.Fprintf(os.Stderr, "Unexpected hash format: %s (len=%d)\n", hashMin, len(hashMin))
		os.Exit(1)
	}
	costMin, err := bcrypt.Cost(hashMin)
	if err != nil || costMin != bcrypt.MinCost {
		fmt.Fprintf(os.Stderr, "Expected MinCost (%d), got %d (err=%v)\n", bcrypt.MinCost, costMin, err)
		os.Exit(1)
	}

	// 2. bcrypt.GenerateFromPassword with cost less than MinCost automatically defaults to DefaultCost
	hashDefault, err := bcrypt.GenerateFromPassword(password, bcrypt.MinCost-1)
	if err != nil {
		fmt.Fprintf(os.Stderr, "bcrypt.GenerateFromPassword failed with cost < MinCost: %v\n", err)
		os.Exit(1)
	}
	costDefault, err := bcrypt.Cost(hashDefault)
	if err != nil || costDefault != bcrypt.DefaultCost {
		fmt.Fprintf(os.Stderr, "Expected DefaultCost (%d), got %d (err=%v)\n", bcrypt.DefaultCost, costDefault, err)
		os.Exit(1)
	}

	// 3. bcrypt.GenerateFromPassword generates distinct hashes for identical passwords due to random salt
	hashMin2, err := bcrypt.GenerateFromPassword(password, bcrypt.MinCost)
	if err != nil {
		fmt.Fprintf(os.Stderr, "Second bcrypt.GenerateFromPassword failed: %v\n", err)
		os.Exit(1)
	}
	if bytes.Equal(hashMin, hashMin2) {
		fmt.Fprintf(os.Stderr, "Expected distinct hashes for identical passwords, got identical hashes\n")
		os.Exit(1)
	}

	// 4. bcrypt.GenerateFromPassword accepts 72-byte passwords and rejects passwords exceeding 72 bytes with ErrPasswordTooLong
	exact72 := bytes.Repeat([]byte("a"), 72)
	if _, err := bcrypt.GenerateFromPassword(exact72, bcrypt.MinCost); err != nil {
		fmt.Fprintf(os.Stderr, "Expected 72-byte password to succeed, got: %v\n", err)
		os.Exit(1)
	}
	tooLong73 := bytes.Repeat([]byte("a"), 73)
	if _, err := bcrypt.GenerateFromPassword(tooLong73, bcrypt.MinCost); !errors.Is(err, bcrypt.ErrPasswordTooLong) {
		fmt.Fprintf(os.Stderr, "Expected ErrPasswordTooLong for 73-byte password, got: %v\n", err)
		os.Exit(1)
	}

	// 5. bcrypt.GenerateFromPassword rejects cost exceeding MaxCost with InvalidCostError
	_, err = bcrypt.GenerateFromPassword(password, bcrypt.MaxCost+1)
	var invalidCostErr bcrypt.InvalidCostError
	if !errors.As(err, &invalidCostErr) || int(invalidCostErr) != bcrypt.MaxCost+1 {
		fmt.Fprintf(os.Stderr, "Expected InvalidCostError(%d), got %T: %v\n", bcrypt.MaxCost+1, err, err)
		os.Exit(1)
	}

	// 6. bcrypt.CompareHashAndPassword verifies matching password and returns ErrMismatchedHashAndPassword on mismatch
	if err := bcrypt.CompareHashAndPassword(hashMin, password); err != nil {
		fmt.Fprintf(os.Stderr, "CompareHashAndPassword failed on matching password: %v\n", err)
		os.Exit(1)
	}
	if err := bcrypt.CompareHashAndPassword(hashMin, []byte("wrong-password")); !errors.Is(err, bcrypt.ErrMismatchedHashAndPassword) {
		fmt.Fprintf(os.Stderr, "Expected ErrMismatchedHashAndPassword, got: %v\n", err)
		os.Exit(1)
	}

	fmt.Println("Contract passed.")
}