golang.org/x/term v0.0.0-20210927222741-03fcf44c2211: ReadPassword

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify term.ReadPassword in pkg:golang/golang.org/x/term@v0.0.0-20210927222741-03fcf44c2211
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/golang.org/x/term@v0.0.0-20210927222741-03fcf44c2211
Demonstrate these symbols/APIs:
  - term.ReadPassword

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:85dbd5f68c55da153c35b4c3b63a89d669a9fa06fd6c4e174b9d98b512da8010","contract":["term.ReadPassword returns an error for negative or invalid file descriptors","term.ReadPassword returns an error for pipe file descriptors","term.ReadPassword returns an error for regular file descriptors","term.ReadPassword returns an error for /dev/null device descriptors","term.ReadPassword reads password input from a terminal without echoing"],"goal":"verify term.ReadPassword in pkg:golang/golang.org/x/term@v0.0.0-20210927222741-03fcf44c2211","kind":"HOW","packages":["pkg:golang/golang.org/x/term@v0.0.0-20210927222741-03fcf44c2211"],"schemaVersion":1,"symbols":["term.ReadPassword"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","language":"go","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","packageManagerVersion":"1.26.6","runtime":"go","runtimeVersion":"1.26.6","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/golang.org/x/term@v0.0.0-20210927222741-03fcf44c2211"],"schemaVersion":1,"subject":"pkg:golang/golang.org/x/term@v0.0.0-20210927222741-03fcf44c2211","symbols":["term.ReadPassword"],"verifierAdapter":"golang@1"}

module example.com/sample

go 1.26.6

require golang.org/x/term v0.0.0-20210927222741-03fcf44c2211

require golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1 // indirect

golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1 h1:SrN+KX8Art/Sf4HNj6Zcz06G7VEz+7w9tdXTPOZ7+l4=
golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211 h1:JGgROgKl9N8DuW20oFS5gxc+lE67/N3FcwmBPMe7ArY=
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=

package main

import (
	"fmt"
	"os"

	"golang.org/x/term"
)

func main() {
	fd := int(os.Stdin.Fd())
	if term.IsTerminal(fd) {
		fmt.Print("Enter password: ")
		password, err := term.ReadPassword(fd)
		if err != nil {
			fmt.Fprintf(os.Stderr, "Failed to read password: %v\n", err)
			os.Exit(1)
		}
		fmt.Println()
		fmt.Printf("Password entered (%d bytes)\n", len(password))
	} else {
		_, err := term.ReadPassword(fd)
		if err != nil {
			fmt.Printf("Non-terminal descriptor returned expected error: %v\n", err)
		}
	}
}

{
  "schemaVersion": 1,
  "goal": "verify term.ReadPassword in pkg:golang/golang.org/x/term@v0.0.0-20210927222741-03fcf44c2211",
  "kind": "HOW",
  "packages": [
    "pkg:golang/golang.org/x/term@v0.0.0-20210927222741-03fcf44c2211"
  ],
  "symbols": [
    "term.ReadPassword"
  ]
}

package main

import (
	"bytes"
	"fmt"
	"os"
	"syscall"
	"unsafe"

	"golang.org/x/term"
)

func openPty() (*os.File, *os.File, error) {
	ptmx, err := os.OpenFile("/dev/ptmx", os.O_RDWR|syscall.O_NOCTTY, 0)
	if err != nil {
		return nil, nil, fmt.Errorf("open /dev/ptmx: %w", err)
	}

	var unlock int = 0
	if _, _, errno := syscall.Syscall(syscall.SYS_IOCTL, ptmx.Fd(), syscall.TIOCSPTLCK, uintptr(unsafe.Pointer(&unlock))); errno != 0 {
		ptmx.Close()
		return nil, nil, fmt.Errorf("ioctl TIOCSPTLCK: %w", errno)
	}

	var ptn uint32 = 0
	if _, _, errno := syscall.Syscall(syscall.SYS_IOCTL, ptmx.Fd(), syscall.TIOCGPTN, uintptr(unsafe.Pointer(&ptn))); errno != 0 {
		ptmx.Close()
		return nil, nil, fmt.Errorf("ioctl TIOCGPTN: %w", errno)
	}

	ptsName := fmt.Sprintf("/dev/pts/%d", ptn)
	pts, err := os.OpenFile(ptsName, os.O_RDWR|syscall.O_NOCTTY, 0)
	if err != nil {
		ptmx.Close()
		return nil, nil, fmt.Errorf("open pts %s: %w", ptsName, err)
	}

	return ptmx, pts, nil
}

func main() {
	// Assertion 1: term.ReadPassword returns an error for negative or invalid file descriptors
	if pass, err := term.ReadPassword(-1); err == nil {
		fmt.Fprintf(os.Stderr, "FAIL: term.ReadPassword(-1) succeeded unexpectedly: %q\n", pass)
		os.Exit(1)
	}

	// Assertion 2: term.ReadPassword returns an error for pipe file descriptors
	r, w, err := os.Pipe()
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: os.Pipe failed: %v\n", err)
		os.Exit(1)
	}
	defer r.Close()
	defer w.Close()

	if pass, err := term.ReadPassword(int(r.Fd())); err == nil {
		fmt.Fprintf(os.Stderr, "FAIL: term.ReadPassword on pipe reader succeeded unexpectedly: %q\n", pass)
		os.Exit(1)
	}
	if pass, err := term.ReadPassword(int(w.Fd())); err == nil {
		fmt.Fprintf(os.Stderr, "FAIL: term.ReadPassword on pipe writer succeeded unexpectedly: %q\n", pass)
		os.Exit(1)
	}

	// Assertion 3: term.ReadPassword returns an error for regular file descriptors
	tmpFile, err := os.CreateTemp("", "term-readpassword-test-*")
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: os.CreateTemp failed: %v\n", err)
		os.Exit(1)
	}
	defer os.Remove(tmpFile.Name())
	defer tmpFile.Close()

	if pass, err := term.ReadPassword(int(tmpFile.Fd())); err == nil {
		fmt.Fprintf(os.Stderr, "FAIL: term.ReadPassword on regular file succeeded unexpectedly: %q\n", pass)
		os.Exit(1)
	}

	// Assertion 4: term.ReadPassword returns an error for /dev/null device descriptors
	devNull, err := os.Open(os.DevNull)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: open /dev/null failed: %v\n", err)
		os.Exit(1)
	}
	defer devNull.Close()

	if pass, err := term.ReadPassword(int(devNull.Fd())); err == nil {
		fmt.Fprintf(os.Stderr, "FAIL: term.ReadPassword on /dev/null succeeded unexpectedly: %q\n", pass)
		os.Exit(1)
	}

	// Assertion 5: term.ReadPassword reads password input from a terminal without echoing
	ptmx, pts, err := openPty()
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: openPty failed: %v\n", err)
		os.Exit(1)
	}
	defer ptmx.Close()
	defer pts.Close()

	expectedPassword := []byte("super-secret-password-123")
	
	// Write newline terminated password to the master side of pty
	go func() {
		_, _ = ptmx.Write(append(expectedPassword, '\n'))
	}()

	pass, err := term.ReadPassword(int(pts.Fd()))
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: term.ReadPassword on pty slave failed: %v\n", err)
		os.Exit(1)
	}

	if !bytes.Equal(pass, expectedPassword) {
		fmt.Fprintf(os.Stderr, "FAIL: term.ReadPassword returned %q, expected %q\n", pass, expectedPassword)
		os.Exit(1)
	}

	fmt.Println("PASS: golang.org/x/term term.ReadPassword contract passed")
}