Limit ArgoCD password seed to the max length bcrypt allows

[bastjan]

By design, bcrypt only uses the first 72 bytes of a password when
generating a hash. Most implementations, including the reference one,
simply silently ignore any trailing input when provided passwords longer
than 72 bytes. This can cause confusion for users who expect the entire
password to be used to generate the hash.

https://cs.opensource.google/go/x/crypto/+/bc7d1d1eb54b3530da4f5ec31625c95d7df40231

Checklist

• Keep pull requests small so they can be easily reviewed.
• Update the documentation.
• Categorize the PR by setting a good title and adding one of the labels:
  bug, enhancement, documentation, change, breaking, dependency
  as they show up in the changelog

[simu]

Please test this thoroughly, we currently use the base64-encoded Lieutenant JWT which is definitely longer than 72 characters as the password, cf.

steward/pkg/agent/agent.go

Line 99 in bdceddc

if err := argocd.CreateArgoSecret(ctx, config, a.Namespace, a.Token); err != nil {

I'm not sure if we assume that the password will be the full JWT elsewhere.

[bastjan]

I'm not sure if we assume that the password will be the full JWT elsewhere.

The remainder of the password was always ignored:

go.mod

require (
	golang.org/x/crypto v0.15.0
	local.dev/oldcrypto v0.0.0-00010101000000-000000000000
)

replace local.dev/oldcrypto => golang.org/x/crypto v0.0.0-20220525230936-793ad666bf5e

bcrypt_test.go

package testbcrypt_test

import (
	"strings"
	"testing"

	"github.com/stretchr/testify/require"
	"golang.org/x/crypto/bcrypt"
	old "local.dev/oldcrypto/bcrypt"
)

func TestBcrypt(t *testing.T) {
	pw := strings.Repeat("a", 100)
	shortPw := strings.Repeat("a", 72)

	oldEnc, err := old.GenerateFromPassword([]byte(pw), old.DefaultCost)
	require.NoError(t, err)

	enc, err := bcrypt.GenerateFromPassword([]byte(shortPw), bcrypt.DefaultCost)
	require.NoError(t, err)

	require.NoError(t, old.CompareHashAndPassword(enc, []byte(shortPw)))
	require.NoError(t, old.CompareHashAndPassword(enc, []byte(pw)))
	require.NoError(t, old.CompareHashAndPassword(oldEnc, []byte(shortPw)))
	require.NoError(t, old.CompareHashAndPassword(oldEnc, []byte(pw)))
	require.NoError(t, bcrypt.CompareHashAndPassword(enc, []byte(shortPw)))
	require.NoError(t, bcrypt.CompareHashAndPassword(enc, []byte(pw)))
	require.NoError(t, bcrypt.CompareHashAndPassword(oldEnc, []byte(shortPw)))
	require.NoError(t, bcrypt.CompareHashAndPassword(oldEnc, []byte(pw)))
}