[deckhouse-cli] Add d8 tools htpasswd (self-contained Apache htpasswd analog) + d8 mirror bundle-layout docs

[ldmonster]

Summary

A new d8 tools htpasswd command (registered in internal/tools/tools.go) that reimplements Apache htpasswd in pure Go.

Algorithms

Flag	Scheme	Notes
-B	bcrypt ($2y$)	Secure. The default (cost 10).
-m	Apache MD5 / apr1 ($apr1$)	Legacy htpasswd default.
-2	SHA-256 crypt ($5$)	Secure. d8 extension.
-5	SHA-512 crypt ($6$)	Secure. d8 extension.
-d	CRYPT / DES	Insecure (first 8 chars only).
-s	SHA-1 ({SHA})	Insecure (unsalted).
-p	plaintext	Insecure.

Each crypt-family algorithm is implemented from the canonical spec (PHK md5crypt, Drepper SHA-crypt, traditional DES crypt(3) with the 12-bit salt twist) and the shared crypt64 alphabet. bcrypt uses golang.org/x/crypto/bcrypt, rewritten to the $2y$ identifier Apache emits for byte-level parity.

CLI surface

Full Apache htpasswd flag surface, including shorthand bundling (-nbB, -BinC 10 ""): -c -n -b -i -m -B -d -s -p -D -v -C. d8 adds three extensions Apache htpasswd does not have: the SHA-crypt algorithms -2/-5 and the -r (rounds) flag.

Operations: add/update, -D delete, -v verify, and -n print-to-stdout. Password files are written atomically (temp file + rename) so a crash mid-write can never leave a truncated file; other users, comments and blank lines are preserved verbatim on update.

Intentional differences from Apache htpasswd

• Default algorithm/cost: Apache defaults to apr1-MD5 (bcrypt cost 5 for -B); d8 defaults to bcrypt at cost 10, so the output is strong and directly usable by d8 iam user create / d8 iam user reset-password --password-hash.
• Bare-hash extension: with -n and no username, d8 prints just the hash (Apache always requires a username and prints username:hash), which is exactly what --password-hash consumes. An explicit empty username (-n "") still prints :hash, matching Apache.
• bcrypt cost range: d8 accepts -C 4–31 (Apache caps at 17); the wider range still produces standard, interoperable bcrypt hashes.
• Exit codes: d8 mirrors Apache htpasswd's exit codes — 2 usage/syntax, 3 verification failure, 5 over-long username, 6 bad/absent user, 1 file-access errors.

Parity verification

Algorithm outputs were cross-checked byte-for-byte against reference implementations:

• Apache httpd htpasswd 2.4.58 (apache2-utils)
• OpenSSL 3.0.13 (openssl passwd -apr1/-1/-5/-6)
• libxcrypt 4.4.36 (python3 crypt, C crypt(3))
• Python 3.12.3 crypt
• Perl crypt (DES)

Verified byte-identical for DES, $1$, $apr1$, $5$ and $6$ across a broad vector set, including edge cases (empty password, the DES 8-byte boundary, salt truncation at 8/16, SHA default-vs-explicit rounds=, rounds clamping, and the SHA-256 vs SHA-512 output permutations). Documented, benign divergences: crypt(3) treats the password as NUL-terminated while the Go port keeps bytes past an embedded 0x00 (unreachable via CLI argv/stdin); and out-of-range SHA rounds are clamped (per Drepper/classic glibc) rather than rejected.