composer: seed the random number generator

I thought rand in Go is auto-seeded but I was wrong, see [1]. This commit adds seed initialization. [1]: https://golang.org/pkg/math/rand/#Seed Signed-off-by: Ondřej Budai <[email protected]>
osbuild · Dec 15, 2020 · 1dd4eb7 · 1dd4eb7
1 parent 973639d
commit 1dd4eb7
Show file tree

Hide file tree

Showing 3 changed files with 27 additions and 6 deletions.
diff --git a/internal/cloudapi/server.go b/internal/cloudapi/server.go
@@ -3,9 +3,11 @@
 package cloudapi
 
 import (
+	"crypto/rand"
 	"encoding/json"
 	"fmt"
-	"math/rand"
+	"math"
+	"math/big"
 	"net/http"
 
 	"github.com/go-chi/chi"
@@ -83,7 +85,11 @@ func (server *Server) Compose(w http.ResponseWriter, r *http.Request) {
 	var targets []*target.Target
 
 	// use the same seed for all images so we get the same IDs
-	manifestSeed := rand.Int63()
+	bigSeed, err := rand.Int(rand.Reader, big.NewInt(math.MaxInt64))
+	if err != nil {
+		panic("cannot generate a manifest seed: " + err.Error())
+	}
+	manifestSeed := bigSeed.Int64()
 
 	for i, ir := range request.ImageRequests {
 		arch, err := distribution.GetArch(ir.Architecture)

diff --git a/internal/kojiapi/server.go b/internal/kojiapi/server.go
@@ -2,10 +2,12 @@
 package kojiapi
 
 import (
+	"crypto/rand"
 	"encoding/json"
 	"fmt"
 	"log"
-	"math/rand"
+	"math"
+	"math/big"
 	"net/http"
 	"strings"
 	"time"
@@ -89,7 +91,11 @@ func (h *apiHandlers) PostCompose(ctx echo.Context) error {
 	kojiDirectory := "osbuild-composer-koji-" + uuid.New().String()
 
 	// use the same seed for all images so we get the same IDs
-	manifestSeed := rand.Int63()
+	bigSeed, err := rand.Int(rand.Reader, big.NewInt(math.MaxInt64))
+	if err != nil {
+		panic("cannot generate a manifest seed: " + err.Error())
+	}
+	manifestSeed := bigSeed.Int64()
 
 	for i, ir := range request.ImageRequests {
 		arch, err := d.GetArch(ir.Architecture)

diff --git a/internal/weldr/api.go b/internal/weldr/api.go
@@ -3,12 +3,14 @@ package weldr
 import (
 	"archive/tar"
 	"bytes"
+	"crypto/rand"
 	"encoding/json"
 	errors_package "errors"
 	"fmt"
 	"io"
 	"log"
-	"math/rand"
+	"math"
+	"math/big"
 	"net"
 	"net/http"
 	"net/url"
@@ -1837,6 +1839,13 @@ func (api *API) composeHandler(writer http.ResponseWriter, request *http.Request
 	}
 
 	size := imageType.Size(cr.Size)
+
+	bigSeed, err := rand.Int(rand.Reader, big.NewInt(math.MaxInt64))
+	if err != nil {
+		panic("cannot generate a manifest seed: " + err.Error())
+	}
+	seed := bigSeed.Int64()
+
 	manifest, err := imageType.Manifest(bp.Customizations,
 		distro.ImageOptions{
 			Size: size,
@@ -1848,7 +1857,7 @@ func (api *API) composeHandler(writer http.ResponseWriter, request *http.Request
 		api.allRepositories(),
 		packages,
 		buildPackages,
-		rand.Int63())
+		seed)
 	if err != nil {
 		errors := responseError{
 			ID:  "ManifestCreationFailed",