From b6570aabaa8b7b61dc4aa84dddac3e84ea792a00 Mon Sep 17 00:00:00 2001 From: Nicolas CHAUVIN Date: Tue, 11 Aug 2026 10:37:03 +0200 Subject: [PATCH] chore(deps): replace rand with getrandom for OS entropy --- Cargo.lock | 6 +++--- Cargo.toml | 2 +- client/Cargo.toml | 2 +- client/src/remote.rs | 4 +--- core/Cargo.toml | 2 +- core/src/crypto.rs | 6 ++---- core/src/model.rs | 6 ++---- core/tests/e2e_sync.rs | 4 +--- relay/Cargo.toml | 2 +- relay/src/storage.rs | 4 +--- relay/src/ws.rs | 4 +--- relay/tests/integration.rs | 4 +--- 12 files changed, 16 insertions(+), 30 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index b5be53e..8de6828 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1842,10 +1842,10 @@ dependencies = [ "chacha20poly1305", "ed25519-dalek", "futures-util", + "getrandom 0.4.3", "hex", "note-protocol", "note-relay", - "rand 0.8.7", "serde", "serde_json", "sha2 0.10.9", @@ -1872,9 +1872,9 @@ dependencies = [ "base64 0.23.0", "ed25519-dalek", "futures-util", + "getrandom 0.4.3", "hex", "note-protocol", - "rand 0.8.7", "rusqlite", "serde", "serde_json", @@ -2043,12 +2043,12 @@ dependencies = [ "base64 0.23.0", "ed25519-dalek", "fs2", + "getrandom 0.4.3", "hex", "note-core", "note-protocol", "note-relay", "notify", - "rand 0.8.7", "reqwest", "serde", "serde_json", diff --git a/Cargo.toml b/Cargo.toml index 1cfdd6f..31ef68f 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -52,5 +52,5 @@ uniffi = "0.28" chacha20poly1305 = { version = "0.10", features = ["std"] } argon2 = "0.5" ed25519-dalek = "3" -rand = "0.8" +getrandom = "0.4" zeroize = { version = "1", features = ["derive"] } diff --git a/client/Cargo.toml b/client/Cargo.toml index 4b3d488..84c3d85 100644 --- a/client/Cargo.toml +++ b/client/Cargo.toml @@ -18,7 +18,7 @@ serde_json.workspace = true base64.workspace = true hex.workspace = true ed25519-dalek.workspace = true -rand.workspace = true +getrandom.workspace = true fs2 = "0.4" notify = "6" diff --git a/client/src/remote.rs b/client/src/remote.rs index 8b57ec9..0cf6d0c 100644 --- a/client/src/remote.rs +++ b/client/src/remote.rs @@ -14,15 +14,13 @@ use note_protocol::{ CreateGroupResponse, CreateInviteRequest, CreateInviteResponse, DeviceListResponse, EnrollRequest, EnrollResponse, }; -use rand::RngCore; -use rand::rngs::OsRng; use crate::config::{PairingBlob, Settings, decode_blob, encode_blob, encode_key}; use crate::store::{LocalStore, resolve_id}; fn new_signing_key() -> ([u8; 32], SigningKey) { let mut seed = [0u8; 32]; - OsRng.fill_bytes(&mut seed); + getrandom::fill(&mut seed).expect("OS RNG unavailable"); let sk = SigningKey::from_bytes(&seed); (seed, sk) } diff --git a/core/Cargo.toml b/core/Cargo.toml index 38a48c7..7639179 100644 --- a/core/Cargo.toml +++ b/core/Cargo.toml @@ -17,7 +17,7 @@ chacha20poly1305.workspace = true sha2 = "0.10" argon2.workspace = true ed25519-dalek.workspace = true -rand.workspace = true +getrandom.workspace = true zeroize.workspace = true tokio.workspace = true tokio-tungstenite.workspace = true diff --git a/core/src/crypto.rs b/core/src/crypto.rs index 9a18f82..0b6e981 100644 --- a/core/src/crypto.rs +++ b/core/src/crypto.rs @@ -13,8 +13,6 @@ use chacha20poly1305::aead::{Aead, Payload}; use chacha20poly1305::{KeyInit, XChaCha20Poly1305, XNonce}; -use rand::RngCore; -use rand::rngs::OsRng; use sha2::{Digest, Sha256}; use zeroize::{Zeroize, ZeroizeOnDrop}; @@ -82,7 +80,7 @@ impl GroupKey { /// Generate a fresh random group key from the OS CSPRNG. pub fn generate() -> Self { let mut bytes = [0u8; KEY_LEN]; - OsRng.fill_bytes(&mut bytes); + getrandom::fill(&mut bytes).expect("OS RNG unavailable"); Self(bytes) } @@ -104,7 +102,7 @@ impl GroupKey { /// Seal `plaintext` into an envelope: `version || nonce || ciphertext`. pub fn seal(key: &GroupKey, aad: Aad, plaintext: &[u8]) -> Vec { let mut nonce = [0u8; NONCE_LEN]; - OsRng.fill_bytes(&mut nonce); + getrandom::fill(&mut nonce).expect("OS RNG unavailable"); let aad_bytes = aad.to_bytes(); let ciphertext = key diff --git a/core/src/model.rs b/core/src/model.rs index a1506c3..485f34e 100644 --- a/core/src/model.rs +++ b/core/src/model.rs @@ -33,8 +33,6 @@ use automerge::transaction::{CommitOptions, Transactable}; use automerge::{ AutoCommit, AutomergeError, Change, ChangeHash, ObjId, ObjType, ROOT, ReadDoc, Value, }; -use rand::RngCore; -use rand::rngs::OsRng; use std::collections::{HashMap, HashSet}; /// Unix milliseconds. Supplied by the caller; the model never reads a clock. @@ -88,7 +86,7 @@ pub struct NoteId(String); impl NoteId { pub fn generate() -> Self { let mut bytes = [0u8; 16]; - OsRng.fill_bytes(&mut bytes); + getrandom::fill(&mut bytes).expect("OS RNG unavailable"); let mut s = String::with_capacity(32); for b in bytes { s.push_str(&format!("{b:02x}")); @@ -115,7 +113,7 @@ pub struct FolderId(String); impl FolderId { pub fn generate() -> Self { let mut bytes = [0u8; 16]; - OsRng.fill_bytes(&mut bytes); + getrandom::fill(&mut bytes).expect("OS RNG unavailable"); let mut s = String::with_capacity(32); for b in bytes { s.push_str(&format!("{b:02x}")); diff --git a/core/tests/e2e_sync.rs b/core/tests/e2e_sync.rs index d94bde1..f3a5231 100644 --- a/core/tests/e2e_sync.rs +++ b/core/tests/e2e_sync.rs @@ -7,12 +7,10 @@ use ed25519_dalek::SigningKey; use note_core::{GroupKey, NoteStore, SyncConfig, sync_once}; use note_relay::state::AppState; use note_relay::storage::{InMemoryStorage, Storage}; -use rand::RngCore; -use rand::rngs::OsRng; fn signing_key() -> SigningKey { let mut seed = [0u8; 32]; - OsRng.fill_bytes(&mut seed); + getrandom::fill(&mut seed).expect("OS RNG unavailable"); SigningKey::from_bytes(&seed) } diff --git a/relay/Cargo.toml b/relay/Cargo.toml index 2c7cafc..83dfbd1 100644 --- a/relay/Cargo.toml +++ b/relay/Cargo.toml @@ -25,7 +25,7 @@ tracing-subscriber.workspace = true ed25519-dalek.workspace = true base64.workspace = true hex.workspace = true -rand.workspace = true +getrandom.workspace = true sha2 = "0.10" rusqlite = { version = "0.32", features = ["bundled"] } diff --git a/relay/src/storage.rs b/relay/src/storage.rs index 3a27f93..8593da8 100644 --- a/relay/src/storage.rs +++ b/relay/src/storage.rs @@ -10,8 +10,6 @@ use std::collections::{HashMap, HashSet}; use std::sync::Mutex; -use rand::RngCore; -use rand::rngs::OsRng; use rusqlite::{Connection, OptionalExtension, params}; use sha2::{Digest, Sha256}; @@ -84,7 +82,7 @@ pub trait Storage: Send + Sync { fn random_hex(bytes: usize) -> String { let mut buf = vec![0u8; bytes]; - OsRng.fill_bytes(&mut buf); + getrandom::fill(&mut buf).expect("OS RNG unavailable"); hex::encode(buf) } diff --git a/relay/src/ws.rs b/relay/src/ws.rs index e6d2282..296a3b9 100644 --- a/relay/src/ws.rs +++ b/relay/src/ws.rs @@ -16,8 +16,6 @@ use base64::engine::general_purpose::STANDARD as B64; use ed25519_dalek::{Signature, Verifier, VerifyingKey}; use futures_util::{SinkExt, StreamExt}; use note_protocol::{ClientMsg, PROTOCOL_VERSION, ServerMsg}; -use rand::RngCore; -use rand::rngs::OsRng; use tokio::sync::broadcast::error::RecvError; use crate::state::{AppState, Broadcast}; @@ -47,7 +45,7 @@ async fn run_session(mut socket: WebSocket, state: Arc) -> anyhow::Res // 2. Challenge let mut challenge = [0u8; 32]; - OsRng.fill_bytes(&mut challenge); + getrandom::fill(&mut challenge).expect("OS RNG unavailable"); send( &mut socket, ServerMsg::Challenge { diff --git a/relay/tests/integration.rs b/relay/tests/integration.rs index 22d32a0..415f1f2 100644 --- a/relay/tests/integration.rs +++ b/relay/tests/integration.rs @@ -17,8 +17,6 @@ use note_protocol::{ use note_relay::build_app; use note_relay::state::AppState; use note_relay::storage::{InMemoryStorage, SqliteStorage, Storage}; -use rand::RngCore; -use rand::rngs::OsRng; use tokio::net::TcpStream; use tokio_tungstenite::tungstenite::Message; use tokio_tungstenite::{MaybeTlsStream, WebSocketStream, connect_async}; @@ -28,7 +26,7 @@ type Ws = WebSocketStream>; fn signing_key() -> SigningKey { let mut seed = [0u8; 32]; - OsRng.fill_bytes(&mut seed); + getrandom::fill(&mut seed).expect("OS RNG unavailable"); SigningKey::from_bytes(&seed) }