Merge pull request #296 from tonistiigi/seed-fix

cmd: seed math rand

cmd/buildx/main.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"os"
 
+	"github.com/containerd/containerd/pkg/seed"
 	"github.com/docker/buildx/commands"
 	"github.com/docker/buildx/version"
 	"github.com/docker/cli/cli-plugins/manager"
@@ -24,6 +25,10 @@ import (
 
 var experimental string
 
+func init() {
+	seed.WithTimeAndRand()
+}
+
 func main() {
 	if os.Getenv("DOCKER_CLI_PLUGIN_ORIGINAL_CLI_COMMAND") == "" {
 		if len(os.Args) < 2 || os.Args[1] != manager.MetadataSubcommandName {

vendor/github.com/containerd/containerd/pkg/seed/seed.go

@@ -0,0 +1,38 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package seed
+
+import (
+	"math/rand"
+	"time"
+)
+
+// WithTimeAndRand seeds the global math rand generator with nanoseconds
+// XOR'ed with a crypto component if available for uniqueness.
+func WithTimeAndRand() {
+	var (
+		b [4]byte
+		u int64
+	)
+
+	tryReadRandom(b[:])
+
+	// Set higher 32 bits, bottom 32 will be set with nanos
+	u |= (int64(b[0]) << 56) | (int64(b[1]) << 48) | (int64(b[2]) << 40) | (int64(b[3]) << 32)
+
+	rand.Seed(u ^ time.Now().UnixNano())
+}

vendor/github.com/containerd/containerd/pkg/seed/seed_linux.go

@@ -0,0 +1,24 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package seed
+
+import "golang.org/x/sys/unix"
+
+func tryReadRandom(p []byte) {
+	// Ignore errors, just decreases uniqueness of seed
+	unix.Getrandom(p, unix.GRND_NONBLOCK)
+}

vendor/github.com/containerd/containerd/pkg/seed/seed_other.go

@@ -0,0 +1,28 @@
+// +build !linux
+
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package seed
+
+import (
+	"crypto/rand"
+	"io"
+)
+
+func tryReadRandom(p []byte) {
+	io.ReadFull(rand.Reader, p)
+}

vendor/modules.txt

@@ -49,6 +49,7 @@ github.com/containerd/containerd/filters
 github.com/containerd/containerd/images
 github.com/containerd/containerd/labels
 github.com/containerd/containerd/log
+github.com/containerd/containerd/pkg/seed
 github.com/containerd/containerd/platforms
 github.com/containerd/containerd/reference
 github.com/containerd/containerd/remotes