hammer-editor

mirror of https://github.com/Darkrock-Studios/hammer-editor.git synced 2026-08-26 18:01:44 +00:00

History

Adam Brown a0c44273b1 Address review: confine blocking RNG to key minting, fix sync-id race Three follow-ups from review of the previous commit. Keyring generation goes back to a blocking generator, now named keyMintingSecureRandom(). On the pre-5.6 kernels this PR targets /dev/urandom returns output from an uninitialized pool with no error, so a freshly provisioned host could mint both master keys from unseeded entropy. Blocking is correct for a key that outlives every session, and it cannot stall a request: .generate()/.rotate() are reachable only from one-shot CLI subcommands, and KeyringManager never writes key material. Pin NativePRNGNonBlocking for the request path instead of trusting provider order, which yields NativePRNG on Linux but DRBG on Windows, and on Linux DRBG seeds from /dev/random and blocks the same way. RandomString shared one CharArray field across every caller, so concurrent begin_sync requests interleaved writes and read back each other's characters. 2000 concurrent callers produced 1999 distinct sync ids, with visible shared substrings between them.	2026-08-16 12:17:10 -07:00
..
src	Address review: confine blocking RNG to key minting, fix sync-id race	2026-08-16 12:17:10 -07:00
build.gradle.kts	Replace the native Argon2 binding with a pure-JVM implementation (#908 )	2026-08-16 00:26:01 -07:00

Adam Brown a0c44273b1 Address review: confine blocking RNG to key minting, fix sync-id race

Three follow-ups from review of the previous commit.

Keyring generation goes back to a blocking generator, now named
keyMintingSecureRandom(). On the pre-5.6 kernels this PR targets
/dev/urandom returns output from an uninitialized pool with no error, so
a freshly provisioned host could mint both master keys from unseeded
entropy. Blocking is correct for a key that outlives every session, and
it cannot stall a request: .generate()/.rotate() are reachable only from
one-shot CLI subcommands, and KeyringManager never writes key material.

Pin NativePRNGNonBlocking for the request path instead of trusting
provider order, which yields NativePRNG on Linux but DRBG on Windows, and
on Linux DRBG seeds from /dev/random and blocks the same way.

RandomString shared one CharArray field across every caller, so
concurrent begin_sync requests interleaved writes and read back each
other's characters. 2000 concurrent callers produced 1999 distinct sync
ids, with visible shared substrings between them.

2026-08-16 12:17:10 -07:00

src

Address review: confine blocking RNG to key minting, fix sync-id race

2026-08-16 12:17:10 -07:00

build.gradle.kts

Replace the native Argon2 binding with a pure-JVM implementation (#908 )

2026-08-16 00:26:01 -07:00