Add a section about working with Random in native #26843
Conversation
| @@ -330,6 +330,17 @@ and in the case of using the Maven configuration instead of `application.propert | |||
| ---- | |||
| ==== | |||
|
|
|||
| === Working with Random and SplittableRandom | |||
|
|
|||
| If your native application is initialized at build time and has static `java.util.Random` or `java.util.SplittableRandom` instances then its native build will fail because embedding such instances in native image will result in the same cached seed value be reused which will negatively affect the entropy (randomness) quality of the produced values. | |||
There was a problem hiding this comment.
I think this is highly confusing: If your native application is initialized at build time.
You don't have the option in Quarkus to initialize "your application" at build time or runtime.
There was a problem hiding this comment.
@gsmet Sure, this is a general point I've tried to convey from the tutorial.
So, may be just If your native application has static ..., omitting is initialized at build time, please suggest an update. Or If some classes in your native application have static ..., etc, of whatever you prefer, I don't mind :-)
| There is a number of techniques that can be used to have static `Random` and `SplittableRandom` instances securely used in native images: | ||
| * Do the runtime initialization instead of the build-time initialization | ||
| * Keep the build-time initialization but request a runtime re-inititalization of the affected classes | ||
| * Substitute instances of `Random` and `SplittableRandom` with `null` |
There was a problem hiding this comment.
How is it a workable option? The chances that they are not actually used are extremely narrow.
There was a problem hiding this comment.
@gsmet For example, there were Random instances used from a test algorithm code in BC FIPS case, https://github.com/quarkusio/quarkus/blob/main/extensions/security/runtime/src/main/java/io/quarkus/security/runtime/graal/BouncyCastleSubstitutions.java#L24, cases like that...
There was a problem hiding this comment.
and also for the 1st option, expand a bit, Do the runtime initialization of the affected classes, and the same for the 2nd option
I agree. I will wait for a new version or @gsmet's proposal to review. Thanks for the PR @sberyozkin. |
|
Np, lets tune it to make it technically precise |
|
Superseded by #27106 . |
quarkus-bot
bot
added
triage/invalid
Fixes #26835