v0.31.2

src/auth/files.rs

@@ -1,7 +1,7 @@
 //! Local filesystem authority. The process owner can initialize or recover the sole admin.
 use anyhow::{ensure, Context, Result};
 use fs2::FileExt;
-use rand::{rngs::OsRng, RngCore};
+use rand::{rngs::SysRng, TryRng};
 use std::{
     fs::{self, File, OpenOptions},
     io::Write,
@@ -86,7 +86,9 @@ pub fn load_or_create_setup_token(dir: &Path) -> Result<String> {
         return load_setup_token(dir);
     }
     let mut bytes = [0u8; 32];
-    OsRng.fill_bytes(&mut bytes);
+    SysRng
+        .try_fill_bytes(&mut bytes)
+        .expect("secure operating system random source unavailable");
     let token: String = bytes.iter().map(|b| format!("{b:02x}")).collect();
     let mut file = match private_options().create_new(true).open(&path) {
         Ok(file) => file,

src/auth/mod.rs

@@ -5,7 +5,7 @@ mod store;
 use crate::{db::Store, runtime::ApiError};
 use anyhow::{ensure, Context, Result};
 use argon2::{
-    password_hash::{PasswordHash, PasswordHasher, PasswordVerifier, SaltString},
+    password_hash::{phc::PasswordHash, PasswordHasher, PasswordVerifier},
     Algorithm, Argon2, Params, Version,
 };
 pub use files::{
@@ -13,7 +13,7 @@ pub use files::{
     prepare_directory, try_lock_directory,
 };
 use http::{header::COOKIE, HeaderMap, StatusCode};
-use rand::{rngs::OsRng, RngCore};
+use rand::{rngs::SysRng, TryRng};
 use sha2::{Digest, Sha256};
 use std::{
     path::PathBuf,
@@ -56,7 +56,9 @@ pub fn now() -> i64 {
 }
 pub fn random_secret() -> String {
     let mut bytes = [0_u8; 32];
-    OsRng.fill_bytes(&mut bytes);
+    SysRng
+        .try_fill_bytes(&mut bytes)
+        .expect("secure operating system random source unavailable");
     bytes.iter().map(|b| format!("{b:02x}")).collect()
 }
 pub fn secret_hash(secret: &str) -> String {
@@ -118,17 +120,15 @@ pub fn validate_password(value: &str) -> Result<()> {
 }
 pub(crate) fn hash_sync(password: &str) -> Result<String> {
     let params = Params::new(19_456, 2, 1, None).context("Argon2 parameters")?;
-    let salt = SaltString::generate(&mut OsRng);
     Ok(Argon2::new(Algorithm::Argon2id, Version::V0x13, params)
-        .hash_password(password.as_bytes(), &salt)?
+        .hash_password(password.as_bytes())?
         .to_string())
 }
 fn verify_sync(password: &str, encoded: &str) -> bool {
-    PasswordHash::new(encoded).ok().is_some_and(|hash| {
-        Argon2::default()
-            .verify_password(password.as_bytes(), &hash)
+    PasswordHash::new(encoded).is_ok()
+        && Argon2::default()
+            .verify_password(password.as_bytes(), encoded)
             .is_ok()
-    })
 }
 pub async fn hash_password_offline(password: String) -> Result<String> {
     validate_password(&password)?;