Loading resty.saml replaces the host's random seed with time + pid

What

resty.saml calls uuid.seed() when it is loaded (lua/resty/saml.lua:3). With no argument, resty.jit-uuid seeds from ngx.time() + ngx.worker.pid() and passes that to math.randomseed.

LuaJIT keeps one math.random state per process, so this replaces whatever the host seeded, for every math.random user in that worker, not only this library.

APISIX shows the effect. http_init_worker seeds each worker from /dev/urandom (apisix/init.lua, core.utils.get_seed_from_urandom), then loads plugins (plugin.init_worker()). Requiring saml-auth loads resty.saml, which re-seeds the worker with time + pid for the rest of its life. Any gateway with saml-auth enabled ends up with a weaker seed than it started with.

Why it matters

• Workers seeded in the same second with the same pid share a sequence. Container replicas usually have identical worker pids, so replicas started together (a rolling deploy) produce the same values: identical AuthnRequest IDs and RelayState values here, and identical UUIDs from every other jit-uuid user in the host (APISIX's request-id, for one).
• Seeds also collide across pids: pid p at second t equals pid p + 1 at second t - 1.
• The seed space is the start second times the pid range, so the values are guessable from a deploy time and a small pid range.

This has been the behaviour since before 0.2.6.

What to do

Keep seeding at load, so hosts that never seed stay covered, but seed from a strong source, e.g. read a number from /dev/urandom and pass it to uuid.seed(seed), with the current time + pid value only as the fallback when that read fails.

Two alternatives, both worse:

• Drop the load-time seed and leave it to the host. A host that never seeds is then left on LuaJIT's fixed default seed, so every worker produces the same sequence.
• Re-seed in each host after plugins load. It works around the library in every embedder and misses plugins loaded later, for example through a plugin syncer.

A regression test can start two workers from a forced identical time + pid and assert their first generate_v4() values differ.