letsencrypt / letsencrypt/boulder
go1.26: remove crypto/rand.Reader argument from all keygen and signing calls
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 5.8k
- Forks
- 649
- Avg merge
- 3d 23h
- Merged PRs (30d)
- 24
Description
As of go1.26, all the cryptography functions that we use will ignore their rand.Reader argument and use a secure internal source of randomness instead. We always just pass the default global rand.Reader, so we should be able to replace that with nil at all callsites.
Read more: https://github.com/golang/go/issues/70942, https://antonz.org/go-1-26/#crypto-reader
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with a repository-wide search for crypto/rand.Reader in key-generation and signing calls, then inspect each caller and the relevant Go crypto API. Replace the default reader arguments at all applicable callsites and run the affected package tests, followed by the repository test suite, to confirm everything builds and passes.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- security
- Issue type
- Refactor
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100