common: seed deterministic RNG from basename of argv0, not full path
What the developer wrote
Authored by ShahanaFarooqui
common: seed deterministic RNG from basename of argv0, not full path
dev_override_randbytes() hashes argv0 into the CLN_DEV_ENTROPY_SEED
stream, so every plugin and subdaemon gets a distinct seed. But
lightningd execs them with absolute paths, so the "deterministic"
stream silently depended on where the source tree was checked out:
canned blocks generated in one directory would not replay in another
(funding tx output order and nlocktime fuzz diverge, so txids change).
This is why check-doc-examples passed locally but failed in CI.
Hash only the basename: binaries still get distinct seeds, but the
stream no longer depends on the checkout path.
What changed, and why it matters
This change fixes a test-flakiness bug in a developer-only random-number override used during testing. It makes the random stream depend only on the program name, not the full file path, so tests produce the same results on different computers. It is not a security vulnerability fix.
No security action required; treat as normal code/test reliability fix.
Security signals we found
No security-relevant signal: change is in a developer override for deterministic testing RNG
No memory safety, authentication, authorization, or cryptographic weakness introduced
No incident or vulnerability disclosure referenced
Evidence from the diff
The commit modifies dev_override_randbytes() in common/randbytes.c. Previously the deterministic RNG seed was derived by hashing the full argv0 path, which caused divergence when binaries were invoked via absolute paths in different checkout directories. The patch uses strrchr to hash only the basename. This affects only the CLN_DEV_ENTROPY_SEED developer/testing path and does not change production randomness behavior.
Changed components
common/randbytes.cCLN_DEV_ENTROPY_SEED developer/testing pathInspect captured patch +11 / −2
diff --git a/common/randbytes.c b/common/randbytes.c
index d78b520..277034c 100644
--- a/common/randbytes.c
+++ b/common/randbytes.c
@@ -9,6 +9,7 @@
#include <common/utils.h>
#include <sodium/randombytes.h>
#include <stdlib.h>
+#include <string.h>
#include <unistd.h>
static bool used = false;
@@ -48,15 +49,23 @@ void randbytes_(void *bytes, size_t num_bytes, u64 *offset)
}
/* We want different seeds for each plugin (hence argv0), and for each
- * lightmingd instance, (hence seed from environment) */
+ * lightningd instance, (hence seed from environment) */
void dev_override_randbytes(const char *argv0, long int seed)
{
struct siphash_seed hashseed;
+ const char *base;
assert(!used);
+ /* Hash only the basename: binaries still get distinct seeds, but
+ * the stream no longer depends on the checkout path. Plugins and
+ * subdaemons are exec'd with absolute paths: hash only the basename,
+ * so the stream doesn't depend on where the source tree lives */
+ base = strrchr(argv0, '/');
+ base = base ? base + 1 : argv0;
+
hashseed.u.u64[0] = seed;
hashseed.u.u64[1] = 0;
- dev_seed = siphash24(&hashseed, argv0, strlen(argv0));
+ dev_seed = siphash24(&hashseed, base, strlen(base));
assert(randbytes_overridden());
}
Why this scored 19/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.