From 32ceb27d77ec98a0eb260246473bedd5773b2cc3 Mon Sep 17 00:00:00 2001
From: CleverWild <cleverwilddev@gmail.com>
Date: Thu, 18 Jun 2026 19:30:31 +0200
Subject: [PATCH] security(server): use SysRng directly for bootstrap token
 generation

Replace make_rng()/StdRng with UnwrapErr(SysRng) to eliminate the PRNG
intermediate layer and make OS entropy derivation explicit and unambiguous.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 server/Cargo.lock                                    | 1 +
 server/Cargo.toml                                    | 1 +
 server/crates/arbiter-server/Cargo.toml              | 1 +
 server/crates/arbiter-server/src/actors/bootstrap.rs | 7 +++----
 4 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/server/Cargo.lock b/server/Cargo.lock
index c1be6e9..01adb3e 100644
--- a/server/Cargo.lock
+++ b/server/Cargo.lock
@@ -771,6 +771,7 @@ dependencies = [
  "proptest",
  "prost-types",
  "rand 0.10.1",
+ "rand_core 0.10.1",
  "rcgen",
  "restructed",
  "rstest",
diff --git a/server/Cargo.toml b/server/Cargo.toml
index cd588a8..ab81ee3 100644
--- a/server/Cargo.toml
+++ b/server/Cargo.toml
@@ -21,6 +21,7 @@ mutants = "0.0.4"
 prost = "0.14.3"
 prost-types = { version = "0.14.3", features = ["chrono"] }
 rand = "0.10.1"
+rand_core = "0.10.1"
 rcgen = { version = "0.14.7", features = [ "aws_lc_rs",  "pem", "x509-parser", "zeroize" ], default-features = false }
 rstest = "0.26.1"
 rustls = { version = "0.23.40", features = ["aws-lc-rs", "logging", "prefer-post-quantum", "std"], default-features = false }
diff --git a/server/crates/arbiter-server/Cargo.toml b/server/crates/arbiter-server/Cargo.toml
index 6082541..8deee71 100644
--- a/server/crates/arbiter-server/Cargo.toml
+++ b/server/crates/arbiter-server/Cargo.toml
@@ -31,6 +31,7 @@ diesel_migrations = { version = "2.3.2", features = ["sqlite"] }
 async-trait.workspace = true
 tokio-stream.workspace = true
 rand.workspace = true
+rand_core.workspace = true
 rcgen.workspace = true
 chrono.workspace = true
 kameo.workspace = true
diff --git a/server/crates/arbiter-server/src/actors/bootstrap.rs b/server/crates/arbiter-server/src/actors/bootstrap.rs
index 0ed57fa..9fbf119 100644
--- a/server/crates/arbiter-server/src/actors/bootstrap.rs
+++ b/server/crates/arbiter-server/src/actors/bootstrap.rs
@@ -4,7 +4,8 @@ use arbiter_proto::{BOOTSTRAP_PATH, home_path};
 use diesel::QueryDsl;
 use diesel_async::RunQueryDsl;
 use kameo::{Actor, messages};
-use rand::{RngExt, distr::Alphanumeric, make_rng, rngs::StdRng};
+use rand::{RngExt, distr::Alphanumeric, rngs::SysRng};
+use rand_core::UnwrapErr;
 use subtle::ConstantTimeEq as _;
 use thiserror::Error;
 use zeroize::Zeroizing;
@@ -12,9 +13,7 @@ use zeroize::Zeroizing;
 const TOKEN_LENGTH: usize = 64;
 
 pub async fn generate_token() -> Result<String, std::io::Error> {
-    let rng: StdRng = make_rng();
-
-    let token = rng.sample_iter(Alphanumeric).take(TOKEN_LENGTH).fold(
+    let token = UnwrapErr(SysRng).sample_iter(Alphanumeric).take(TOKEN_LENGTH).fold(
         String::default(),
         |mut accum, char| {
             accum += char.to_string().as_str();