refactor: fix rand read linter violations

.golangci.yml

@@ -573,11 +573,6 @@ issues:
         - dupl
         - gosec
 
-    # TODO: replace rand.Read with crypto/rand.Read
-    - text: 'rand.Read has been deprecated since Go 1.20'
-      linters:
-        - staticcheck
-
 #     CertPool.Subjects() has been deprecated but there is no alternative
 #	 https://github.com/golang/go/issues/46287
     - text: 'SA1019: pool.Subjects has been deprecated since Go 1.18'

registry/datastore/gc_integration_test.go

@@ -3,7 +3,8 @@
 package datastore_test
 
 import (
-	"math/rand"
+	"crypto/rand"
+	mrand "math/rand"
 	"strconv"
 	"testing"
 	"time"
@@ -32,14 +33,14 @@ func randomBlob(t testing.TB) *models.Blob {
 	return &models.Blob{
 		MediaType: "application/octet-stream",
 		Digest:    randomDigest(t),
-		Size:      rand.Int63(),
+		Size:      mrand.Int63(),
 	}
 }
 
 func randomRepository(t testing.TB) *models.Repository {
 	t.Helper()
 
-	n := strconv.Itoa(rand.Int())
+	n := strconv.Itoa(mrand.Int())
 	return &models.Repository{
 		Name: n,
 		Path: n,

registry/handlers/api_gitlab_integration_test.go

@@ -4,10 +4,10 @@ package handlers_test
 
 import (
 	"bytes"
+	"crypto/rand"
 	"encoding/json"
 	"fmt"
 	"io"
-	"math/rand"
 	"net/http"
 	"net/url"
 	"path"

registry/handlers/blobupload_integration_test.go

@@ -3,7 +3,8 @@
 package handlers
 
 import (
-	"math/rand"
+	"crypto/rand"
+	mrand "math/rand"
 	"testing"
 
 	"github.com/docker/distribution"
@@ -28,7 +29,7 @@ func buildRepository(t *testing.T, env *env, path string) *models.Repository {
 func randomDigest(t *testing.T) digest.Digest {
 	t.Helper()
 
-	bytes := make([]byte, rand.Intn(10000))
+	bytes := make([]byte, mrand.Intn(10000))
 	_, err := rand.Read(bytes)
 	require.NoError(t, err)
 
@@ -43,7 +44,7 @@ func buildRandomBlob(t *testing.T, env *env) *models.Blob {
 	b := &models.Blob{
 		MediaType: "application/octet-stream",
 		Digest:    randomDigest(t),
-		Size:      rand.Int63n(10000),
+		Size:      mrand.Int63n(10000),
 	}
 	err := bStore.Create(env.ctx, b)
 	require.NoError(t, err)
@@ -57,7 +58,7 @@ func randomBlobDescriptor(t *testing.T) distribution.Descriptor {
 	return distribution.Descriptor{
 		MediaType: "application/octet-stream",
 		Digest:    randomDigest(t),
-		Size:      rand.Int63n(10000),
+		Size:      mrand.Int63n(10000),
 	}
 }
 

registry/handlers/integration_helpers_test.go

@@ -6,11 +6,12 @@ import (
 	"bytes"
 	"context"
 	"crypto"
+	"crypto/rand"
 	"encoding/base64"
 	"encoding/json"
 	"fmt"
 	"io"
-	"math/rand"
+	mrand "math/rand"
 	"net/http"
 	"net/http/httptest"
 	"net/http/httputil"
@@ -683,7 +684,7 @@ func createRandomSmallLayer() (io.ReadSeeker, digest.Digest, int64) {
 	// small as this will lead to flakes, as there is only one sha for layer
 	// size 0, handfull of shas for layer with size 1, etc... 128-196 bytes
 	// gives enough entropy to make tests reliable.
-	size := 128 + rand.Int63n(64)
+	size := 128 + mrand.Int63n(64)
 	b := make([]byte, size)
 	_, _ = rand.Read(b) // always returns err==nil
 
@@ -859,8 +860,8 @@ func randomPlatformSpec() manifestlist.PlatformSpec {
 	oses := []string{"aix", "darwin", "linux", "freebsd", "plan9"}
 
 	return manifestlist.PlatformSpec{
-		Architecture: architectures[rand.Intn(len(architectures))],
-		OS:           oses[rand.Intn(len(oses))],
+		Architecture: architectures[mrand.Intn(len(architectures))],
+		OS:           oses[mrand.Intn(len(oses))],
 		// Optional values.
 		OSVersion:  "",
 		OSFeatures: nil,
@@ -1057,7 +1058,7 @@ func buildManifestDigestURL(t *testing.T, env *testEnv, repoPath string, targetM
 func shuffledCopy(s []string) []string {
 	shuffled := make([]string, len(s))
 	copy(shuffled, s)
-	rand.Shuffle(len(shuffled), func(i, j int) {
+	mrand.Shuffle(len(shuffled), func(i, j int) {
 		shuffled[i], shuffled[j] = shuffled[j], shuffled[i]
 	})
 

registry/storage/driver/s3-aws/s3_test.go

 package s3
 
 import (
+	"crypto/rand"
 	"fmt"
-	"math/rand"
+	mrand "math/rand"
 	"net/http"
 	"net/url"
 	"os"
@@ -671,7 +672,7 @@ func testDeleteFilesError(t *testing.T, mock s3iface.S3API, numFiles int) (int,
 	// simulate deleting numFiles files
 	paths := make([]string, 0, numFiles)
 	for i := 0; i < numFiles; i++ {
-		paths = append(paths, strconv.Itoa(rand.Int()))
+		paths = append(paths, strconv.Itoa(mrand.Int()))
 	}
 
 	return d.DeleteFiles(context.Background(), paths)

registry/storage/driver/testsuites/testsuites.go

@@ -3,11 +3,12 @@ package testsuites
 import (
 	"bytes"
 	"context"
+	"crypto/rand"
 	"crypto/sha256"
 	"errors"
 	"fmt"
 	"io"
-	"math/rand"
+	mrand "math/rand"
 	"net/http"
 	"os"
 	"path"
@@ -915,7 +916,7 @@ func (s *DriverSuite) TestDeleteFiles() {
 	defer s.deletePath(s.T(), firstPart(parentDir))
 
 	/* #nosec G404 */
-	blobPaths := s.buildFiles(s.T(), parentDir, rand.Intn(10), 32)
+	blobPaths := s.buildFiles(s.T(), parentDir, mrand.Intn(10), 32)
 
 	count, err := s.StorageDriver.DeleteFiles(s.ctx, blobPaths)
 	require.NoError(s.T(), err)
@@ -1273,7 +1274,7 @@ func (s *DriverSuite) TestConcurrentStreamReads() {
 	readContents := func() {
 		defer wg.Done()
 		/* #nosec G404 */
-		offset := rand.Int63n(int64(len(contents)))
+		offset := mrand.Int63n(int64(len(contents)))
 		reader, err := s.StorageDriver.Reader(s.ctx, filename, offset)
 		require.NoError(s.T(), err)
 		defer reader.Close()
@@ -1386,7 +1387,7 @@ func (s *DriverSuite) TestWalkParallel() {
 		}
 
 		/* #nosec G404 */
-		err := s.StorageDriver.PutContent(s.ctx, wantedFiles[i], randomContents(int64(8+rand.Intn(8))))
+		err := s.StorageDriver.PutContent(s.ctx, wantedFiles[i], randomContents(int64(8+mrand.Intn(8))))
 		require.NoError(s.T(), err)
 	}
 
@@ -1454,7 +1455,7 @@ func (s *DriverSuite) TestWalkParallelError() {
 
 	for _, file := range wantedFiles {
 		/* #nosec G404 */
-		err := s.StorageDriver.PutContent(s.ctx, file, randomContents(int64(8+rand.Intn(8))))
+		err := s.StorageDriver.PutContent(s.ctx, file, randomContents(int64(8+mrand.Intn(8))))
 		require.NoError(s.T(), err)
 	}
 
@@ -1507,7 +1508,7 @@ func (s *DriverSuite) TestWalkParallelStopsProcessingOnError() {
 
 	for _, file := range wantedFiles {
 		/* #nosec G404 */
-		err := s.StorageDriver.PutContent(s.ctx, file, randomContents(int64(8+rand.Intn(8))))
+		err := s.StorageDriver.PutContent(s.ctx, file, randomContents(int64(8+mrand.Intn(8))))
 		require.NoError(s.T(), err)
 	}
 
@@ -1706,7 +1707,7 @@ func (s *DriverSuite) benchmarkWalkParallel(b *testing.B, numFiles int, f storag
 
 		for i := 0; i < numFiles; i++ {
 			/* #nosec G404 */
-			err := s.StorageDriver.PutContent(s.ctx, wantedFiles[i], randomContents(int64(8+rand.Intn(8))))
+			err := s.StorageDriver.PutContent(s.ctx, wantedFiles[i], randomContents(int64(8+mrand.Intn(8))))
 			require.NoError(b, err)
 		}
 
@@ -2214,7 +2215,7 @@ func randomPath(minTldLen, length int) string {
 	p := "/"
 	for len(p) < length {
 		/* #nosec G404 */
-		chunkLength := rand.Intn(length-len(p)) + 1
+		chunkLength := mrand.Intn(length-len(p)) + 1
 		if len(p) == 1 && chunkLength < minTldLen {
 			// First component is too short - retry
 			continue
@@ -2236,11 +2237,11 @@ func randomFilename(length int) string {
 	wasSeparator := true
 	for i := range b {
 		/* #nosec G404 */
-		if !wasSeparator && i < len(b)-1 && rand.Intn(4) == 0 {
-			b[i] = separatorChars[rand.Intn(len(separatorChars))]
+		if !wasSeparator && i < len(b)-1 && mrand.Intn(4) == 0 {
+			b[i] = separatorChars[mrand.Intn(len(separatorChars))]
 			wasSeparator = true
 		} else {
-			b[i] = filenameChars[rand.Intn(len(filenameChars))]
+			b[i] = filenameChars[mrand.Intn(len(filenameChars))]
 			wasSeparator = false
 		}
 	}
@@ -2251,7 +2252,7 @@ func randomFilename(length int) string {
 // chars long inclusive.
 func randomFilenameRange(minimum, maximum int) string { // nolint:unparam //(min always receives 8)
 	/* #nosec G404 */
-	return randomFilename(minimum + (rand.Intn(maximum + 1)))
+	return randomFilename(minimum + (mrand.Intn(maximum + 1)))
 }
 
 // randomBranchingFiles creates n number of randomly named files at the end of
@@ -2289,7 +2290,6 @@ func randomContents(length int64) []byte {
 			randomBytes = make([]byte, 128<<23)
 		}
 
-		/* #nosec G404*/
 		_, _ = rand.Read(randomBytes) // always returns len(randomBytes) and nil error
 	})
 

registry/storage/filereader_test.go

@@ -2,6 +2,7 @@ package storage
 
 import (
 	"bytes"
+	"crypto/rand"
 	"io"
 	mrand "math/rand"
 	"testing"
@@ -16,7 +17,7 @@ import (
 func TestSimpleRead(t *testing.T) {
 	ctx := context.Background()
 	content := make([]byte, 1<<20)
-	n, err := mrand.Read(content)
+	n, err := rand.Read(content)
 	require.NoError(t, err, "unexpected error building random data")
 
 	require.Equal(t, len(content), n, "random read didn't fill buffer")

registry/storage/validation/oci_test.go

 package validation_test
 
 import (
+	"crypto/rand"
 	"fmt"
-	"math/rand"
+	mrand "math/rand"
 	"regexp"
 	"testing"
 
@@ -289,7 +290,7 @@ func TestVerifyManifest_OCI_ReferenceLimits(t *testing.T) {
 
 			// Create a random layer for each of the specified manifest layers.
 			for i := 0; i < tt.manifestLayers; i++ {
-				b := make([]byte, rand.Intn(20))
+				b := make([]byte, mrand.Intn(20))
 				rand.Read(b)
 
 				layer, err := repo.Blobs(ctx).Put(ctx, v1.MediaTypeImageLayer, b)

registry/storage/validation/schema2_test.go

 package validation_test
 
 import (
+	"crypto/rand"
 	"errors"
 	"fmt"
-	"math/rand"
+	mrand "math/rand"
 	"regexp"
 	"testing"
 
@@ -292,7 +293,7 @@ func TestVerifyManifest_Schema2_ReferenceLimits(t *testing.T) {
 
 			// Create a random layer for each of the specified manifest layers.
 			for i := 0; i < tt.manifestLayers; i++ {
-				b := make([]byte, rand.Intn(20))
+				b := make([]byte, mrand.Intn(20))
 				rand.Read(b)
 
 				layer, err := repo.Blobs(ctx).Put(ctx, schema2.MediaTypeLayer, b)

testutil/tarfile.go

@@ -3,6 +3,7 @@ package testutil
 import (
 	"archive/tar"
 	"bytes"
+	"crypto/rand"
 	"fmt"
 	"io"
 	mrand "math/rand"
@@ -46,7 +47,7 @@ func CreateRandomTarFile() (rs io.ReadSeeker, dgst digest.Digest, err error) {
 		randomData := make([]byte, fileSize)
 
 		// Fill up the buffer with some random data.
-		n, err := mrand.Read(randomData)
+		n, err := rand.Read(randomData)
 
 		if n != len(randomData) {
 			return nil, "", fmt.Errorf("short read creating random reader: %v bytes != %v bytes", n, len(randomData))