deps: Bump to rand v0.9 where possible #480

joncinque · 2025-12-01T16:46:27Z

Problem

The repo is still on rand v0.8 in a lot of places, but that version isn't very compatible with rust 2024 due to its usage of gen as a function name, which is becoming a keyword.

Summary of changes

Follow https://rust-random.github.io/book/update-0.9.html to perform the upgrade to rand v0.9 where possible.

Most crypto libraries are still on rand v0.8 / rand_core v0.6, and the blstrs and ecdsa implementations of random aren't as simple as just taking 32 or 64 random bytes, so I left those back.

cc @puhtaytow

#### Problem The repo is still on rand v0.8 in a lot of places, but that version isn't very compatible with rust 2024 due to its usage of `gen` as a function name, which is becoming a keyword. #### Summary of changes Follow https://rust-random.github.io/book/update-0.9.html to perform the upgrade to rand v0.9 where possible. Most crypto libraries are still on rand v0.8 / rand_core v0.6, and the blstrs and ecdsa implementations of `random` aren't as simple as just taking 32 or 64 random bytes, so I left those back.

alexpyattaev

Checked the crates I know:

address
frozen-abi
keypair
serde-varint

Overall the change looks good, but I'd prefer if we pinned some version for frozen-abi. Technically, changing the rand version for frozen-abi at this point would require a major version bump (assuming someone has already started using the version with ABI checks).

alexpyattaev · 2025-12-01T18:31:00Z

frozen-abi/Cargo.toml

 # to avoid version skew and keep digest computation stable regardless of consumer dependencies.
-rand = "0.8.5"
-rand_chacha = "0.3.1"
+rand = { workspace = true }


Should we pin the version of rand here to avoid ABI hashes from breaking accidentally? None of this runs in prod, so perf is a non-issue.

The frozen-abi tests in this repo would catch that, no?

We need to add those tests. But yes, they should catch this.

How different would they be from these? https://github.com/anza-xyz/solana-sdk/blob/master/scripts/test-frozen-abi.sh

I have this draft here #484 this should early catch eventual changes. Somehow it has the same issue as described here #477 - Works with cargo test, but with cargo hack those are skipped.

alexpyattaev · 2025-12-01T18:43:31Z

keypair/src/lib.rs

    pub fn new() -> Self {
-        let mut rng = OsRng;
-        Self(ed25519_dalek::SigningKey::generate(&mut rng))
+        let secret_bytes = rand::random::<[u8; Self::SECRET_KEY_LENGTH]>();


Technically, this changes from explicitly using OsRng to using ThreadRng. Not sure it matters, just pointing it out. It is probably for the best.

joncinque · 2025-12-01T19:00:48Z

Technically, changing the rand version for frozen-abi at this point would require a major version bump (assuming someone has already started using the version with ABI checks).

Right, it's a little annoying, but probably for the best

puhtaytow · 2025-12-02T10:29:33Z

Technically, changing the rand version for frozen-abi at this point would require a major version bump (assuming someone has already started using the version with ABI checks).

Right, it's a little annoying, but probably for the best

Unfortunately.

I have spoken with Alex and we agreed that perhaps it would be better if we switch frozen-abi to rand/chacha v0.9 using this ocassion. It would be breaking change, but performed now, would reflect in less work later.

If you think this is the good move then please leave frozen-abi crate deps as it was and here i have prepared the small PR #482 to be merged after yours.

joncinque · 2025-12-02T11:59:31Z

If you think this is the good move then please leave frozen-abi crate deps as it was and here i have prepared the small PR #482 to be merged after yours.

I don't understand, is the separate PR mainly to do the contribution in a separate PR? The changes are here and passing CI, why force me to spend extra time to revert parts of this PR?

puhtaytow · 2025-12-02T12:51:52Z

If you think this is the good move then please leave frozen-abi crate deps as it was and here i have prepared the small PR #482 to be merged after yours.

I don't understand, is the separate PR mainly to do the contribution in a separate PR? The changes are here and passing CI, why force me to spend extra time to revert parts of this PR?

Sorry! I didn't notice that you adjusted the interface definition as well. All good! 🙏

alexpyattaev

Approving for crates:

```
address
```
```
frozen-abi
```
```
keypair
```
```
serde-varint
```

joncinque · 2025-12-03T19:53:48Z

@samkim-crypto can you review the other crates not covered by @alexpyattaev ?

samkim-crypto

Yes, I checked the rest of the crates and things look good to me.

we should keep rand to v0.8 for crates that depend on blstrs and ecdsa implementations
double checked the getrandom version update for sdk-wasm-js
the other crates seem pretty straightforward. There seems to be some places where we can write things in slightly more idiomatic way, but very minor nits that you can choose to update only if you want to

samkim-crypto · 2025-12-04T02:42:04Z

serialize-utils/src/cursor.rs

+            let test_value = if rand::random_bool(0.5) {
+                Some(rand::random::<u64>())
+            } else {
+                None
+            };


Suggested change

let test_value = if rand::random_bool(0.5) {

Some(rand::random::<u64>())

} else {

None

};

let test_value = rand::rng()

.random_bool(0.5)

.then(|| rand::random::<u64>());

Very minor nit: I guess this could be written slightly more idiomatically.

samkim-crypto · 2025-12-04T02:53:31Z

vote-interface/src/state/mod.rs

        .sorted_by_key(|lockout| lockout.slot())
        .collect();
-        let root = rng.gen_ratio(1, 2).then(|| {
+        let root = rng.random_ratio(1, 2).then(|| {


Nit: Seems like random_ratio should be used for fractions like 1/3 or 5/7. For this particular case, it seems like rng.random_bool(0.5) is probably more idiomatic.

samkim-crypto · 2025-12-04T02:54:01Z

vote-interface/src/state/mod.rs

        });
-        let timestamp = rng.gen_ratio(1, 2).then(|| rng.gen());
-        let hash = Hash::from(rng.gen::<[u8; 32]>());
+        let timestamp = rng.random_ratio(1, 2).then(|| rng.random());


Nit: same here

joncinque · 2025-12-04T10:41:20Z

Addressed the nits, let me know what you think!

samkim-crypto

Looks good to me!

joncinque requested review from alexpyattaev and samkim-crypto December 1, 2025 16:46

joncinque added 3 commits December 1, 2025 17:49

Also update getrandom for wasm builds

0b44e6c

wasm: Don't use cache fallback for CI

18c4008

Bump getrandom to next patch version

6dd3d0f

alexpyattaev reviewed Dec 1, 2025

View reviewed changes

puhtaytow mentioned this pull request Dec 2, 2025

frozen-abi: migrate StableAbi to rand v0.9 #482

Closed

alexpyattaev previously approved these changes Dec 3, 2025

View reviewed changes

samkim-crypto previously approved these changes Dec 4, 2025

View reviewed changes

joncinque dismissed stale reviews from samkim-crypto and alexpyattaev via 0b27d3f December 4, 2025 10:41

joncinque requested a review from samkim-crypto December 4, 2025 10:41

Address nits

24759a1

joncinque force-pushed the rand9 branch from 0b27d3f to 24759a1 Compare December 4, 2025 10:44

samkim-crypto approved these changes Dec 4, 2025

View reviewed changes

joncinque merged commit 0623f42 into anza-xyz:master Dec 4, 2025
24 checks passed

joncinque deleted the rand9 branch December 4, 2025 11:09

deps: Bump to rand v0.9 where possible #480

deps: Bump to rand v0.9 where possible #480

Uh oh!

Conversation

joncinque commented Dec 1, 2025

Problem

Summary of changes

Uh oh!

alexpyattaev left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

puhtaytow Dec 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

joncinque commented Dec 1, 2025

Uh oh!

puhtaytow commented Dec 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

joncinque commented Dec 2, 2025

Uh oh!

puhtaytow commented Dec 2, 2025

Uh oh!

alexpyattaev left a comment

Choose a reason for hiding this comment

Uh oh!

joncinque commented Dec 3, 2025

Uh oh!

samkim-crypto left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

joncinque commented Dec 4, 2025

Uh oh!

samkim-crypto left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

puhtaytow Dec 2, 2025 •

edited

Loading

puhtaytow commented Dec 2, 2025 •

edited

Loading

samkim-crypto left a comment •

edited

Loading