Skip to content

Fix FIPS-safe random string generation in dataset generator#343

Merged
corporate-gadfly merged 1 commit into
OpenVoxProject:mainfrom
corporate-gadfly:fix-fips-generate-tests
Jun 25, 2026
Merged

Fix FIPS-safe random string generation in dataset generator#343
corporate-gadfly merged 1 commit into
OpenVoxProject:mainfrom
corporate-gadfly:fix-fips-generate-tests

Conversation

@corporate-gadfly

Copy link
Copy Markdown
Contributor

Chunk large RandomStringUtils calls to stay under the BC FIPS DRBG per-request limit (262144 bits / 32768 bytes), which was causing generate tests to fail under the FIPS profile.

  • add random-ascii-string helper in cli/generate.clj and use it in add-blob
  • add alphabetic-string helper in random.clj and route random-string/ random-string-alpha through it
  • use StringBuilder-based chunk assembly to reduce intermediate allocations
  • add local type hints on interop targets to avoid reflection noise

@corporate-gadfly corporate-gadfly force-pushed the fix-fips-generate-tests branch from a0254ad to 18a61a3 Compare June 25, 2026 15:37
Chunk large RandomStringUtils calls to stay under the BC FIPS DRBG
per-request limit (262144 bits / 32768 bytes), which was causing
generate tests to fail under the FIPS profile.

- add random-ascii-string helper in cli/generate.clj and use it in add-blob
- add alphabetic-string helper in random.clj and route random-string/
  random-string-alpha through it
- use StringBuilder-based chunk assembly to reduce intermediate allocations
- add local type hints on interop targets to avoid reflection noise

Co-authored-by: GitHub Copilot <copilot@users.noreply.github.com>
Signed-off-by: Corporate Gadfly <haroon.rafique@gmail.com>
@corporate-gadfly corporate-gadfly force-pushed the fix-fips-generate-tests branch from 18a61a3 to 85c759e Compare June 25, 2026 15:50
@corporate-gadfly corporate-gadfly merged commit c23b506 into OpenVoxProject:main Jun 25, 2026
10 checks passed
@corporate-gadfly corporate-gadfly deleted the fix-fips-generate-tests branch June 25, 2026 18:07
@jpartlow

jpartlow commented Jun 25, 2026

Copy link
Copy Markdown
Contributor

@corporate-gadfly thanks for working on this. What's here looks workable, but there are three changes I suggest:

  1. pull random-ascii-string into random.clj
  2. extract a chunked-random-string function from the guts of random-ascii-string and alphabetic-string and have them call that common function
  3. benchmark.clj touch-parameter-value may have a similar issue?

Oops, looks like I missed the merge deadline :)

Depending on what you think about point 3 above, these might still be worth doing. I'm not really up to speed on what the FIPS goals, requirements are here. Do you want me to take a stab at it?

@corporate-gadfly

Copy link
Copy Markdown
Contributor Author

@corporate-gadfly thanks for working on this. What's here looks workable, but there are three changes I suggest:

1. pull random-ascii-string into random.clj

2. extract a chunked-random-string function from the guts of random-ascii-string and alphabetic-string and have them call that common function

3. benchmark.clj touch-parameter-value may have a similar issue?

Oops, looks like I missed the merge deadline :)

Depending on what you think about point 3 above, these might still be worth doing. I'm not really up to speed on what the FIPS goals, requirements are here. Do you want me to take a stab at it?

TY for the feedback @jpartlow. Feel free to engage.

My main goal is to have a green daily workflow.

@jpartlow

Copy link
Copy Markdown
Contributor

TY for the feedback @jpartlow. Feel free to engage.

My main goal is to have a green daily workflow.

Ah, ok, I see where this bubbled up from now. I'll take a stab at it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants