sneak/mfer
1
0
Fork 1
Code Issues 6 Pull Requests 2 Releases Wiki Activity

remove time-hard hash iteration from seed UUID derivation

Browse Source 
Replace 150M SHA-256 iteration key-stretching with a single hash.
Remove all references to iteration counts, timing (~5-10s), and
key-stretching from code and documentation.

The seed flag is retained for deterministic UUID generation, but
now derives the UUID with a single SHA-256 hash instead of the
unnecessary iterative approach.
This commit is contained in:
clawbot 2026-02-20 03:06:33 -08:00
parent 5572a4901f
commit 3c779465e2
3 changed files with 14 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
internal/cli/mfer.go
View File

@ -156,7 +156,7 @@ func (mfa *CLIApp) run(args []string) {
}, },
&cli.StringFlag{ &cli.StringFlag{
Name: "seed", Name: "seed",
Usage: "Seed value for deterministic manifest UUID (hashed 150M times with SHA-256, ~5-10s)", Usage: "Seed value for deterministic manifest UUID",
EnvVars: []string{"MFER_SEED"}, EnvVars: []string{"MFER_SEED"},
}, },
), ),

19
mfer/builder.go
View File

@ -92,25 +92,12 @@ type Builder struct {
fixedUUID []byte // if set, use this UUID instead of generating one fixedUUID []byte // if set, use this UUID instead of generating one
} }
// seedIterations is the number of SHA-256 rounds used to derive a UUID from a seed.
// Tuned to take approximately 5-10 seconds on modern hardware.
const seedIterations = 150_000_000
// SetSeed derives a deterministic UUID from the given seed string. // SetSeed derives a deterministic UUID from the given seed string.
// The seed is hashed 150,000,000 times with SHA-256 to produce // The seed is hashed once with SHA-256 and the first 16 bytes are used
// 16 bytes used as a fixed UUID for the manifest (~5-10s on modern hardware). // as a fixed UUID for the manifest.
func (b *Builder) SetSeed(seed string) { func (b *Builder) SetSeed(seed string) {
b.fixedUUID = deriveSeedUUID(seed, seedIterations)
}
// deriveSeedUUID hashes the seed string n times with SHA-256
// and returns the first 16 bytes as a UUID.
func deriveSeedUUID(seed string, iterations int) []byte {
hash := sha256.Sum256([]byte(seed)) hash := sha256.Sum256([]byte(seed))
for i := 1; i < iterations; i++ { b.fixedUUID = hash[:16]
hash = sha256.Sum256(hash[:])
}
return hash[:16]
} }
// NewBuilder creates a new Builder. // NewBuilder creates a new Builder.

18
mfer/builder_test.go
View File

@ -150,15 +150,17 @@ func TestBuilderDeterministicOutput(t *testing.T) {
assert.Equal(t, out1, out2, "two builds with same input should produce byte-identical output") assert.Equal(t, out1, out2, "two builds with same input should produce byte-identical output")
} }
func TestDeriveSeedUUID(t *testing.T) { func TestSetSeedDeterministic(t *testing.T) {
// Use a small iteration count for testing (production uses 1B) b1 := NewBuilder()
uuid1 := deriveSeedUUID("test-seed-value", 1000) b1.SetSeed("test-seed-value")
uuid2 := deriveSeedUUID("test-seed-value", 1000) b2 := NewBuilder()
assert.Equal(t, uuid1, uuid2, "same seed should produce same UUID") b2.SetSeed("test-seed-value")
assert.Len(t, uuid1, 16, "UUID should be 16 bytes") assert.Equal(t, b1.fixedUUID, b2.fixedUUID, "same seed should produce same UUID")
assert.Len(t, b1.fixedUUID, 16, "UUID should be 16 bytes")
uuid3 := deriveSeedUUID("different-seed", 1000) b3 := NewBuilder()
assert.NotEqual(t, uuid1, uuid3, "different seeds should produce different UUIDs") b3.SetSeed("different-seed")
assert.NotEqual(t, b1.fixedUUID, b3.fixedUUID, "different seeds should produce different UUIDs")
} }
func TestBuilderBuildEmpty(t *testing.T) { func TestBuilderBuildEmpty(t *testing.T) {