platform: portable secure-random backend for macOS/Windows

getrandom(2) is Linux-only — macOS has <sys/random.h> but no getrandom
symbol, Windows has neither — so the AppleClang build failed with
"call to undeclared function 'getrandom'" in ytelemetry.c and the three
token mints (session, token_issuer, runner_agent).

Add a platform/random module mirroring platform/time: a single
picomesh_platform_random_bytes() with per-OS backends selected by CMake —
Linux getrandom(2), macOS/BSD getentropy(3) (chunked to 256 bytes),
Windows rand_s(). Call sites now use the helper and lose their direct
<sys/random.h> dependency; the security mints keep failing closed, the
telemetry id generator keeps its non-secret PRNG fallback.

Author: zokrezyl

CMakeLists.txt

@@ -48,13 +48,15 @@ include(build-tools/picomesh/libs/libcurl.cmake)
 # ---- platform backend selection -------------------------------------
 #
 # platform abstractions get one backend file per platform. Backends
-# under src/picomesh/platform/<module>/<platform>.c. Today only `time`
-# is platform-split; future modules (paths, threads, sockets) follow
+# under src/picomesh/platform/<module>/<platform>.c. `time` and `random`
+# are platform-split; future modules (paths, threads, sockets) follow
 # the same shape.
 if(WIN32)
-    set(PICOMESH_PLATFORM_TIME_SRC src/picomesh/platform/time/windows.c)
+    set(PICOMESH_PLATFORM_TIME_SRC   src/picomesh/platform/time/windows.c)
+    set(PICOMESH_PLATFORM_RANDOM_SRC src/picomesh/platform/random/windows.c)
 else()
-    set(PICOMESH_PLATFORM_TIME_SRC src/picomesh/platform/time/posix.c)
+    set(PICOMESH_PLATFORM_TIME_SRC   src/picomesh/platform/time/posix.c)
+    set(PICOMESH_PLATFORM_RANDOM_SRC src/picomesh/platform/random/posix.c)
 endif()
 
 # ---- picomesh runtime ---------------------------------------------------
@@ -103,6 +105,7 @@ add_library(picomesh_runtime STATIC
     src/picomesh/json/json.c
     src/yyjson/yyjson.c
     ${PICOMESH_PLATFORM_TIME_SRC}
+    ${PICOMESH_PLATFORM_RANDOM_SRC}
 )
 target_include_directories(picomesh_runtime PUBLIC
     include

include/picomesh/platform/random.h

@@ -0,0 +1,32 @@
+/* platform/random.h — cross-platform cryptographically-secure randomness.
+ *
+ * One call, no platform headers in callers. Backends live under
+ * src/picomesh/platform/random/<platform>.c — CMake selects one based
+ * on the target:
+ *   - posix.c   : Linux getrandom(2); macOS/BSD getentropy(3).
+ *   - windows.c : the CRT CSPRNG (rand_s / RtlGenRandom).
+ *
+ * Replaces direct <sys/random.h> getrandom() use, which is Linux-only
+ * (macOS has <sys/random.h> but no getrandom symbol; Windows has
+ * neither). */
+
+#ifndef PICOMESH_PLATFORM_RANDOM_H
+#define PICOMESH_PLATFORM_RANDOM_H
+
+#include <stddef.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* Fill `buf` with `len` cryptographically-secure random bytes, retrying
+ * partial reads / EINTR internally. Returns 0 on success, -1 on failure
+ * (in which case the contents of `buf` are unspecified). All-or-nothing:
+ * a 0 return guarantees every byte was written. */
+int picomesh_platform_random_bytes(void *buf, size_t len);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* PICOMESH_PLATFORM_RANDOM_H */

src/picomesh/core/ytelemetry.c

@@ -11,13 +11,12 @@
 #include <picomesh/picoclass/class.h>
 #include <picomesh/picoclass/rpc.h>
 #include <picomesh/picoclass/yheaders.h>
+#include <picomesh/platform/random.h>
 
-#include <errno.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <strings.h>
-#include <sys/random.h>
 #include <time.h>
 #include <unistd.h>
 
@@ -77,26 +76,13 @@ static int ytel_bytes_all_zero(const uint8_t *bytes, size_t n) {
 }
 
 static void ytel_fill_random(uint8_t *bytes, size_t n) {
-  /* Prefer the kernel CSPRNG; retry partial reads and EINTR. */
-  size_t off = 0;
-  while (off < n) {
-    ssize_t got = getrandom(bytes + off, n - off, 0);
-    if (got > 0) {
-      off += (size_t)got;
-      continue;
-    }
-    if (got < 0 && errno == EINTR)
-      continue;
-    break;
-  }
-  if (off == n)
+  /* Prefer the kernel CSPRNG. */
+  if (picomesh_platform_random_bytes(bytes, n) == 0)
     return;
-  /* Fallback for the remainder: trace/span ids are correlation ids, not
-   * secrets, so a clock/pid-seeded PRNG is acceptable when getrandom is
-   * unavailable. */
-  uint64_t seed =
-      ytel_mono_ns() ^ ((uint64_t)getpid() << 32) ^ (uint64_t)(off + 1);
-  for (size_t i = off; i < n; ++i) {
+  /* Fallback: trace/span ids are correlation ids, not secrets, so a
+   * clock/pid-seeded PRNG is acceptable when the CSPRNG is unavailable. */
+  uint64_t seed = ytel_mono_ns() ^ ((uint64_t)getpid() << 32) ^ 1u;
+  for (size_t i = 0; i < n; ++i) {
     seed = seed * 6364136223846793005ull + 1442695040888963407ull;
     bytes[i] = (uint8_t)(seed >> 33);
   }

src/picomesh/platform/random/posix.c

@@ -0,0 +1,43 @@
+/* random/posix.c — POSIX CSPRNG backend.
+ *
+ * Linux uses getrandom(2) (glibc wrapper over the syscall). macOS and the
+ * BSDs don't expose getrandom but do provide getentropy(3), which fills up
+ * to 256 bytes per call from the same kernel CSPRNG — chunk for larger
+ * requests. Both block only until the pool is initialised, then never
+ * again, which is what callers minting session ids / tokens want. */
+
+/* getrandom() needs _GNU_SOURCE / _DEFAULT_SOURCE; the build defines
+ * _GNU_SOURCE tree-wide, so no local define is needed here. */
+
+#include <picomesh/platform/random.h>
+
+#include <errno.h>
+#include <sys/random.h>
+
+int picomesh_platform_random_bytes(void *buf, size_t len) {
+  unsigned char *out = (unsigned char *)buf;
+  size_t off = 0;
+  while (off < len) {
+#if defined(__linux__)
+    ssize_t got = getrandom(out + off, len - off, 0);
+    if (got < 0) {
+      if (errno == EINTR)
+        continue;
+      return -1;
+    }
+    off += (size_t)got;
+#else
+    /* getentropy fills at most 256 bytes and is all-or-nothing per call. */
+    size_t chunk = len - off;
+    if (chunk > 256)
+      chunk = 256;
+    if (getentropy(out + off, chunk) != 0) {
+      if (errno == EINTR)
+        continue;
+      return -1;
+    }
+    off += chunk;
+#endif
+  }
+  return 0;
+}

src/picomesh/platform/random/windows.c

@@ -0,0 +1,29 @@
+/* random/windows.c — Windows CSPRNG backend.
+ *
+ * Uses rand_s(), the CRT wrapper over RtlGenRandom (the system CSPRNG).
+ * It needs _CRT_RAND_S defined before <stdlib.h> and pulls no extra
+ * import library (unlike BCryptGenRandom, which would need bcrypt.lib),
+ * keeping the picomesh.exe link self-contained. */
+
+#define _CRT_RAND_S
+
+#include <picomesh/platform/random.h>
+
+#include <stdlib.h>
+
+int picomesh_platform_random_bytes(void *buf, size_t len) {
+  unsigned char *out = (unsigned char *)buf;
+  size_t off = 0;
+  while (off < len) {
+    unsigned int value;
+    if (rand_s(&value) != 0)
+      return -1;
+    size_t chunk = len - off;
+    if (chunk > sizeof(value))
+      chunk = sizeof(value);
+    for (size_t i = 0; i < chunk; ++i)
+      out[off + i] = (unsigned char)(value >> (8 * i));
+    off += chunk;
+  }
+  return 0;
+}

src/picomesh/plugins/runner_agent/store.c

@@ -32,17 +32,16 @@
 #include <picomesh/json/json.h>
 #include <picomesh/picoclass/class.h>
 #include <picomesh/picoclass/yheaders.h>
+#include <picomesh/platform/random.h>
 #include <picomesh/plugin/sharded_storage/sharded_storage.h>
 #include <picomesh/plugin/token_issuer/token_issuer.h>
 #include <picomesh/security/jwt.h>
 #include <picomesh/security/sha256.h>
 
-#include <errno.h>
 #include <stdint.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include <sys/random.h>
 
 #define RA_CTX "runner_agent"
 
@@ -129,16 +128,8 @@ static int ra_alloc_token(char *out, size_t cap) {
   if (cap < 4 + 32 + 1)
     return 0;
   uint8_t raw[16];
-  size_t got = 0;
-  while (got < sizeof(raw)) {
-    ssize_t read_len = getrandom(raw + got, sizeof(raw) - got, 0);
-    if (read_len < 0) {
-      if (errno == EINTR)
-        continue;
-      return 0;
-    }
-    got += (size_t)read_len;
-  }
+  if (picomesh_platform_random_bytes(raw, sizeof(raw)) != 0)
+    return 0;
   static const char hex[] = "0123456789abcdef";
   memcpy(out, "rnr_", 4);
   size_t k = 4;

src/picomesh/plugins/session/session.c

@@ -27,15 +27,14 @@
 #include <picomesh/engine/engine.h>
 #include <picomesh/picoclass/class.h>
 #include <picomesh/picoclass/rpc.h>
+#include <picomesh/platform/random.h>
 #include <picomesh/platform/time.h>
 #include <picomesh/plugin/relational_storage/relational_sql.h>
 
-#include <errno.h>
 #include <stdint.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include <sys/random.h>
 
 #define SESSION_DDL                                                            \
   "CREATE TABLE IF NOT EXISTS sessions("                                       \
@@ -57,16 +56,8 @@ static struct session_session_data *sess(struct object *obj) {
  */
 static int alloc_token(char *out, size_t cap) {
   uint8_t raw[16];
-  size_t got = 0;
-  while (got < sizeof(raw)) {
-    ssize_t read_len = getrandom(raw + got, sizeof(raw) - got, 0);
-    if (read_len < 0) {
-      if (errno == EINTR)
-        continue;
-      return 0;
-    }
-    got += (size_t)read_len;
-  }
+  if (picomesh_platform_random_bytes(raw, sizeof(raw)) != 0)
+    return 0;
   static const char hex[] = "0123456789abcdef";
   size_t k = 0;
   for (size_t i = 0; i < sizeof(raw) && k + 2 < cap; ++i) {

src/picomesh/plugins/token_issuer/store.c

@@ -23,19 +23,18 @@
 #include <picomesh/engine/engine.h>
 #include <picomesh/picoclass/class.h>
 #include <picomesh/picoclass/yheaders.h>
+#include <picomesh/platform/random.h>
 #include <picomesh/platform/time.h>
 #include <picomesh/plugin/accounts/accounts.h>
 #include <picomesh/plugin/password_authn/password_authn.h>
 #include <picomesh/plugin/relational_storage/relational_sql.h>
 #include <picomesh/security/jwt.h>
 #include <picomesh/security/secret.h>
 
-#include <errno.h>
 #include <stdint.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include <sys/random.h>
 
 #define TI_DDL                                                                 \
   "CREATE TABLE IF NOT EXISTS refresh_tokens("                                 \
@@ -69,16 +68,8 @@ static struct picomesh_void_result ti_open(struct rel_handle *rel_handle,
  * randomness is unavailable — a refresh token is a bearer secret. */
 static int alloc_refresh_token(char *out, size_t cap) {
   uint8_t raw[16];
-  size_t got = 0;
-  while (got < sizeof(raw)) {
-    ssize_t read_len = getrandom(raw + got, sizeof(raw) - got, 0);
-    if (read_len < 0) {
-      if (errno == EINTR)
-        continue;
-      return 0;
-    }
-    got += (size_t)read_len;
-  }
+  if (picomesh_platform_random_bytes(raw, sizeof(raw)) != 0)
+    return 0;
   static const char hex[] = "0123456789abcdef";
   size_t k = 0;
   for (size_t i = 0; i < sizeof(raw) && k + 2 < cap; ++i) {