only seed math/rand once

[jbardin]

Re-seeding the PRNG every time only serves to make the output an
obfuscated timestamp. On windows with a low clock resolution, this
manifests itself by outputting the same value on calls within the
minimum time delta of the clock.

Fixes #21550

[apparentlymart]

This fix seems reasonable, but got me thinking more: we have a few different things in Terraform and in providers that generate random numbers, and this seems to be using the default shared generator that other code might also be reseeding.

Should we give this package its own generator instance so that it can be sure it isn't going to get reseeded in a bad way by some other code? (This feels similar to our principle of avoiding using the default HTTP client because other libraries that we load might/did do weird things to it.)

[jbardin]

I was thinking the same thing, but didn't create a new source since it's actually a bit awkward to make s locked source, and figured I could find one in our own packages to use instead.

Since this is the standard way of using the default rand.Source, any package seeding things incorrectly is what should be creating a new source, however you're right that we should probably protect this from badly behaved packages anyway.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.