JuliusBrussee/caveman · error

kms: generate probe: %w

Error message

kms: generate probe: %w

What it means

Client.Probe wraps the crypto/rand.Read failure while generating the 32 random probe bytes for the live encrypt/decrypt round-trip. This fires only when the OS entropy source fails (crypto/rand.Read returning an error is extremely rare and usually signals a broken/degraded system CSPRNG).

Source

Thrown at shared/platform/kms/kms.go:320

}

// ProbePayloadProduction performs the same live round-trip with the payload KEK.
func ProbePayloadProduction(ctx context.Context) error {
	if !runtimeenv.IsProduction() {
		return nil
	}
	client, err := FromPayloadEnvironment()
	if err != nil {
		return err
	}
	return client.Probe(ctx)
}

// Probe verifies live key access without persisting tenant data.
func (c *Client) Probe(ctx context.Context) error {
	plaintext := make([]byte, 32)
	if _, err := rand.Read(plaintext); err != nil {
		return fmt.Errorf("kms: generate probe: %w", err)
	}
	envelope, err := c.Encrypt(ctx, plaintext)
	if err != nil {
		return fmt.Errorf("kms: probe encrypt: %w", err)
	}
	decrypted, err := c.Decrypt(ctx, envelope)
	if err != nil {
		return fmt.Errorf("kms: probe decrypt: %w", err)
	}
	if !bytes.Equal(decrypted, plaintext) {
		return errors.New("kms: probe plaintext mismatch")
	}
	return nil
}

func validateLocation(region, keyID string) error {
	if !regionPattern.MatchString(region) {
		return errors.New("kms: invalid Scaleway region")

View on GitHub (pinned to 766dce6b13)

Solutions

1. Investigate host entropy/CSPRNG health; crypto/rand failing indicates a system-level problem
2. Retry the probe after the host recovers
3. Check container/host configuration that could deplete or block the entropy source

When it happens

Trigger: Thrown at shared/platform/kms/kms.go:320 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of JuliusBrussee/caveman@766dce6b13 (2026-08-18). Data as JSON: /api/errors/8e7022f4309bd2c6. Report an issue: GitHub.