OpenNHP/opennhp · error

error generating spoId

Error message

error generating spoId: %v

What it means

NewSmartPolicy loads a smart-policy JSON file, unmarshals it into common.SmartPolicy, then assigns a fresh identifier via utils.GenerateUUIDv4(). The error 'error generating spoId: %v' wraps any failure from that UUID generator, meaning the runtime could not produce a new UUIDv4 for the policy. In practice this almost always indicates the underlying source of randomness (crypto/rand) failed on the host, since the ID generation itself takes no user input.

Solutions

1. Check the wrapped error in the message to identify the underlying entropy failure (e.g. 'open /dev/urandom: too many open files') and fix that root cause
2. Verify /dev/urandom is available and getrandom(2) is permitted in the container/seccomp config
3. Raise the process file-descriptor limit (ulimit -n) if exhaustion is the cause
4. Retry the run — crypto/rand failures are usually transient host-level issues
5. Upgrade Go: modern versions use getrandom(2) which rarely fails on Linux

Example fix

// before
spoId, err := utils.GenerateUUIDv4()
if err != nil {
    return common.SmartPolicy{}, fmt.Errorf("error generating spoId: %v", err)
}
// after
spoId, err := utils.GenerateUUIDv4()
if err != nil {
    log.Errorf("UUIDv4 generation failed: %v", err)
    return common.SmartPolicy{}, fmt.Errorf("error generating spoId: %w", err)
}

// no pre-call validation possible; UUID gen takes no input
// ensure entropy source works on this host at startup:
f, err := os.OpenFile("/dev/urandom", os.O_RDONLY, 0)
if err != nil {
    log.Fatalf("no entropy source available: %v", err)
}
f.Close()

sp, err := params.NewSmartPolicy()
if err != nil {
    if strings.Contains(err.Error(), "error generating spoId") {
        log.Errorf("entropy failure, check /dev/urandom and fd limits: %v", err)
        // retry after fixing host conditions
    }
    return err
}

When it happens

Trigger: Calling AppParams.NewSmartPolicy (via the nhp-db runApp flow) after the policy JSON parses successfully, when utils.GenerateUUIDv4() returns a non-nil error — i.e. crypto/rand entropy read failure, e.g. exhausted or blocked /dev/urandom in a restricted container.

Common situations: Running nhp-db inside a hardened container or sandbox where /dev/urandom is unavailable or open files are capped; hitting the process file-descriptor limit so crypto/rand's internal open fails; misconfigured seccomp profiles blocking getrandom(2).

Understand the failure class

Background: "This is a bug, please report it": internal invariant violations, unreachable panics, and SNH errors explained — this error's family across 47 libraries.

Related errors

• failed to generate UUID:
• failed to generate UUID v4
• unknown remote provider
• unknown remote provider
• unsupported key type, expect RSA

AI-assisted analysis of OpenNHP/opennhp@6e04ca5ff0 (2026-09-07). Data as JSON: /api/errors/29d9170adb7d2960. Report an issue: GitHub.

Appendix: source

Thrown at endpoints/db/utils.go:152

		return common.SmartPolicy{}, fmt.Errorf("could not open file: %v", err)
	}
	defer file.Close()

	fileContentByte, err := io.ReadAll(file)
	if err != nil {
		return common.SmartPolicy{}, fmt.Errorf("error reading file: %v", err)
	}

	var config common.SmartPolicy

	err = json.Unmarshal(fileContentByte, &config)
	if err != nil {
		return common.SmartPolicy{}, fmt.Errorf("json parsing error: %s", err)
	}

	spoId, err := utils.GenerateUUIDv4()
	if err != nil {
		return common.SmartPolicy{}, fmt.Errorf("error generating spoId: %v", err)
	}

	config.PolicyId = spoId

	return config, nil
}

func (a *AppParams) GetMetadata() (string, error) {
	if a.Metadata == "" {
		return "", nil
	}

	content, err := os.ReadFile(a.Metadata)
	if err != nil {
		return "", err
	}

	return string(content), nil

View on GitHub (pinned to 6e04ca5ff0)