What causes "failed to generate PKCE verifier: %w" in Tencent/WeKnora?

Verify crypto/rand works on the host (check dmesg/seccomp denials for getrandom)

failed to generate PKCE verifier: %w

Error message

failed to generate PKCE verifier: %w

What it means

Wraps a failure from transport.GenerateCodeVerifier when creating the PKCE code verifier for the authorization-code flow. PKCE is mandatory in this flow, so a verifier-generation failure aborts StartAuthorization before any URL is produced. Typically caused by the underlying secure randomness source failing.

Source

Thrown at internal/mcp/oauth_manager.go:124

			return "", "", fmt.Errorf("dynamic client registration failed: %w", err)
		}
		clientID := h.GetClientID()
		if clientID == "" {
			return "", "", fmt.Errorf("dynamic client registration returned an empty client_id")
		}
		if err := m.repo.SaveClient(ctx, &types.MCPOAuthClient{
			TenantID:    tenantID,
			ServiceID:   service.ID,
			ClientID:    clientID,
			RedirectURI: redirectURI,
		}); err != nil {
			logger.GetLogger(ctx).Warnf("failed to persist MCP oauth client: %v", err)
		}
	}

	verifier, err := transport.GenerateCodeVerifier()
	if err != nil {
		return "", "", fmt.Errorf("failed to generate PKCE verifier: %w", err)
	}
	challenge := transport.GenerateCodeChallenge(verifier)
	state, err := transport.GenerateState()
	if err != nil {
		return "", "", fmt.Errorf("failed to generate state: %w", err)
	}

	authURL, err := h.GetAuthorizationURL(ctx, state, challenge)
	if err != nil {
		return "", "", fmt.Errorf("failed to build authorization URL: %w", err)
	}

	if err := m.states.Put(ctx, state, OAuthState{
		TenantID:         tenantID,
		UserID:           principal.StorageID(),
		Principal:        principal,
		ServiceID:        service.ID,
		CodeVerifier:     verifier,

View on GitHub (pinned to 988cbb0330)

Solutions

Verify crypto/rand works on the host (check dmesg/seccomp denials for getrandom)
Fix container/sandbox security policies that block the random source
Retry the authorization start; RNG failures are typically transient
Ensure the runtime is not using a stubbed or restricted crypto provider

Defensive patterns

Strategy: retry

Validate before calling

// smoke-test crypto/rand availability at startup
if _, err := crypto_rand.Read(make([]byte, 32)); err != nil {
    log.Fatalf("crypto/rand unavailable: %v", err)
}

Try / catch

_, _, err := mgr.StartAuthorizationForService(ctx, svc, tenantID, principal, redirect, "")
if err != nil && strings.Contains(err.Error(), "PKCE verifier") {
    // RNG failure is typically transient: retry once, then surface as infra error
    if _, _, retryErr := mgr.StartAuthorizationForService(ctx, svc, tenantID, principal, redirect, ""); retryErr != nil {
        return fmt.Errorf("secure RNG unavailable on host: %w", retryErr)
    }
    return nil
}
if err != nil { return err }

Prevention

Add a startup health check that reads from crypto/rand
Avoid seccomp/AppArmor rules that block getrandom(2) in containers
Do not stub crypto/rand in production builds
Monitor entropy-related kernel logs on constrained hosts

When it happens

Trigger: transport.GenerateCodeVerifier returns an error — usually crypto/rand read failure, entropy exhaustion, or an OS-level RNG error — when building the authorize request.

Common situations: Container/host with depleted entropy (rare on modern Linux); seccomp/AppArmor policy blocking getrandom(2); running on constrained hardware; instrumented crypto/rand stub in tests returning errors.

Related errors

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/c4a4626e7ea7fc0d. Report an issue: GitHub.