{"record":{"id":"5b0c771bff958bd5","repo":"chenhg5/cc-connect","slug":"weixin-s-aes-key-w","errorCode":null,"errorMessage":"weixin: %s: aes key: %w","messagePattern":"weixin: (.+?): aes key: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"platform/weixin/media_outbound.go","lineNumber":65,"sourceCode":"\t\trc.contextToken = p.getContextToken(rc.peerUserID)\n\t}\n\tif strings.TrimSpace(rc.contextToken) == \"\" {\n\t\treturn nil, fmt.Errorf(\"weixin: missing context_token for peer %q\", rc.peerUserID)\n\t}\n\treturn rc, nil\n}\n\nfunc (p *Platform) uploadToWeixinCDN(ctx context.Context, to string, plaintext []byte, mediaType int, label string) (*cdnUploadedRef, error) {\n\tif len(plaintext) == 0 {\n\t\treturn nil, fmt.Errorf(\"weixin: %s: empty payload\", label)\n\t}\n\tif strings.TrimSpace(p.cdnBaseURL) == \"\" {\n\t\treturn nil, fmt.Errorf(\"weixin: cdn_base_url is empty\")\n\t}\n\trawSize := len(plaintext)\n\taesKey := make([]byte, 16)\n\tif _, err := rand.Read(aesKey); err != nil {\n\t\treturn nil, fmt.Errorf(\"weixin: %s: aes key: %w\", label, err)\n\t}\n\tfilekey := randomHex(16)\n\treq := getUploadURLRequest{\n\t\tFilekey:     filekey,\n\t\tMediaType:   mediaType,\n\t\tToUserID:    to,\n\t\tRawsize:     rawSize,\n\t\tRawfilemd5:  md5Hex(plaintext),\n\t\tFilesize:    aesECBPaddedSize(rawSize),\n\t\tNoNeedThumb: true,\n\t\tAeskey:      hex.EncodeToString(aesKey),\n\t}\n\tresp, err := p.api.getUploadURL(ctx, req)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"weixin: %s: %w\", label, err)\n\t}\n\t// 选择上传 URL 和 HTTP client\n\tvar cdnUploadURL string","sourceCodeStart":47,"sourceCodeEnd":83,"githubUrl":"https://github.com/chenhg5/cc-connect/blob/4000b2338aa6e850c99df54f8b0ed6ed7460b401/platform/weixin/media_outbound.go#L47-L83","documentation":"Uploading outbound media to the Weixin CDN failed at the key-generation step: the error wraps whatever the random/key derivation step returned, so no AES key could be established for encrypting the image/file/audio payload in uploadToWeixinCDN.","triggerScenarios":"rand.Read(aesKey) returning an error during SendImage/SendFile/SendAudio — essentially only when the OS CSPRNG is unavailable.","commonSituations":"Container with no access to /dev/urandom; seccomp/apparmor policy blocking getrandom syscall.","solutions":["Inspect the wrapped error to find why crypto/rand failed.","Fix the environment: ensure /dev/urandom is available or the getrandom syscall is permitted in the container/sandbox.","Restart the process on a healthy host; this failure is environmental, not fixable in code."],"exampleFix":"// docker run before\n docker run --security-opt seccomp=strict.json ...\n// after\n docker run ...  # default seccomp allows getrandom","handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := p.SendAudio(ctx, rc, audio, \"amr\"); err != nil && strings.Contains(err.Error(), \"aes key\") { log.Error(\"crypto/rand unavailable; check container entropy access\") }","preventionTips":["Ensure /dev/urandom is mounted in containers","Don't block the getrandom syscall in seccomp profiles","Treat this as environmental — alert on it rather than looping"],"tags":["weixin","media","crypto","entropy"],"backgroundTag":"http-request-failed","analyzedSha":"4000b2338aa6e850c99df54f8b0ed6ed7460b401","analyzedAt":"2026-09-06T11:45:09.575Z","contentChangedAt":"2026-09-06T11:45:09.575Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}