{"record":{"id":"6796b3fe5058e765","repo":"nektos/act","slug":"generate-auth-token-w","errorCode":null,"errorMessage":"generate auth token: %w","messagePattern":"generate auth token: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"pkg/artifactcache/handler.go","lineNumber":92,"sourceCode":"\t\treturn nil, err\n\t}\n\th.storage = storage\n\n\tif customExternalURL != \"\" {\n\t\th.customExternalURL = customExternalURL\n\t}\n\n\tif outboundIP != \"\" {\n\t\th.outboundIP = outboundIP\n\t} else if ip := common.GetOutboundIP(); ip == nil {\n\t\treturn nil, fmt.Errorf(\"unable to determine outbound IP address\")\n\t} else {\n\t\th.outboundIP = ip.String()\n\t}\n\n\ttokenBytes := make([]byte, 16)\n\tif _, err := rand.Read(tokenBytes); err != nil {\n\t\treturn nil, fmt.Errorf(\"generate auth token: %w\", err)\n\t}\n\th.token = hex.EncodeToString(tokenBytes)\n\n\trouter := httprouter.New()\n\tbase := \"/\" + h.token + apiPath\n\trouter.GET(base+\"/cache\", h.middleware(h.find))\n\trouter.POST(base+\"/caches\", h.middleware(h.reserve))\n\trouter.PATCH(base+\"/caches/:id\", h.middleware(h.upload))\n\trouter.POST(base+\"/caches/:id\", h.middleware(h.commit))\n\trouter.GET(base+\"/artifacts/:id\", h.middleware(h.get))\n\trouter.POST(base+\"/clean\", h.middleware(h.clean))\n\n\th.router = router\n\n\th.gcCache()\n\n\tlistener, err := net.Listen(\"tcp\", fmt.Sprintf(\"%s:%d\", h.outboundIP, port))\n\tif err != nil {","sourceCodeStart":74,"sourceCodeEnd":110,"githubUrl":"https://github.com/nektos/act/blob/4f411281417e88660bea1c1a1749aa71ae0bd60f/pkg/artifactcache/handler.go#L74-L110","documentation":"The artifact cache server generates a random 16-byte auth token (crypto/rand) that scopes every HTTP route ('/<token>/api/...'). If rand.Read fails — which for crypto/rand realistically means the OS entropy source is unavailable or blocked — server startup aborts with the wrapped 'generate auth token: %w' error before the HTTP router is created.","triggerScenarios":"Starting act (or NewHandler directly) on a system where crypto/rand cannot read entropy: early-boot entropy starvation on minimal VMs/containers, a broken /dev/urandom, or seccomp/container runtimes blocking getrandom(2).","commonSituations":"act inside tightly sandboxed containers with syscalls filtered; embedded/minimal systems before the entropy pool is initialized; rare kernel/runtime misconfigurations; Go runtimes on platforms with faulty entropy plumbing.","solutions":["Verify the OS entropy source: check that /dev/urandom is readable and getrandom is not blocked by seccomp/apparmor profiles.","If running act in a container, allow getrandom(2) in the security profile or use a less restrictive runtime.","On entropy-starved VMs, wait until the pool is ready or install haveged/virtio-rng.","Update the Go toolchain / act build if the failure persists, since older runtimes had entropy bugs on some platforms."],"exampleFix":"# before\nact -j build   # inside container with seccomp blocking getrandom\n# -> generate auth token: ...\n\n# after\n# run with a profile permitting getrandom, e.g.:\ndocker run --security-opt seccomp=unconfined ... act -j build","handlingStrategy":"retry","validationCode":"package main\n\nimport (\n\t\"crypto/rand\"\n\t\"fmt\"\n\t\"os\"\n)\n\nfunc entropyAvailable() error {\n\tf, err := os.Open(\"/dev/urandom\")\n\tif err != nil {\n\t\treturn fmt.Errorf(\"entropy source unavailable: %w\", err)\n\t}\n\tdefer f.Close()\n\tbuf := make([]byte, 8)\n\tif _, err := rand.Read(buf); err != nil {\n\t\treturn fmt.Errorf(\"crypto/rand read failed: %w\", err)\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":"handler, err := artifactcache.NewHandler(...)\nif err != nil && strings.Contains(err.Error(), \"generate auth token\") {\n    // entropy starvation can be transient on cold VMs: brief retry before failing\n    time.Sleep(2 * time.Second)\n    handler, err = artifactcache.NewHandler(...)\n    if err != nil {\n        return fmt.Errorf(\"system entropy unavailable (getrandom blocked?); fix sandbox/kernel: %w\", err)\n    }\n}","preventionTips":["Permit getrandom(2) in container seccomp profiles running act.","Install virtio-rng/haveged on entropy-starved VMs.","Treat repeated crypto/rand failures as an environment defect, not a code bug."],"tags":["entropy","crypto-rand","artifact-cache","sandboxing"],"backgroundTag":null,"analyzedSha":"4f411281417e88660bea1c1a1749aa71ae0bd60f","analyzedAt":"2026-08-15T09:19:46.307Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}