{"record":{"id":"6c62357005c82d16","repo":"atuinsh/atuin","slug":"failed-to-generate-random-bytes","errorCode":null,"errorMessage":"Failed to generate random bytes!","messagePattern":"Failed to generate random bytes!","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"crates/atuin-common/src/utils.rs","lineNumber":16,"sourceCode":"use std::env;\nuse std::ffi::OsString;\nuse std::path::{Path, PathBuf};\n\nuse base64::prelude::{BASE64_URL_SAFE_NO_PAD, Engine};\nuse getrandom::fill;\nuse uuid::Uuid;\n\n/// Generate N random bytes, using a cryptographically secure source\n#[must_use]\npub fn crypto_random_bytes<const N: usize>() -> [u8; N] {\n    // rand say they are in principle safe for crypto purposes, but that it is perhaps a better\n    // idea to use getrandom for things such as passwords.\n    let mut ret = [0u8; N];\n\n    fill(&mut ret).expect(\"Failed to generate random bytes!\");\n\n    ret\n}\n\n/// Generate N random bytes using a cryptographically secure source, return encoded as a string\n#[must_use]\npub fn crypto_random_string<const N: usize>() -> String {\n    let bytes = crypto_random_bytes::<N>();\n\n    // We only use this to create a random string, and won't be reversing it to find the original\n    // data - no padding is OK there. It may be in URLs.\n    BASE64_URL_SAFE_NO_PAD.encode(bytes)\n}\n\n#[must_use]\npub fn uuid_v7() -> Uuid {\n    Uuid::now_v7()\n}","sourceCodeStart":1,"sourceCodeEnd":34,"githubUrl":"https://github.com/atuinsh/atuin/blob/c0c717ab04c881764bcad4b3d169a507e2432643/crates/atuin-common/src/utils.rs#L1-L34","documentation":"`crypto_random_bytes` calls `getrandom::fill` to source cryptographically secure randomness and panics if the OS entropy source fails. The `getrandom` crate only errors when the operating system cannot provide randomness (e.g. getrandom(2)//dev/urandom unavailable). This backs session/key generation in Atuin.","triggerScenarios":"Any call to `crypto_random_bytes::<N>()` (used for key/session generation) when the kernel's entropy source is unavailable or blocked at startup.","commonSituations":"Early-boot containers/VMs before the kernel RNG is seeded; heavily restricted seccomp profiles blocking the getrandom syscall; embedded or minimal Linux systems without /dev/urandom.","solutions":["Ensure the kernel entropy pool is initialized (wait for `crng_init` / use `kernel.randomize_va_space` defaults)","Fix container seccomp/apparmor profiles to allow the getrandom syscall","Verify /dev/urandom exists and is readable inside the runtime environment","Update getrandom crate and OS tooling if on an old kernel with RNG initialization bugs"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":"// Use fallable getrandom directly instead of the panicking wrapper:\nlet mut buf = [0u8; N];\ngetrandom::fill(&mut buf).map_err(|e| MyError::EntropyUnavailable(e))?","preventionTips":["Verify getrandom syscall availability in container seccomp profiles","Delay crypto-dependent startup until kernel RNG is seeded on embedded/early-boot systems","Monitor entropy availability in minimal VM images"],"tags":["crypto","entropy","panic","system"],"backgroundTag":"missing-dependency","analyzedSha":"c0c717ab04c881764bcad4b3d169a507e2432643","analyzedAt":"2026-09-12T07:40:01.341Z","contentChangedAt":"2026-09-12T07:40:01.341Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}