{"record":{"id":"76646b6a5b059932","repo":"tauri-apps/tauri","slug":"failed-to-get-random-bytes-76646b","errorCode":null,"errorMessage":"failed to get random bytes","messagePattern":"failed to get random bytes","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/tauri/src/protocol/asset.rs","lineNumber":230,"sourceCode":"    // avoid reading the file if we already read it\n    // as part of mime type detection\n    let buf = if let Some(b) = read_bytes {\n      b\n    } else {\n      let mut local_buf = Vec::with_capacity(len as usize);\n      file.read_to_end(&mut local_buf)?;\n      local_buf\n    };\n    resp = resp.header(CONTENT_LENGTH, len);\n    resp.body(buf.into())\n  };\n\n  response.map_err(Into::into)\n}\n\nfn random_boundary() -> String {\n  let mut x = [0_u8; 30];\n  getrandom::fill(&mut x).expect(\"failed to get random bytes\");\n  (x[..])\n    .iter()\n    .map(|&x| format!(\"{x:x}\"))\n    .fold(String::new(), |mut a, x| {\n      a.push_str(x.as_str());\n      a\n    })\n}\n","sourceCodeStart":212,"sourceCodeEnd":239,"githubUrl":"https://github.com/tauri-apps/tauri/blob/52e4b6e71d8632a7e648f866c442e287ecddee34/crates/tauri/src/protocol/asset.rs#L212-L239","documentation":"The asset protocol builds multipart responses (e.g. range requests) and generates a random boundary with getrandom::fill(). The expect fires when the OS entropy source fails: getrandom(2)/ /dev/urandom blocked by a sandbox, broken device node, or unsupported kernel.","triggerScenarios":"Serving assets over the custom asset protocol (asset: URL / app.asset_protocol enabled) inside a container with a seccomp profile that denies the getrandom syscall or /dev/urandom.","commonSituations":"Hardened Docker/seccomp or gVisor environments; minimal embedded images. Effectively unreachable on standard desktop platforms.","solutions":["Permit getrandom(2) and /dev/urandom in the container security profile.","Use a standard base image / newer kernel.","Disable the asset protocol for that deployment if it is not needed."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"let mut probe = [0u8; 8];\nif getrandom::fill(&mut probe).is_err() {\n    return Err(\"OS entropy unavailable for asset protocol boundaries\".into());\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Do not block getrandom(2) or /dev/urandom in hardened container profiles.","Verify the asset protocol works in the production sandbox image."],"tags":["tauri","asset-protocol","multipart","getrandom","sandbox","entropy"],"backgroundTag":"os-entropy-unavailable","analyzedSha":"52e4b6e71d8632a7e648f866c442e287ecddee34","analyzedAt":"2026-08-20T13:59:20.734Z","schemaVersion":2},"datasetVersion":"2026-08-31T22:30:34.772Z"}