{"record":{"id":"8e7022f4309bd2c6","repo":"JuliusBrussee/caveman","slug":"kms-generate-probe-w","errorCode":null,"errorMessage":"kms: generate probe: %w","messagePattern":"kms: generate probe: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"shared/platform/kms/kms.go","lineNumber":320,"sourceCode":"}\n\n// ProbePayloadProduction performs the same live round-trip with the payload KEK.\nfunc ProbePayloadProduction(ctx context.Context) error {\n\tif !runtimeenv.IsProduction() {\n\t\treturn nil\n\t}\n\tclient, err := FromPayloadEnvironment()\n\tif err != nil {\n\t\treturn err\n\t}\n\treturn client.Probe(ctx)\n}\n\n// Probe verifies live key access without persisting tenant data.\nfunc (c *Client) Probe(ctx context.Context) error {\n\tplaintext := make([]byte, 32)\n\tif _, err := rand.Read(plaintext); err != nil {\n\t\treturn fmt.Errorf(\"kms: generate probe: %w\", err)\n\t}\n\tenvelope, err := c.Encrypt(ctx, plaintext)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"kms: probe encrypt: %w\", err)\n\t}\n\tdecrypted, err := c.Decrypt(ctx, envelope)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"kms: probe decrypt: %w\", err)\n\t}\n\tif !bytes.Equal(decrypted, plaintext) {\n\t\treturn errors.New(\"kms: probe plaintext mismatch\")\n\t}\n\treturn nil\n}\n\nfunc validateLocation(region, keyID string) error {\n\tif !regionPattern.MatchString(region) {\n\t\treturn errors.New(\"kms: invalid Scaleway region\")","sourceCodeStart":302,"sourceCodeEnd":338,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/766dce6b1394ebb56a3090748d5a0240a5aefb36/shared/platform/kms/kms.go#L302-L338","documentation":"Client.Probe wraps the crypto/rand.Read failure while generating the 32 random probe bytes for the live encrypt/decrypt round-trip. This fires only when the OS entropy source fails (crypto/rand.Read returning an error is extremely rare and usually signals a broken/degraded system CSPRNG).","triggerScenarios":"Thrown at shared/platform/kms/kms.go:320 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Investigate host entropy/CSPRNG health; crypto/rand failing indicates a system-level problem","Retry the probe after the host recovers","Check container/host configuration that could deplete or block the entropy source"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"766dce6b1394ebb56a3090748d5a0240a5aefb36","analyzedAt":"2026-08-18T03:14:35.516Z","contentChangedAt":"2026-08-18T03:14:35.516Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}