{"record":{"id":"910c13141ec87f73","repo":"gastownhall/beads","slug":"failed-to-generate-id-w","errorCode":null,"errorMessage":"failed to generate id: %w","messagePattern":"failed to generate id: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"internal/audit/audit.go","lineNumber":194,"sourceCode":"\t\t\"old_value\": oldValue,\n\t\t\"new_value\": newValue,\n\t}\n\tif reason != \"\" {\n\t\textra[\"reason\"] = reason\n\t}\n\t_, _ = AppendIfEnabled(&Entry{\n\t\tKind:    \"field_change\",\n\t\tIssueID: issueID,\n\t\tActor:   actor,\n\t\tExtra:   extra,\n\t})\n}\n\nfunc newID() (string, error) {\n\t// 16 bytes (128-bit) of entropy — birthday probability for 8000 IDs is ~9e-32.\n\tvar b [16]byte\n\tif _, err := rand.Read(b[:]); err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to generate id: %w\", err)\n\t}\n\treturn idPrefix + hex.EncodeToString(b[:]), nil\n}\n","sourceCodeStart":176,"sourceCodeEnd":198,"githubUrl":"https://github.com/gastownhall/beads/blob/71377f276968b452ee607177637970a4ff888584/internal/audit/audit.go#L176-L198","documentation":"newID generates a 16-byte random ID with crypto/rand and wraps any rand.Read failure as \"failed to generate id\". crypto/rand.Read failing indicates the OS entropy source is unavailable — extremely rare on Linux/macOS, but possible on the Windows RNG path or in restricted sandboxes. Since Append calls newID, this error surfaces as a failed audit append before any file I/O.","triggerScenarios":"crypto/rand.Read returning an error because /dev/urandom (or getrandom(2)) is unavailable; containers with blocked syscall access; platforms where the RNG fails during early boot or under severe resource exhaustion.","commonSituations":"Highly restricted container runtimes (some minimal seccomp profiles); unusual or ancient platforms; virtualized environments with entropy-starved kernels (mostly historical).","solutions":["Retry the operation — the failure is usually transient or spurious.","Check the sandbox/seccomp profile allows getrandom(2) or /dev/urandom reads.","Verify the container image/platform has a working /dev/urandom device.","Upgrade Go/runtime platform if on a known-affected platform.","Inspect the wrapped %w cause to confirm the exact RNG failure."],"exampleFix":"// before\nid, err := auditAppendWithNewID() // \"failed to generate id: ...\"\n// after\nfor i := 0; i < 3; i++ {\n    id, err = auditAppendWithNewID()\n    if err == nil { break }\n    time.Sleep(10 * time.Millisecond)\n}","handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"failed to generate id\") {\n    // transient RNG failure: retry with backoff\n    for i := 0; i < 3 && err != nil; i++ {\n        time.Sleep(time.Duration(1<<i) * 10 * time.Millisecond)\n        _, err = doAppend()\n    }\n}","preventionTips":["Ensure sandboxes/seccomp profiles allow getrandom(2) and /dev/urandom.","Retry RNG-dependent operations once before failing.","Keep /dev/urandom available in minimal container images."],"tags":["go","crypto","random","entropy"],"backgroundTag":"crypto-rand-failure","analyzedSha":"71377f276968b452ee607177637970a4ff888584","analyzedAt":"2026-08-30T18:55:39.744Z","schemaVersion":2},"datasetVersion":"2026-08-30T23:17:21.991Z"}