{"record":{"id":"a34f37de0c7be58d","repo":"hashicorp/packer","slug":"generate-ephemeral-keypair-w","errorCode":null,"errorMessage":"generate ephemeral keypair: %w","messagePattern":"generate ephemeral keypair: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/sign_keyless.go","lineNumber":107,"sourceCode":"\tcert     *x509.Certificate\n\tverifier Verifier\n\tkeyID    string\n}\n\nfunc newKeylessSigner(ctx context.Context, cfg BackendConfig) (Signer, error) {\n\tfulcioURL := strings.TrimSpace(cfg.FulcioURL)\n\tif fulcioURL == \"\" {\n\t\tfulcioURL = defaultFulcioURL\n\t}\n\n\tidToken, err := resolveAmbientIDToken(ctx, cfg.Env)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tkeypair, err := newKeylessEphemeralKeypair()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"generate ephemeral keypair: %w\", err)\n\t}\n\n\tfulcio := newKeylessFulcio(fulcioURL)\n\tcertDER, err := fulcio.GetCertificate(ctx, keypair, &sigstoregosign.CertificateProviderOptions{IDToken: idToken})\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"request Fulcio certificate: %w\", err)\n\t}\n\n\tcertificate, err := x509.ParseCertificate(certDER)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"parse Fulcio certificate: %w\", err)\n\t}\n\n\tcertPEM := pem.EncodeToMemory(&pem.Block{Type: \"CERTIFICATE\", Bytes: certDER})\n\tverifier, err := newSigstoreVerifierFromPublicKey(certificate.PublicKey)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"create keyless verifier: %w\", err)\n\t}","sourceCodeStart":89,"sourceCodeEnd":125,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/sign_keyless.go#L89-L125","documentation":"This error wraps a failure from sigstoregosign.NewEphemeralKeypair, which generates the short-lived ECDSA keypair used for keyless signing before requesting a Fulcio certificate. The library throws it when local key generation fails, typically because the system's crypto/rand entropy source is unavailable or the underlying crypto operation fails. This is rare and indicates a host-level crypto environment problem rather than a configuration issue.","triggerScenarios":"newKeylessSigner (internal/attestation/sign_keyless.go:105-108) calls newKeylessEphemeralKeypair during keyless signing setup; error surfaces when crypto/rand reads fail or the elliptic key generation errors in the sigstore-go SDK.","commonSituations":"Running in a sandbox/container with a blocked or unseeded /dev/urandom; restricted seccomp policies blocking getrandom; heavily constrained environments where the RNG device is unavailable.","solutions":["Check that the host's entropy source is available (test with `head -c 16 /dev/urandom` or a small Go program calling crypto/rand).","Fix container/sandbox security policies (seccomp/apparmor) to allow getrandom(2) or access to /dev/urandom.","Retry the run; transient RNG failures are rare but possible.","If persistent, check the Go runtime version for known crypto/rand issues and upgrade."],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"signer, err := newKeylessSigner(ctx, cfg)\nif err != nil && strings.Contains(err.Error(), \"generate ephemeral keypair\") {\n    // verify host entropy source, then retry once\n}","preventionTips":["Ensure containers/sandboxes permit getrandom(2) and /dev/urandom.","Keep Go runtime up to date.","Treat this as environmental: alert on it rather than silencing it."],"tags":["crypto","keypair-generation","entropy"],"backgroundTag":"random-source-unavailable","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}