{"record":{"id":"c34f73e7f68c7c3c","repo":"caddyserver/caddy","slug":"generating-random-confirmation-bytes-v","errorCode":null,"errorMessage":"generating random confirmation bytes: %v","messagePattern":"generating random confirmation bytes: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/commandfuncs.go","lineNumber":111,"sourceCode":"\t\tcmd.Args = append(cmd.Args, \"--watch\")\n\t}\n\tif pidfileFlag != \"\" {\n\t\tcmd.Args = append(cmd.Args, \"--pidfile\", pidfileFlag)\n\t}\n\tstdinPipe, err := cmd.StdinPipe()\n\tif err != nil {\n\t\treturn caddy.ExitCodeFailedStartup,\n\t\t\tfmt.Errorf(\"creating stdin pipe: %v\", err)\n\t}\n\tcmd.Stdout = os.Stdout\n\tcmd.Stderr = os.Stderr\n\n\t// generate the random bytes we'll send to the child process\n\texpect := make([]byte, 32)\n\t_, err = rand.Read(expect)\n\tif err != nil {\n\t\treturn caddy.ExitCodeFailedStartup,\n\t\t\tfmt.Errorf(\"generating random confirmation bytes: %v\", err)\n\t}\n\n\t// begin writing the confirmation bytes to the child's\n\t// stdin; use a goroutine since the child hasn't been\n\t// started yet, and writing synchronously would result\n\t// in a deadlock\n\tgo func() {\n\t\t_, _ = stdinPipe.Write(expect)\n\t\tstdinPipe.Close()\n\t}()\n\n\t// start the process\n\terr = cmd.Start()\n\tif err != nil {\n\t\treturn caddy.ExitCodeFailedStartup,\n\t\t\tfmt.Errorf(\"starting caddy process: %v\", err)\n\t}\n","sourceCodeStart":93,"sourceCodeEnd":129,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/cmd/commandfuncs.go#L93-L129","documentation":"Returned by `caddy start` when crypto/rand.Read fails while generating the 32 random confirmation bytes for the parent-child handshake. Go documents rand.Read as never failing on supported platforms (it panics on unsupported ones), so encountering this error is exceptional — it indicates a broken system entropy source in a custom build or unusual platform.","triggerScenarios":"Effectively unreachable with standard Go on Linux/macOS/Windows; conceivable on platforms where getrandom(2) is unavailable such as very old kernels or restricted sandboxes using Go versions predating the fallback chain.","commonSituations":"Near-zero incidence; would surface only on exotic kernels, gVisor-style sandboxes with blocked entropy syscalls, or heavily patched Go runtimes.","solutions":["Verify entropy availability: cat /proc/sys/kernel/random/entropy_stat on Linux","Upgrade the Go toolchain used to build Caddy (modern rand.Read cannot return an error)","Run on a supported platform/kernel for the Go version in use"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep the Go toolchain and Caddy build current — rand.Read cannot fail on supported platforms","On exotic kernels, verify getrandom(2) availability before deploying"],"tags":["cli","caddy-start","crypto-rand","platform"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}