{"record":{"id":"c688e4991f2f7e6a","repo":"router-for-me/CLIProxyAPI","slug":"failed-to-generate-random-bytes-w-c688e4","errorCode":null,"errorMessage":"failed to generate random bytes: %w","messagePattern":"failed to generate random bytes: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/auth/codex/pkce.go","lineNumber":42,"sourceCode":"\t// Generate code challenge using S256 method\n\tcodeChallenge := generateCodeChallenge(codeVerifier)\n\n\treturn &PKCECodes{\n\t\tCodeVerifier:  codeVerifier,\n\t\tCodeChallenge: codeChallenge,\n\t}, nil\n}\n\n// generateCodeVerifier creates a cryptographically secure random string to be used\n// as the code verifier in the PKCE flow. The verifier is a high-entropy string\n// that is later used to prove possession of the client that initiated the\n// authorization request.\nfunc generateCodeVerifier() (string, error) {\n\t// Generate 96 random bytes (will result in 128 base64 characters)\n\tbytes := make([]byte, 96)\n\t_, err := rand.Read(bytes)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to generate random bytes: %w\", err)\n\t}\n\n\t// Encode to URL-safe base64 without padding\n\treturn base64.URLEncoding.WithPadding(base64.NoPadding).EncodeToString(bytes), nil\n}\n\n// generateCodeChallenge creates a code challenge from a given code verifier.\n// The challenge is derived by taking the SHA256 hash of the verifier and then\n// Base64 URL-encoding the result. This is sent in the initial authorization\n// request and later verified against the verifier.\nfunc generateCodeChallenge(codeVerifier string) string {\n\thash := sha256.Sum256([]byte(codeVerifier))\n\treturn base64.URLEncoding.WithPadding(base64.NoPadding).EncodeToString(hash[:])\n}\n","sourceCodeStart":24,"sourceCodeEnd":57,"githubUrl":"https://github.com/router-for-me/CLIProxyAPI/blob/78f0c4079e3e6273d65d03b5549cffc898703264/internal/auth/codex/pkce.go#L24-L57","documentation":"crypto/rand's rand.Read returned an error while filling the 96-byte buffer for the PKCE code verifier. On Go's standard library, rand.Read fails only when the OS entropy source is unavailable (getrandom(2)/dev/urandom errors). On any normal system this cannot happen; seeing it means the host or container runtime is broken at the OS level, or code replaced rand.Reader.","triggerScenarios":"Container/seccomp profile blocking getrandom or access to /dev/urandom; a chroot missing /dev/urandom; test code swapping crypto/rand.Reader; ancient kernels without usable entropy early in boot.","commonSituations":"Over-restrictive Docker seccomp/apparmor profiles; minimal VM images; unit tests that inject failing readers and accidentally leak into production code paths.","solutions":["Exec into the container and check readability: `head -c 16 /dev/urandom | xxd`.","Loosen the seccomp/apparmor profile to allow getrandom(2) and /dev/urandom access.","Rebuild the image with a proper /dev (tmpfs dev mode) — run docker with --device /dev/urandom or default dev setup.","Audit for rand.Reader overrides in vendored/test code."],"exampleFix":"# before: docker run --security-opt seccomp=strict.json ...\n# after: allow getrandom in the profile or use the default profile\ndocker run --security-opt seccomp=default.json ...","handlingStrategy":"validation","validationCode":"// Probe the entropy source before relying on PKCE\nb := make([]byte, 16)\nif _, err := rand.Read(b); err != nil {\n    return fmt.Errorf(\"system entropy source unavailable: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"if _, err := rand.Read(buf); err != nil {\n    // OS-level failure: fix the runtime (seccomp, /dev, kernel); do not retry blindly\n    return fmt.Errorf(\"crypto/rand unavailable: %w\", err)\n}","preventionTips":["Test container images with a simple crypto/rand read at build time.","Allow getrandom(2) in seccomp profiles; ensure /dev/urandom exists.","Never override rand.Reader in production code paths."],"tags":["crypto","entropy","container","pkce","os"],"backgroundTag":null,"analyzedSha":"78f0c4079e3e6273d65d03b5549cffc898703264","analyzedAt":"2026-08-15T12:26:37.444Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}