{"record":{"id":"e80440444efd7019","repo":"sipeed/picoclaw","slug":"generating-state-w","errorCode":null,"errorMessage":"generating state: %w","messagePattern":"generating state: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"pkg/auth/oauth.go","lineNumber":99,"sourceCode":"\tif _, err := rand.Read(buf); err != nil {\n\t\treturn \"\", err\n\t}\n\treturn hex.EncodeToString(buf), nil\n}\n\nfunc LoginBrowser(cfg OAuthProviderConfig) (*AuthCredential, error) {\n\treturn LoginBrowserWithOptions(cfg, LoginBrowserOptions{})\n}\n\nfunc LoginBrowserWithOptions(cfg OAuthProviderConfig, opts LoginBrowserOptions) (*AuthCredential, error) {\n\tpkce, err := GeneratePKCE()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"generating PKCE: %w\", err)\n\t}\n\n\tstate, err := GenerateState()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"generating state: %w\", err)\n\t}\n\n\tredirectURI := oauthCallbackRedirectURI(cfg.Port)\n\tcallbackPort := cfg.Port\n\tvar resultCh <-chan callbackResult\n\n\tif !opts.NoBrowser {\n\t\tcallbackResultCh := make(chan callbackResult, 1)\n\t\tlistener, actualPort, err := listenOAuthCallback(cfg.Port)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"starting callback server on port %d: %w\", cfg.Port, err)\n\t\t}\n\n\t\tredirectURI = oauthCallbackRedirectURI(actualPort)\n\t\tcallbackPort = actualPort\n\t\tresultCh = callbackResultCh\n\n\t\tserver := &http.Server{Handler: oauthCallbackHandler(state, callbackResultCh)}","sourceCodeStart":81,"sourceCodeEnd":117,"githubUrl":"https://github.com/sipeed/picoclaw/blob/49183d7e8daed0dba89ddbb6fcb60089401d9680/pkg/auth/oauth.go#L81-L117","documentation":"GenerateState() failed at pkg/auth/oauth.go:99 — the 32-byte crypto/rand read backing the OAuth state parameter returned an error. Like the PKCE failure, this is an OS entropy source failure, not an application bug; on healthy systems the probability is effectively zero.","triggerScenarios":"Same class as PKCE: getrandom(2) blocked by seccomp, /dev/urandom absent from the container image, or entropy pool unavailable during very early boot in minimal VMs.","commonSituations":"Hardened containers, custom VM images, or instrumented test environments with a stubbed failing rand.Reader.","solutions":["Confirm the runtime provides a working random device: head -c 32 /dev/urandom && echo ok","Adjust the sandbox profile to permit getrandom(2)","Restart the process once; persistent failure means the environment is broken, not the app"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if _, err := auth.LoginBrowser(cfg); err != nil {\n    if strings.Contains(err.Error(), \"generating state\") {\n        log.Fatal(\"OS random source unavailable; fix the runtime environment\")\n    }\n    return err\n}","preventionTips":["Verify entropy sources in hardened/sandboxed environments before shipping","Treat state-generation failure as fatal configuration, never transient"],"tags":["crypto","oauth","go","sandbox"],"backgroundTag":null,"analyzedSha":"49183d7e8daed0dba89ddbb6fcb60089401d9680","analyzedAt":"2026-08-15T21:55:41.315Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}