{"record":{"id":"f05e18b3df2a9d81","repo":"chenhg5/cc-connect","slug":"yuanbao-generate-nonce-w","errorCode":null,"errorMessage":"yuanbao: generate nonce: %w","messagePattern":"yuanbao: generate nonce: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"platform/yuanbao/sign.go","lineNumber":126,"sourceCode":"\ts := now.Format(\"2006-01-02T15:04:05+08:00\")\n\treturn s\n}\n\nfunc fetchToken(appKey, appSecret, apiDomain, routeEnv string) (*tokenData, error) {\n\tif apiDomain == \"\" {\n\t\tapiDomain = defaultAPIDomain\n\t}\n\turlStr := strings.TrimRight(apiDomain, \"/\") + tokenPath\n\tclient := &http.Client{Timeout: httpTimeout}\n\tvar lastErr error\n\n\tfor attempt := 0; attempt <= maxRetries; attempt++ {\n\t\tif attempt > 0 {\n\t\t\ttime.Sleep(retryDelay)\n\t\t}\n\t\tnonceBytes := make([]byte, 16)\n\t\tif _, err := rand.Read(nonceBytes); err != nil {\n\t\t\tlastErr = fmt.Errorf(\"yuanbao: generate nonce: %w\", err)\n\t\t\tcontinue\n\t\t}\n\t\tnonce := hex.EncodeToString(nonceBytes)\n\t\ttimestamp := buildTimestamp()\n\t\tsignature := computeSignature(nonce, timestamp, appKey, appSecret)\n\n\t\tpayload := map[string]string{\n\t\t\t\"app_key\": appKey, \"nonce\": nonce,\n\t\t\t\"signature\": signature, \"timestamp\": timestamp,\n\t\t}\n\t\tbody, _ := json.Marshal(payload)\n\n\t\treq, err := http.NewRequest(\"POST\", urlStr, strings.NewReader(string(body)))\n\t\tif err != nil {\n\t\t\tlastErr = fmt.Errorf(\"yuanbao: create request: %w\", err)\n\t\t\tcontinue\n\t\t}\n\t\treq.Header.Set(\"Content-Type\", \"application/json\")","sourceCodeStart":108,"sourceCodeEnd":144,"githubUrl":"https://github.com/chenhg5/cc-connect/blob/4000b2338aa6e850c99df54f8b0ed6ed7460b401/platform/yuanbao/sign.go#L108-L144","documentation":"Thrown by fetchToken when crypto/rand.Read fails to fill the 16-byte nonce buffer during token acquisition. This means the OS entropy source is unavailable or the cryptographic RNG errored — on modern Linux this is nearly always a sign of a serious system-level problem (e.g. exhausted/degraded entropy, restricted /dev/urandom, seccomp blocking getrandom).","triggerScenarios":"rand.Read returns a non-nil error inside the token fetch retry loop (up to maxRetries attempts with retryDelay backoff); lastErr holds the wrapped cause and the loop continues to the next attempt. Callers: getToken, VerifyCredentials.","commonSituations":"Containers/seccomp profiles blocking the getrandom syscall, stripped-down VMs or embedded systems with broken /dev/urandom, or a compromised/misconfigured CSPRNG in exotic environments. Also seen in sandboxes that stub crypto/rand.","solutions":["Inspect the wrapped error from lastErr/logs to identify the syscall failure (getrandom vs /dev/urandom) and fix the container/seccomp policy to allow getrandom.","Verify /dev/urandom is present and readable in the deployment environment (ls -l /dev/urandom; test with dd if=/dev/urandom of=/dev/null bs=16 count=1).","Upgrade the base image/kernel if running on an old or minimal system with broken RNG support.","Check that the host's entropy/CRNG initialized correctly (dmesg for 'random: crng init done').","Rely on the existing retry/backoff: if the failure is transient the loop retries up to maxRetries; surface the final error if all attempts fail."],"exampleFix":"// before\nnonceBytes := make([]byte, 16)\nif _, err := rand.Read(nonceBytes); err != nil {\n    lastErr = fmt.Errorf(\"yuanbao: generate nonce: %w\", err)\n    continue\n}\n// after (host-side fix: allow getrandom in the sandbox)\n// Docker: drop the seccomp restriction or add \"getrandom\" to the allowlist\n// docker run --security-opt seccomp=allowed-syscalls.json ...","handlingStrategy":"retry","validationCode":"func entropyAvailable() error {\n    b := make([]byte, 16)\n    if _, err := rand.Read(b); err != nil {\n        return fmt.Errorf(\"entropy source unavailable: %w\", err)\n    }\n    return nil\n} // call at startup, before attempting token fetch","typeGuard":null,"tryCatchPattern":"token, err := fetchToken(ctx, cfg)\nif err != nil {\n    if strings.Contains(err.Error(), \"generate nonce\") {\n        slog.Error(\"crypto RNG failed; environment problem\", \"err\", err)\n        // do NOT retry locally forever — fail health check, alert operator\n        return fmt.Errorf(\"token fetch blocked by RNG failure: %w\", err)\n    }\n    return err\n}","preventionTips":["Verify the container/seccomp profile permits getrandom before deployment.","Check /dev/urandom readability in minimal images at startup.","Pre-flight the RNG with a self-check on boot (fail fast, alert).","Keep retry backoff but cap total attempts and surface the wrapped cause."],"tags":["crypto","entropy","nonce","yuanbao"],"backgroundTag":"entropy-source-failed","analyzedSha":"4000b2338aa6e850c99df54f8b0ed6ed7460b401","analyzedAt":"2026-09-06T11:45:09.575Z","contentChangedAt":"2026-09-06T11:45:09.575Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}