{"record":{"id":"f44ee83126134938","repo":"gastownhall/beads","slug":"identity-generate-request-nonce-w","errorCode":null,"errorMessage":"identity: generate request nonce: %w","messagePattern":"identity: generate request nonce: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"internal/storage/dbproxy/identity/control.go","lineNumber":54,"sourceCode":"\tControlPort int    `json:\"control_port\"`\n\tMAC         string `json:\"mac\"`\n}\n\n// Identify authenticates to a proxy control listener and returns its identity.\nfunc Identify(host string, controlPort int, secret string, timeout time.Duration) (*IdentReply, error) {\n\taddr := net.JoinHostPort(host, strconv.Itoa(controlPort))\n\tconn, err := net.DialTimeout(\"tcp\", addr, timeout)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"identity: dial control listener: %w\", err)\n\t}\n\tdefer func() { _ = conn.Close() }()\n\n\tif err := conn.SetDeadline(time.Now().Add(timeout)); err != nil {\n\t\treturn nil, fmt.Errorf(\"identity: set control deadline: %w\", err)\n\t}\n\tnonceBytes := make([]byte, identNonceBytes)\n\tif _, err := rand.Read(nonceBytes); err != nil {\n\t\treturn nil, fmt.Errorf(\"identity: generate request nonce: %w\", err)\n\t}\n\tnonce := hex.EncodeToString(nonceBytes)\n\tif _, err := io.WriteString(conn, \"IDENT \"+secret+\" \"+nonce+\"\\n\"); err != nil {\n\t\treturn nil, fmt.Errorf(\"identity: write request: %w\", err)\n\t}\n\n\tline, err := bufio.NewReader(io.LimitReader(conn, maxIdentReplyBytes+1)).ReadString('\\n')\n\tif errors.Is(err, io.EOF) && len(line) == 0 {\n\t\treturn nil, ErrIdentRefused\n\t}\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"identity: read reply: %w\", err)\n\t}\n\tif len(line) > maxIdentReplyBytes {\n\t\treturn nil, errors.New(\"identity: oversized reply\")\n\t}\n\n\tvar reply IdentReply","sourceCodeStart":36,"sourceCodeEnd":72,"githubUrl":"https://github.com/gastownhall/beads/blob/71377f276968b452ee607177637970a4ff888584/internal/storage/dbproxy/identity/control.go#L36-L72","documentation":"Identify generates a fresh random nonce (crypto/rand) for the IDENT request to prevent replay. This error wraps rand.Read failing, which indicates the system's cryptographic random source is unavailable.","triggerScenarios":"crypto/rand.Read returning an error while building the IDENT request — OS entropy source failure (e.g. broken /dev/urandom in a container or restricted environment).","commonSituations":"Hardened containers/seccomp profiles blocking getrandom(2); stripped-down environments without a working entropy source.","solutions":["Fix the environment's entropy source (restore /dev/urandom access or allow the getrandom syscall)","Review seccomp/AppArmor profiles blocking crypto/rand syscalls","Retry on a healthy host; if persistent, treat as infrastructure failure and report"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"reply, err := Identify(host, port, secret, timeout)\nif err != nil && strings.Contains(err.Error(), \"generate request nonce\") {\n\t// entropy source broken; fail fast and alert infrastructure\n}","preventionTips":["Ensure containers allow getrandom(2) / expose /dev/urandom","Audit seccomp and AppArmor profiles for crypto/rand syscalls","Monitor entropy availability in hardened environments"],"tags":["crypto","random","entropy","dbproxy"],"backgroundTag":"entropy-source-unavailable","analyzedSha":"71377f276968b452ee607177637970a4ff888584","analyzedAt":"2026-08-30T18:55:39.744Z","schemaVersion":2},"datasetVersion":"2026-08-30T23:17:21.991Z"}