{"record":{"id":"f7d41f609184b0a8","repo":"tauri-apps/tauri","slug":"unable-to-generate-cryptographically-secure-keys-f","errorCode":null,"errorMessage":"unable to generate cryptographically secure keys for Tauri \\\"Isolation\\\" Pattern","messagePattern":"unable to generate cryptographically secure keys for Tauri \\\\\"Isolation\\\\\" Pattern","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"crates/tauri-codegen/src/context.rs","lineNumber":388,"sourceCode":"        // we check if `__TAURI_ISOLATION_HOOK__` exists in the isolation code\n        // before modifying the files since we inject our own `__TAURI_ISOLATION_HOOK__` reference in HTML files\n        if String::from_utf8_lossy(input).contains(\"__TAURI_ISOLATION_HOOK__\") {\n          sets_isolation_hook = true;\n        }\n        map_isolation(key, path, input, csp_hashes)\n      })?;\n\n      if !sets_isolation_hook {\n        panic!(\"The isolation application does not contain a file setting the `window.__TAURI_ISOLATION_HOOK__` value.\");\n      }\n\n      let schema = options.isolation_schema;\n\n      quote!(#root::Pattern::Isolation {\n        assets: ::std::sync::Arc::new(#assets),\n        schema: #schema.into(),\n        key: #key.into(),\n        crypto_keys: std::boxed::Box::new(::tauri::utils::pattern::isolation::Keys::new().expect(\"unable to generate cryptographically secure keys for Tauri \\\"Isolation\\\" Pattern\")),\n      })\n    }\n  };\n\n  let acl_file_path = out_dir.join(ACL_MANIFESTS_FILE_NAME);\n  let acl: BTreeMap<String, Manifest> = if acl_file_path.exists() {\n    let acl_file =\n      std::fs::read_to_string(acl_file_path).expect(\"failed to read plugin manifest map\");\n    serde_json::from_str(&acl_file).expect(\"failed to parse plugin manifest map\")\n  } else {\n    Default::default()\n  };\n\n  let capabilities_file_path = out_dir.join(CAPABILITIES_FILE_NAME);\n  let capabilities_from_files = if capabilities_file_path.exists() {\n    let capabilities_json =\n      std::fs::read_to_string(&capabilities_file_path).expect(\"failed to read capabilities\");\n    serde_json::from_str(&capabilities_json).expect(\"failed to parse capabilities\")","sourceCodeStart":370,"sourceCodeEnd":406,"githubUrl":"https://github.com/tauri-apps/tauri/blob/52e4b6e71d8632a7e648f866c442e287ecddee34/crates/tauri-codegen/src/context.rs#L370-L406","documentation":"Runtime panic in code generated by tauri-codegen for apps using the Tauri Isolation pattern. Keys::new() builds the AES-GCM encryption key by calling getrandom::fill() on the OS CSPRNG (crates/tauri-utils/src/pattern/isolation.rs); if the system randomness source is unavailable, .expect(\"unable to generate cryptographically secure keys ...\") panics while the app Context is created at startup.","triggerScenarios":"Starting an app configured with `app > security > pattern > use: \"Isolation\"` on a system where getrandom fails: /dev/urandom missing or unreadable, the getrandom(2) syscall blocked by a seccomp/AppArmor profile, a container runtime or sandbox denying it, or a kernel/VM with no usable entropy source.","commonSituations":"Hardened Docker/gVisor/Kata containers with syscall allowlists written before getrandom was common; custom minimal VM images without /dev/urandom; restricted CI executors; seccomp profiles that omit getrandom(2).","solutions":["Confirm the OS CSPRNG is reachable in the target environment: `ls -l /dev/urandom` and `head -c 16 /dev/urandom | xxd`","Allow the getrandom(2) syscall and reads of /dev/urandom in the container's seccomp / AppArmor / sandbox profile","Upgrade the container runtime or kernel — very old kernels or outdated runc/seccomp versions lack getrandom support","If the environment cannot provide entropy, switch the app off the Isolation pattern (default Brownfield pattern) in tauri.conf.json"],"exampleFix":"// tauri.conf.json — before\n\"security\": { \"pattern\": { \"use\": \"Isolation\" } }\n\n// after (environment cannot supply entropy)\n\"security\": { \"csp\": \"default-src 'self'\" } // drop Isolation","handlingStrategy":"validation","validationCode":"// probe the OS CSPRNG in the exact deployment environment before enabling Isolation\nfn os_rng_ok() -> bool {\n    let mut buf = [0u8; 1];\n    getrandom::fill(&mut buf).is_ok()\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Smoke-test app startup inside the actual container/VM image, not just on the dev machine","Allow getrandom(2) and /dev/urandom in seccomp/AppArmor profiles","Keep the Isolation pattern only when the deployment environments are known to provide entropy"],"tags":["isolation","cryptography","getrandom","runtime","panic"],"backgroundTag":"crypto-rng-unavailable","analyzedSha":"52e4b6e71d8632a7e648f866c442e287ecddee34","analyzedAt":"2026-08-20T13:59:20.734Z","contentChangedAt":"2026-08-20T13:59:20.734Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}