{"record":{"id":"ffbb7988d56933ee","repo":"JuliusBrussee/caveman","slug":"envelope-data-key-entropy-w","errorCode":null,"errorMessage":"envelope: data key entropy: %w","messagePattern":"envelope: data key entropy: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"shared/platform/envelope/envelope.go","lineNumber":72,"sourceCode":"func Seal(plaintext []byte) (ciphertext []byte, metaJSON []byte, err error) {\n\treturn seal(plaintext, schemeV1, nil, \"\")\n}\n\n// SealForScope binds ciphertext authentication to tenant/object scope. Moving\n// ciphertext plus metadata to another tenant, project, or object class makes\n// decryption fail even when storage and KMS credentials are compromised.\nfunc SealForScope(plaintext []byte, scope Scope) (ciphertext []byte, metaJSON []byte, err error) {\n\taad, scopeHash, err := scopeAAD(scope)\n\tif err != nil {\n\t\treturn nil, nil, err\n\t}\n\treturn seal(plaintext, schemeV2, aad, scopeHash)\n}\n\nfunc seal(plaintext []byte, scheme string, aad []byte, scopeHash string) (ciphertext []byte, metaJSON []byte, err error) {\n\tdataKey := make([]byte, 32)\n\tif _, err := rand.Read(dataKey); err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"envelope: data key entropy: %w\", err)\n\t}\n\tblock, err := aes.NewCipher(dataKey)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"envelope: aes: %w\", err)\n\t}\n\tgcm, err := cipher.NewGCM(block)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"envelope: gcm: %w\", err)\n\t}\n\tnonce := make([]byte, gcm.NonceSize())\n\tif _, err := rand.Read(nonce); err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"envelope: nonce entropy: %w\", err)\n\t}\n\tciphertext = gcm.Seal(nonce, nonce, plaintext, aad)\n\n\twrapped, err := secretbox.EncryptPayloadKey(dataKey)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"envelope: wrap data key: %w\", err)","sourceCodeStart":54,"sourceCodeEnd":90,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/766dce6b1394ebb56a3090748d5a0240a5aefb36/shared/platform/envelope/envelope.go#L54-L90","documentation":"The envelope sealer's crypto/rand read for the 32-byte data key failed. A failure from the system entropy source means secure key generation is impossible; the seal aborts before producing any ciphertext rather than encrypting under a possibly weak or empty key.","triggerScenarios":"Thrown at shared/platform/envelope/envelope.go:72 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check system entropy source availability (/dev/urandom, getrandom)","If persistent, the host or container runtime is broken — restart or replace it"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"766dce6b1394ebb56a3090748d5a0240a5aefb36","analyzedAt":"2026-08-18T03:14:35.516Z","contentChangedAt":"2026-08-18T03:14:35.516Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}