atuinsh/atuin · critical

Failed to generate random bytes!

Error message

Failed to generate random bytes!

What it means

`crypto_random_bytes` calls `getrandom::fill` to source cryptographically secure randomness and panics if the OS entropy source fails. The `getrandom` crate only errors when the operating system cannot provide randomness (e.g. getrandom(2)//dev/urandom unavailable). This backs session/key generation in Atuin.

Solutions

1. Ensure the kernel entropy pool is initialized (wait for `crng_init` / use `kernel.randomize_va_space` defaults)
2. Fix container seccomp/apparmor profiles to allow the getrandom syscall
3. Verify /dev/urandom exists and is readable inside the runtime environment
4. Update getrandom crate and OS tooling if on an old kernel with RNG initialization bugs

// Use fallable getrandom directly instead of the panicking wrapper:
let mut buf = [0u8; N];
getrandom::fill(&mut buf).map_err(|e| MyError::EntropyUnavailable(e))?

When it happens

Trigger: Any call to `crypto_random_bytes::<N>()` (used for key/session generation) when the kernel's entropy source is unavailable or blocked at startup.

Common situations: Early-boot containers/VMs before the kernel RNG is seeded; heavily restricted seccomp profiles blocking the getrandom syscall; embedded or minimal Linux systems without /dev/urandom.

Understand the failure class

Background: "not installed", "pip install", "required for": how missing-dependency errors surface across open-source libraries — this error's family across 34 libraries.

Related errors

• Atuin running with no parent!
• clone pty reader
• Could not build config
• Could not build default
• Could not deserialize config

AI-assisted analysis of atuinsh/atuin@c0c717ab04 (2026-09-12). Data as JSON: /api/errors/6c62357005c82d16. Report an issue: GitHub.

Appendix: source

Thrown at crates/atuin-common/src/utils.rs:16

use std::env;
use std::ffi::OsString;
use std::path::{Path, PathBuf};

use base64::prelude::{BASE64_URL_SAFE_NO_PAD, Engine};
use getrandom::fill;
use uuid::Uuid;

/// Generate N random bytes, using a cryptographically secure source
#[must_use]
pub fn crypto_random_bytes<const N: usize>() -> [u8; N] {
    // rand say they are in principle safe for crypto purposes, but that it is perhaps a better
    // idea to use getrandom for things such as passwords.
    let mut ret = [0u8; N];

    fill(&mut ret).expect("Failed to generate random bytes!");

    ret
}

/// Generate N random bytes using a cryptographically secure source, return encoded as a string
#[must_use]
pub fn crypto_random_string<const N: usize>() -> String {
    let bytes = crypto_random_bytes::<N>();

    // We only use this to create a random string, and won't be reversing it to find the original
    // data - no padding is OK there. It may be in URLs.
    BASE64_URL_SAFE_NO_PAD.encode(bytes)
}

#[must_use]
pub fn uuid_v7() -> Uuid {
    Uuid::now_v7()
}

View on GitHub (pinned to c0c717ab04)