gastownhall/beads · critical

identity: generate request nonce: %w

Error message

identity: generate request nonce: %w

What it means

Identify generates a fresh random nonce (crypto/rand) for the IDENT request to prevent replay. This error wraps rand.Read failing, which indicates the system's cryptographic random source is unavailable.

Source

Thrown at internal/storage/dbproxy/identity/control.go:54

	ControlPort int    `json:"control_port"`
	MAC         string `json:"mac"`
}

// Identify authenticates to a proxy control listener and returns its identity.
func Identify(host string, controlPort int, secret string, timeout time.Duration) (*IdentReply, error) {
	addr := net.JoinHostPort(host, strconv.Itoa(controlPort))
	conn, err := net.DialTimeout("tcp", addr, timeout)
	if err != nil {
		return nil, fmt.Errorf("identity: dial control listener: %w", err)
	}
	defer func() { _ = conn.Close() }()

	if err := conn.SetDeadline(time.Now().Add(timeout)); err != nil {
		return nil, fmt.Errorf("identity: set control deadline: %w", err)
	}
	nonceBytes := make([]byte, identNonceBytes)
	if _, err := rand.Read(nonceBytes); err != nil {
		return nil, fmt.Errorf("identity: generate request nonce: %w", err)
	}
	nonce := hex.EncodeToString(nonceBytes)
	if _, err := io.WriteString(conn, "IDENT "+secret+" "+nonce+"\n"); err != nil {
		return nil, fmt.Errorf("identity: write request: %w", err)
	}

	line, err := bufio.NewReader(io.LimitReader(conn, maxIdentReplyBytes+1)).ReadString('\n')
	if errors.Is(err, io.EOF) && len(line) == 0 {
		return nil, ErrIdentRefused
	}
	if err != nil {
		return nil, fmt.Errorf("identity: read reply: %w", err)
	}
	if len(line) > maxIdentReplyBytes {
		return nil, errors.New("identity: oversized reply")
	}

	var reply IdentReply

View on GitHub (pinned to 71377f2769)

Solutions

1. Fix the environment's entropy source (restore /dev/urandom access or allow the getrandom syscall)
2. Review seccomp/AppArmor profiles blocking crypto/rand syscalls
3. Retry on a healthy host; if persistent, treat as infrastructure failure and report

reply, err := Identify(host, port, secret, timeout)
if err != nil && strings.Contains(err.Error(), "generate request nonce") {
	// entropy source broken; fail fast and alert infrastructure
}

When it happens

Trigger: crypto/rand.Read returning an error while building the IDENT request — OS entropy source failure (e.g. broken /dev/urandom in a container or restricted environment).

Common situations: Hardened containers/seccomp profiles blocking getrandom(2); stripped-down environments without a working entropy source.

Related errors

• failed to generate id: %w
• httpapi: request id seed: %w
• identity: generate proxy secret: %w
• failed to generate credential encryption key: %w
• identity: dial control listener: %w

AI-assisted analysis of gastownhall/beads@71377f2769 (2026-08-30). Data as JSON: /api/errors/f44ee83126134938. Report an issue: GitHub.