What causes "failed to generate CID: %w" in larksuite/cli?

Restore access to the system entropy source (/dev/urandom) or fix the crypto/rand failure reported in the wrapped cause

failed to generate CID: %w

Error message

failed to generate CID: %w

What it means

generateCID creates a random UUID used as a Content-ID; if the crypto/random source fails (uuid.NewRandom error), the failure is wrapped with this message. UUIDs are used precisely to avoid filename-derived cid issues, so a generation failure means the environment's randomness source is unavailable.

Source

Thrown at shortcuts/mail/draft/patch.go:1012

// or protocol-relative URL (//host/...) is rejected.
func isLocalFileSrc(src string) bool {
	trimmed := strings.TrimSpace(src)
	if trimmed == "" {
		return false
	}
	if strings.HasPrefix(trimmed, "//") {
		return false
	}
	return !uriSchemeRegexp.MatchString(trimmed)
}

// generateCID returns a random UUID string suitable for use as a Content-ID.
// UUIDs contain only [0-9a-f-], which is inherently RFC-safe and unique,
// avoiding all filename-derived encoding/collision issues.
func generateCID() (string, error) {
	id, err := uuid.NewRandom()
	if err != nil {
		return "", fmt.Errorf("failed to generate CID: %w", err)
	}
	return id.String(), nil
}

// LocalImageRef represents a local image found in an HTML body that needs
// to be embedded as an inline MIME part.
type LocalImageRef struct {
	FilePath string // original src value from the HTML
	CID      string // generated Content-ID
}

// ResolveLocalImagePaths scans HTML for <img src="local/path"> references,
// validates each path, generates CIDs, and returns the modified HTML with
// cid: URIs plus the list of local image references to embed as inline parts.
// This function handles only the HTML transformation; callers are responsible
// for embedding the actual file data (e.g., via emlbuilder.AddFileInline).
func ResolveLocalImagePaths(html string) (string, []LocalImageRef, error) {
	matches := imgSrcRegexp.FindAllStringSubmatchIndex(html, -1)

View on GitHub (pinned to 7fd6ef3c07)

Solutions

Restore access to the system entropy source (/dev/urandom) or fix the crypto/rand failure reported in the wrapped cause
Retry the operation once the environment issue is fixed
Check the wrapped cause (%w) for the underlying OS error to pinpoint the environment problem

Example fix

# before (restricted container)
docker run --security-opt ... image  # /dev/urandom blocked
# after
# allow device access or run with default seccomp so crypto/rand works
docker run image

Defensive patterns

Strategy: retry

Validate before calling

if _, err := uuid.NewRandom(); err != nil {
	// entropy source unavailable — fix environment (e.g. /dev/urandom access) before running
}

Try / catch

cid, err := generateCID()
if err != nil {
	// inspect wrapped cause for OS/crypto/rand error; repair entropy source, then retry
	return fmt.Errorf("cid generation failed: %w", err)
}

Prevention

Run in environments with a working entropy source (default seccomp, /dev/urandom accessible)
Log the wrapped cause to identify the underlying OS error
Retry once transient resource issues are resolved; persisting failure is environmental

When it happens

Trigger: uuid.NewRandom failing due to the OS entropy source being unavailable (e.g. /dev/urandom inaccessible, restricted container, low-level crypto/rand error) during ResolveLocalImagePaths inline embedding.

Common situations: Sandboxes or hardened containers blocking /dev/urandom; memory/exhaustion errors from crypto/rand; unusual OS images without a random device.

Related errors

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/0fee72988874854d. Report an issue: GitHub.