sipeed/picoclaw · warning

generating PKCE: %w

Error message

generating PKCE: %w

What it means

GeneratePKCE() failed at pkg/auth/oauth.go:94 — crypto/rand could not fill the code-verifier buffer. On any normal Linux/macOS/Windows host this cannot happen; it indicates the OS random source is unavailable or blocked (broken container runtime, hardened seccomp blocking getrandom(2), or a replaced rand.Reader in tests).

Source

Thrown at pkg/auth/oauth.go:94

}

// GenerateState generates a random state string for OAuth CSRF protection.
func GenerateState() (string, error) {
	buf := make([]byte, 32)
	if _, err := rand.Read(buf); err != nil {
		return "", err
	}
	return hex.EncodeToString(buf), nil
}

func LoginBrowser(cfg OAuthProviderConfig) (*AuthCredential, error) {
	return LoginBrowserWithOptions(cfg, LoginBrowserOptions{})
}

func LoginBrowserWithOptions(cfg OAuthProviderConfig, opts LoginBrowserOptions) (*AuthCredential, error) {
	pkce, err := GeneratePKCE()
	if err != nil {
		return nil, fmt.Errorf("generating PKCE: %w", err)
	}

	state, err := GenerateState()
	if err != nil {
		return nil, fmt.Errorf("generating state: %w", err)
	}

	redirectURI := oauthCallbackRedirectURI(cfg.Port)
	callbackPort := cfg.Port
	var resultCh <-chan callbackResult

	if !opts.NoBrowser {
		callbackResultCh := make(chan callbackResult, 1)
		listener, actualPort, err := listenOAuthCallback(cfg.Port)
		if err != nil {
			return nil, fmt.Errorf("starting callback server on port %d: %w", cfg.Port, err)
		}

View on GitHub (pinned to 49183d7e8d)

Solutions

1. Treat as environmental: verify the container/VM exposes /dev/urandom and getrandom works (head -c 32 /dev/urandom)
2. Loosen the seccomp/sandbox profile to allow getrandom
3. Restart the process — entropy pool blockage at boot self-resolves
4. Do not add retries; if the OS RNG is broken, retrying is futile and dangerous

if _, err := auth.LoginBrowserWithOptions(cfg, opts); err != nil {
    if strings.Contains(err.Error(), "generating PKCE") {
        // OS randomness unavailable: environmental, not retryable
        log.Fatal("OS random source unavailable; check sandbox/seccomp profile")
    }
    return err
}

When it happens

Trigger: Running under a sandbox profile that denies getrandom(2)//dev/urandom; minimal VMs with entropy starvation at very early boot; a test or embedding that swaps rand.Reader with a failing reader.

Common situations: gVisor/Firecracker microVMs with restrictive syscalls; custom-built minimal containers missing /dev/urandom; extremely rare in practice.

Related errors

• generating state: %w
• error fetching models: %w
• parsing device code response: %w
• device code authentication timed out after 15 minutes
• reading device token response: %w

AI-assisted analysis of sipeed/picoclaw@49183d7e8d (2026-08-15). Data as JSON: /api/errors/c7ae6b9afb8a2d7e. Report an issue: GitHub.