tauri-apps/tauri · critical

unable to generate cryptographically secure keys for Tauri…

Error message

unable to generate cryptographically secure keys for Tauri "Isolation" Pattern

What it means

This panic occurs at build time in tauri-codegen when generating the context code for the Tauri "Isolation" pattern. The generated code calls `tauri::utils::pattern::isolation::Keys::new()`, which generates a cryptographic keypair using the platform RNG; if that RNG fails or no secure randomness source is available, `.expect` panics with this message. The library treats failure to obtain secure keys as fatal because an Isolation pattern without strong keys is insecure.

Solutions

1. Fix the entropy source on the build machine (ensure /dev/urandom is available/accessible; check getrandom support for the target).
2. Retry the build in a normal environment (host with working OS RNG) instead of the restricted container.
3. If secure keys genuinely cannot be generated, temporarily disable the Isolation pattern in tauri.conf.json (`app.security.pattern` removed) while fixing the environment.
4. Update tauri-utils/getrandom to versions supporting your target platform.

Example fix

// tauri.conf.json before
"security": { "pattern": { "use": "isolation" } }
// after (until entropy issue is fixed)
"security": {}

// before enabling Isolation pattern in CI, sanity-check the RNG works:
// run a tiny Rust probe using getrandom, or in shell:
test -c /dev/urandom && echo "entropy OK" || echo "fix entropy before enabling isolation pattern"

When it happens

Trigger: Building a Tauri app configured with `app.security.pattern.isolation` set in tauri.conf.json when `Keys::new()` cannot source cryptographically secure randomness from the OS (e.g. failing /dev/urandom, getrandom failing on the build platform).

Common situations: Cross-compiling or building in restricted environments (containers, chroots) where /dev/urandom or the system entropy API is unavailable; exotic targets where the getrandom backend is unsupported; heavily sandboxed CI runners.

Related errors

• Tauri "Isolation" Pattern only supports relative or…
• unable to find isolation file
• cannot use both `resources` and `resources_map`
• embedded file asset has no parent
• failed to canonicalize global API script path

AI-assisted analysis of tauri-apps/tauri@460ec35447 (2026-09-18). Data as JSON: /api/errors/f1b4ecd4bdb4c4a5. Report an issue: GitHub.

Appendix: source

Thrown at crates/tauri-codegen/src/context.rs:390

        if String::from_utf8_lossy(input).contains("__TAURI_ISOLATION_HOOK__") {
          sets_isolation_hook = true;
        }
        map_isolation(key, path, input, csp_hashes)
      })?;

      if !sets_isolation_hook {
        panic!(
          "The isolation application does not contain a file setting the `window.__TAURI_ISOLATION_HOOK__` value."
        );
      }

      let schema = options.isolation_schema;

      quote!(#root::Pattern::Isolation {
        assets: ::std::sync::Arc::new(#assets),
        schema: #schema.into(),
        key: #key.into(),
        crypto_keys: std::boxed::Box::new(::tauri::utils::pattern::isolation::Keys::new().expect("unable to generate cryptographically secure keys for Tauri \"Isolation\" Pattern")),
      })
    }
  };

  let acl_file_path = out_dir.join(ACL_MANIFESTS_FILE_NAME);
  let acl: BTreeMap<String, Manifest> = if acl_file_path.exists() {
    let acl_file =
      std::fs::read_to_string(acl_file_path).expect("failed to read plugin manifest map");
    serde_json::from_str(&acl_file).expect("failed to parse plugin manifest map")
  } else {
    Default::default()
  };

  let capabilities_file_path = out_dir.join(CAPABILITIES_FILE_NAME);
  let capabilities_from_files = if capabilities_file_path.exists() {
    let capabilities_json =
      std::fs::read_to_string(&capabilities_file_path).expect("failed to read capabilities");
    serde_json::from_str(&capabilities_json).expect("failed to parse capabilities")

View on GitHub (pinned to 460ec35447)