CloakHQ/CloakBrowser · error · RuntimeError

Could not fetch a signed SHA256SUMS (SHA256SUMS + SHA256SUMS

Error message

Could not fetch a signed SHA256SUMS (SHA256SUMS + SHA256SUMS.sig) for this release — refusing to use an unverified binary. Retry, or report at https://github.com/CloakHQ/cloakbrowser/issues

What it means

On the official (free) download path, the signed SHA256SUMS + .sig pair could not be fetched. Signature is the trust root and non-bypassable, so the library refuses to use an unverified binary.

Source

Thrown at cloakbrowser/download.py:657

        if checksums is None:
            logger.warning(
                "SHA256SUMS not available from custom URL — skipping checksum verification"
            )
            return
        expected = checksums.get(tarball_name)
        if expected is None:
            logger.warning(
                "SHA256SUMS found but no entry for %s — skipping verification",
                tarball_name,
            )
            return
        _verify_checksum(file_path, expected)
        return

    # Official path: signature is the trust root and is non-bypassable.
    manifest = _fetch_signed_manifest(version)
    if manifest is None:
        raise RuntimeError(
            "Could not fetch a signed SHA256SUMS (SHA256SUMS + SHA256SUMS.sig) "
            "for this release — refusing to use an unverified binary. "
            "Retry, or report at https://github.com/CloakHQ/cloakbrowser/issues"
        )
    manifest_bytes, sig_bytes = manifest
    _verify_signature(manifest_bytes, sig_bytes)
    manifest_text = manifest_bytes.decode("utf-8")

    # Version binding: the signed manifest must declare the version we asked for.
    # The signature proves "we made this manifest", not "this is the version you
    # requested" — without this check a mirror could serve a genuinely-signed
    # older release in place of the requested one (forced downgrade).
    requested = version or get_chromium_version()
    declared = _parse_manifest_version(manifest_text)
    if declared != requested:
        raise RuntimeError(
            f"Version mismatch in signed SHA256SUMS: requested {requested}, "
            f"manifest declares {declared or 'none'}. Refusing (possible downgrade)."

View on GitHub (pinned to d6bad5de26)

Solutions

Retry the install/download
Verify the manifest URL is reachable (proxy/firewall rules)
Report at https://github.com/CloakHQ/cloakbrowser/issues if persistent

Defensive patterns

Strategy: retry

Try / catch

for attempt in range(3):
    try:
        return install()
    except RuntimeError as e:
        if "Could not fetch a signed SHA256SUMS" in str(e) and attempt < 2:
            time.sleep(2 ** attempt); continue
        raise

Prevention

Retry installs with backoff on manifest fetch failures
Ensure CI egress allows both tarball and SHA256SUMS URLs

When it happens

Trigger: _verify_download_checksum after downloading the official archive when _fetch_signed_manifest returns None (network failure or 404 on the manifest).

Common situations: GitHub Releases/CDN outage; firewall blocking the manifest URL while allowing the tarball; retryable transient fetch failure.

Related errors

AI-assisted analysis of CloakHQ/CloakBrowser@d6bad5de26 (2026-08-28). Data as JSON: /api/errors/71fcb6408f73dab9. Report an issue: GitHub.