CloakHQ/CloakBrowser · critical · BinaryVerificationError

{exc}

Error message

{exc}

What it means

The Pro SHA256SUMS manifest's signature failed verification; the underlying RuntimeError message is re-wrapped as BinaryVerificationError so the Pro router treats it as a tampering signal (abort), not a transient failure.

Source

Thrown at cloakbrowser/download.py:591

            f"{base}/SHA256SUMS.sig", follow_redirects=True, timeout=10.0
        )
        sig_resp.raise_for_status()
    except Exception as exc:
        # Fetch failure is transient, not tampering — raise a plain RuntimeError
        # (the router reports it as "unavailable, retry") rather than a
        # BinaryVerificationError (which it surfaces as a tampering signal).
        raise RuntimeError(
            f"Could not fetch the signed SHA256SUMS for Pro {version} ({exc})"
        ) from exc

    manifest_bytes = manifest_resp.content
    # _verify_signature / _verify_checksum raise plain RuntimeError; convert to
    # BinaryVerificationError so the Pro router treats them as tampering signals
    # (re-raise) rather than transient failures (fall back to free).
    try:
        _verify_signature(manifest_bytes, sig_resp.content)
    except RuntimeError as exc:
        raise BinaryVerificationError(str(exc)) from exc
    manifest_text = manifest_bytes.decode("utf-8")

    # Version binding: same forced-downgrade defense as the official path.
    declared = _parse_manifest_version(manifest_text)
    if declared != version:
        raise BinaryVerificationError(
            f"Version mismatch in signed Pro SHA256SUMS: requested {version}, "
            f"manifest declares {declared or 'none'}. Refusing (possible downgrade)."
        )

    tarball_name = get_archive_name()
    expected = _parse_checksums(manifest_text).get(tarball_name)
    if expected is None:
        raise BinaryVerificationError(
            f"Signature-verified Pro SHA256SUMS has no entry for {tarball_name} — "
            f"cannot confirm binary integrity."
        )
    try:

View on GitHub (pinned to d6bad5de26)

Solutions

  1. Do not retry blindly — verify your network path (DNS, proxy, TLS)
  2. Update cloakbrowser to the latest version in case of signing key rotation
  3. Report the incident upstream — this indicates authenticity failure
Defensive patterns

Strategy: try-catch

Try / catch

from cloakbrowser.download import BinaryVerificationError
try:
    install()
except BinaryVerificationError as e:
    security_alert(f"Pro manifest signature failure: {e}")
    raise  # never bypass

Prevention

When it happens

Trigger: _verify_signature(manifest_bytes, sig_resp.content) failing during a Pro download — wrong/invalid signature over the manifest.

Common situations: MITM or compromised mirror serving altered manifests; CDN misconfiguration; signature key rotation mismatch with an old client.

Related errors

AI-assisted analysis of CloakHQ/CloakBrowser@d6bad5de26 (2026-08-28). Data as JSON: /api/errors/86b5e7c372df6a3d. Report an issue: GitHub.