CloakHQ/CloakBrowser · critical · BinaryVerificationError

Signature-verified Pro SHA256SUMS has no entry for {tarballN

Error message

Signature-verified Pro SHA256SUMS has no entry for {tarballName} - cannot confirm binary integrity.

What it means

After the Pro SHA256SUMS manifest passes signature and version checks, the code looks up the expected hash for the archive named by Config.GetArchiveName(). If that filename has no line in the manifest, integrity cannot be confirmed and the error is thrown rather than trusting the binary.

Source

Thrown at dotnet/src/CloakBrowser/Download.cs:632

        }
        catch (InvalidOperationException exc)
        {
            throw new BinaryVerificationError(exc.Message, exc);
        }

        var manifestText = System.Text.Encoding.UTF8.GetString(manifestData);

        // Version binding: same forced-downgrade defense as the official free path.
        var declared = ParseManifestVersion(manifestText);
        if (declared != version)
            throw new BinaryVerificationError(
                $"Version mismatch in signed Pro SHA256SUMS: requested {version}, " +
                $"manifest declares {declared ?? "none"}. Refusing (possible downgrade).");

        var tarballName = Config.GetArchiveName();
        var checksums = ParseChecksums(manifestText);
        if (!checksums.TryGetValue(tarballName, out var expected))
            throw new BinaryVerificationError(
                $"Signature-verified Pro SHA256SUMS has no entry for {tarballName} - " +
                "cannot confirm binary integrity.");
        try
        {
            VerifyChecksum(filePath, expected);
        }
        catch (InvalidOperationException exc)
        {
            throw new BinaryVerificationError(exc.Message, exc);
        }
    }

    private static void WriteProVersionMarker(string version, string? releaseChannel = null)
    {
        var markerPrefix = Config.NormalizeReleaseChannel(releaseChannel) == "preview"
            ? "latest_pro_version_preview"
            : "latest_pro_version";
        var marker = Path.Combine(Config.GetCacheDir(), $"{markerPrefix}_{Config.GetPlatformTag()}");

View on GitHub (pinned to d6bad5de26)

Solutions

Check the release's SHA256SUMS contents and confirm your OS/arch archive is listed; if not, use a supported platform or wait for a fixed release
Update the library to the latest version in case archive naming changed
Report the missing entry at the project issue tracker with your platform and version

Defensive patterns

Strategy: try-catch

Try / catch

try { await dl.DownloadProBinaryAsync(version, ct); }
catch (BinaryVerificationError e) when (e.Message.Contains("no entry for"))
{ /* unsupported platform for this release: abort or pick another platform */ }

Prevention

Check the release notes/SHA256SUMS for supported platforms before adopting a version
Test on all target platforms in CI when bumping versions

When it happens

Trigger: Calling DownloadProBinaryAsync on a platform/arch whose tarball name (Config.GetArchiveName()) is absent from the fetched SHA256SUMS - e.g. a new OS/arch combination the release publisher forgot to include, or a filename format change between versions.

Common situations: Running on an uncommon platform (e.g. linux-arm64 vs amd64) the publisher didn't ship; a release where manifest filenames were renamed (compression change .tar.gz -> .zip); stale manifest for a newer archive naming scheme.

Related errors

AI-assisted analysis of CloakHQ/CloakBrowser@d6bad5de26 (2026-08-28). Data as JSON: /api/errors/d81947726f7012bd. Report an issue: GitHub.