CloakHQ/CloakBrowser · critical · BinaryVerificationError

Version mismatch in signed Pro SHA256SUMS: requested {versio

Error message

Version mismatch in signed Pro SHA256SUMS: requested {version}, manifest declares {declared ?? "none"}. Refusing (possible downgrade).

What it means

Thrown during Pro binary verification when the version declared inside the signature-verified SHA256SUMS manifest does not match the version the caller requested. The signature only proves who made the manifest, so this check prevents a mirror from serving a genuinely-signed but older release in place of the requested one (forced downgrade).

Source

Thrown at dotnet/src/CloakBrowser/Download.cs:617

                // InvalidOperationException (the router reports it as "unavailable,
                // retry") rather than a BinaryVerificationError (a tampering signal).
                throw new InvalidOperationException(
                    $"Could not fetch the signed SHA256SUMS for Pro {version} ({exc.Message})", exc);
            }
        }

        var (manifestData, sigData) = manifest.Value;

        // VerifySignature / VerifyChecksum throw InvalidOperationException; convert to
        // BinaryVerificationError so the Pro router treats them as tampering signals
        // (re-raise) rather than transient failures (fall back to free).
        try
        {
            VerifySignature(manifestData, sigData);
        }
        catch (InvalidOperationException exc)
        {
            throw new BinaryVerificationError(exc.Message, exc);
        }

        var manifestText = System.Text.Encoding.UTF8.GetString(manifestData);

        // Version binding: same forced-downgrade defense as the official free path.
        var declared = ParseManifestVersion(manifestText);
        if (declared != version)
            throw new BinaryVerificationError(
                $"Version mismatch in signed Pro SHA256SUMS: requested {version}, " +
                $"manifest declares {declared ?? "none"}. Refusing (possible downgrade).");

        var tarballName = Config.GetArchiveName();
        var checksums = ParseChecksums(manifestText);
        if (!checksums.TryGetValue(tarballName, out var expected))
            throw new BinaryVerificationError(
                $"Signature-verified Pro SHA256SUMS has no entry for {tarballName} - " +
                "cannot confirm binary integrity.");
        try

View on GitHub (pinned to d6bad5de26)

Solutions

  1. Confirm the exact version string you passed to DownloadProBinaryAsync matches the published release tag (no 'v' prefix vs with prefix mismatches)
  2. Retry with the version omitted so the library resolves the default
  3. Clear any local/cached manifest and retry; if the mismatch persists, report it at the project's issue tracker since upstream's manifest may be mis-published

Example fix

// before
var path = await dl.DownloadProBinaryAsync("1.2.2", ct);
// after - pass the version the release actually declares
var path = await dl.DownloadProBinaryAsync("1.2.3", ct);
Defensive patterns

Strategy: validation

Validate before calling

var requested = "1.2.3";
var declared = ParseManifestVersion(manifestText); // expose or replicate
if (declared != null && declared != requested)
    throw new InvalidOperationException($"Refusing: manifest is {declared}, requested {requested}");
await dl.DownloadProBinaryAsync(requested, ct);

Try / catch

try { await dl.DownloadProBinaryAsync(version, ct); }
catch (BinaryVerificationError e) when (e.Message.Contains("Version mismatch"))
{ /* log version, fail hard - do NOT retry with the declared (older) version */ }

Prevention

When it happens

Trigger: Calling DownloadProBinaryAsync (which calls VerifyProDownloadAsync) with a version argument that differs from the version string ParseManifestVersion extracts from the fetched SHA256SUMS text, e.g. requesting 1.2.3 while the manifest lists 1.2.2 or has no parseable version.

Common situations: Passing an outdated or mistyped version string; a cached/mirrored manifest for a different release; upstream published a manifest whose header names a different version than the tag it was uploaded under.

Related errors

AI-assisted analysis of CloakHQ/CloakBrowser@d6bad5de26 (2026-08-28). Data as JSON: /api/errors/55b5cc4c184a5a83. Report an issue: GitHub.