CloakHQ/CloakBrowser · critical · BinaryVerificationError

Version mismatch in signed Pro SHA256SUMS: requested {versio

Error message

Version mismatch in signed Pro SHA256SUMS: requested {version}, manifest declares {declared or 'none'}. Refusing (possible downgrade).

What it means

The signature on the Pro SHA256SUMS is valid, but the version declared inside the manifest differs from the requested version. This blocks a forced-downgrade attack where a genuinely-signed older release is served in place of the requested one.

Source

Thrown at cloakbrowser/download.py:597

        # BinaryVerificationError (which it surfaces as a tampering signal).
        raise RuntimeError(
            f"Could not fetch the signed SHA256SUMS for Pro {version} ({exc})"
        ) from exc

    manifest_bytes = manifest_resp.content
    # _verify_signature / _verify_checksum raise plain RuntimeError; convert to
    # BinaryVerificationError so the Pro router treats them as tampering signals
    # (re-raise) rather than transient failures (fall back to free).
    try:
        _verify_signature(manifest_bytes, sig_resp.content)
    except RuntimeError as exc:
        raise BinaryVerificationError(str(exc)) from exc
    manifest_text = manifest_bytes.decode("utf-8")

    # Version binding: same forced-downgrade defense as the official path.
    declared = _parse_manifest_version(manifest_text)
    if declared != version:
        raise BinaryVerificationError(
            f"Version mismatch in signed Pro SHA256SUMS: requested {version}, "
            f"manifest declares {declared or 'none'}. Refusing (possible downgrade)."
        )

    tarball_name = get_archive_name()
    expected = _parse_checksums(manifest_text).get(tarball_name)
    if expected is None:
        raise BinaryVerificationError(
            f"Signature-verified Pro SHA256SUMS has no entry for {tarball_name} — "
            f"cannot confirm binary integrity."
        )
    try:
        _verify_checksum(file_path, expected)
    except RuntimeError as exc:
        raise BinaryVerificationError(str(exc)) from exc


def _verify_download_checksum(file_path: Path, version: str | None = None) -> None:

View on GitHub (pinned to d6bad5de26)

Solutions

Clear caches and retry with the exact version pinned
Check for a MITM proxy rewriting responses
Report upstream with requested vs declared versions

Defensive patterns

Strategy: try-catch

Try / catch

from cloakbrowser.download import BinaryVerificationError
try:
    _download_pro_binary(PIN, key)
except BinaryVerificationError as e:
    if "Version mismatch" in str(e):
        clear_caches(); _download_pro_binary(PIN, key)  # once
    else:
        raise

Prevention

Always pin exact versions for reproducible installs
Investigate proxies that cache release metadata when mismatches repeat

When it happens

Trigger: Pro download where _parse_manifest_version(manifest_text) != requested version — e.g. a mirror/cache serving an older signed manifest.

Common situations: Stale CDN cache for the manifest; downgrade-serving proxy; server-side release mix-up.

Related errors

AI-assisted analysis of CloakHQ/CloakBrowser@d6bad5de26 (2026-08-28). Data as JSON: /api/errors/a1405204b54f24ca. Report an issue: GitHub.