CloakHQ/CloakBrowser · critical · RuntimeError

Version mismatch in signed SHA256SUMS: requested

Error message

Version mismatch in signed SHA256SUMS: requested {requested}, manifest declares {declared or 'none'}. Refusing (possible downgrade).

What it means

The official manifest's signature is valid but the version it declares differs from the requested/default version — the same forced-downgrade defense as the Pro path: a mirror could serve a genuinely-signed older release in place of the requested one.

Solutions

Pin the exact version you need and retry with cleared cache
Bypass caching proxies / check DNS
Report upstream with requested vs declared versions

Defensive patterns

Strategy: try-catch

Try / catch

try:
    install()
except RuntimeError as e:
    if "Version mismatch in signed SHA256SUMS" in str(e):
        clear_caches(); install()  # bypass stale cache once
    else:
        raise

Prevention

Pin exact versions and clear caches between pin changes
Watch for caching proxies serving stale signed manifests

When it happens

Trigger: Official download where _parse_manifest_version(manifest_text) != (version or get_chromium_version()) — stale or mismatched manifest served for the release.

Common situations: CDN cache serving an older manifest; proxy pinning old responses; version metadata drift between default-version resolution and the release bucket.

Related errors

AI-assisted analysis of CloakHQ/CloakBrowser@d6bad5de26 (2026-08-28). Data as JSON: /api/errors/0e3d8f8b53449073. Report an issue: GitHub.

Appendix: source

Thrown at cloakbrowser/download.py:673

    manifest = _fetch_signed_manifest(version)
    if manifest is None:
        raise RuntimeError(
            "Could not fetch a signed SHA256SUMS (SHA256SUMS + SHA256SUMS.sig) "
            "for this release — refusing to use an unverified binary. "
            "Retry, or report at https://github.com/CloakHQ/cloakbrowser/issues"
        )
    manifest_bytes, sig_bytes = manifest
    _verify_signature(manifest_bytes, sig_bytes)
    manifest_text = manifest_bytes.decode("utf-8")

    # Version binding: the signed manifest must declare the version we asked for.
    # The signature proves "we made this manifest", not "this is the version you
    # requested" — without this check a mirror could serve a genuinely-signed
    # older release in place of the requested one (forced downgrade).
    requested = version or get_chromium_version()
    declared = _parse_manifest_version(manifest_text)
    if declared != requested:
        raise RuntimeError(
            f"Version mismatch in signed SHA256SUMS: requested {requested}, "
            f"manifest declares {declared or 'none'}. Refusing (possible downgrade)."
        )

    checksums = _parse_checksums(manifest_text)
    expected = checksums.get(tarball_name)
    if expected is None:
        raise RuntimeError(
            f"Signature-verified SHA256SUMS has no entry for {tarball_name} — "
            f"cannot confirm binary integrity."
        )
    _verify_checksum(file_path, expected)


def _parse_manifest_version(text: str) -> str | None:
    """Read the 'version=<v>' line from a signed manifest. None if absent.

    The line has no internal whitespace so older wrappers' SHA256SUMS parsers

View on GitHub (pinned to d6bad5de26)