CloakHQ/CloakBrowser · critical · RuntimeError

Version mismatch in signed SHA256SUMS: requested {requested}

Error message

Version mismatch in signed SHA256SUMS: requested {requested}, manifest declares {declared or 'none'}. Refusing (possible downgrade).

What it means

The official manifest's signature is valid but the version it declares differs from the requested/default version — the same forced-downgrade defense as the Pro path: a mirror could serve a genuinely-signed older release in place of the requested one.

Source

Thrown at cloakbrowser/download.py:673

    manifest = _fetch_signed_manifest(version)
    if manifest is None:
        raise RuntimeError(
            "Could not fetch a signed SHA256SUMS (SHA256SUMS + SHA256SUMS.sig) "
            "for this release — refusing to use an unverified binary. "
            "Retry, or report at https://github.com/CloakHQ/cloakbrowser/issues"
        )
    manifest_bytes, sig_bytes = manifest
    _verify_signature(manifest_bytes, sig_bytes)
    manifest_text = manifest_bytes.decode("utf-8")

    # Version binding: the signed manifest must declare the version we asked for.
    # The signature proves "we made this manifest", not "this is the version you
    # requested" — without this check a mirror could serve a genuinely-signed
    # older release in place of the requested one (forced downgrade).
    requested = version or get_chromium_version()
    declared = _parse_manifest_version(manifest_text)
    if declared != requested:
        raise RuntimeError(
            f"Version mismatch in signed SHA256SUMS: requested {requested}, "
            f"manifest declares {declared or 'none'}. Refusing (possible downgrade)."
        )

    checksums = _parse_checksums(manifest_text)
    expected = checksums.get(tarball_name)
    if expected is None:
        raise RuntimeError(
            f"Signature-verified SHA256SUMS has no entry for {tarball_name} — "
            f"cannot confirm binary integrity."
        )
    _verify_checksum(file_path, expected)


def _parse_manifest_version(text: str) -> str | None:
    """Read the 'version=<v>' line from a signed manifest. None if absent.

    The line has no internal whitespace so older wrappers' SHA256SUMS parsers

View on GitHub (pinned to d6bad5de26)

Solutions

  1. Pin the exact version you need and retry with cleared cache
  2. Bypass caching proxies / check DNS
  3. Report upstream with requested vs declared versions
Defensive patterns

Strategy: try-catch

Try / catch

try:
    install()
except RuntimeError as e:
    if "Version mismatch in signed SHA256SUMS" in str(e):
        clear_caches(); install()  # bypass stale cache once
    else:
        raise

Prevention

When it happens

Trigger: Official download where _parse_manifest_version(manifest_text) != (version or get_chromium_version()) — stale or mismatched manifest served for the release.

Common situations: CDN cache serving an older manifest; proxy pinning old responses; version metadata drift between default-version resolution and the release bucket.

Related errors

AI-assisted analysis of CloakHQ/CloakBrowser@d6bad5de26 (2026-08-28). Data as JSON: /api/errors/0e3d8f8b53449073. Report an issue: GitHub.