{"record":{"id":"10ad83683e1c3763","repo":"CloakHQ/CloakBrowser","slug":"could-not-fetch-the-signed-sha256sums-for-pro-ver-10ad83","errorCode":null,"errorMessage":"Could not fetch the signed SHA256SUMS for Pro {version} ({exc})","messagePattern":"Could not fetch the signed SHA256SUMS for Pro (.+?) \\((.+?)\\)","errorType":"exception","errorClass":"RuntimeError","httpStatus":null,"severity":"error","filePath":"cloakbrowser/download.py","lineNumber":580,"sourceCode":"    CLOAKBROWSER_SKIP_CHECKSUM cannot bypass it. A failed manifest FETCH is\n    transient — nothing was validated — and raises a plain RuntimeError. A\n    valid-license user is never silently downgraded to the free binary.\n    \"\"\"\n    base = f\"{DOWNLOAD_BASE_URL}/releases/pro/chromium-v{version}\"\n    try:\n        manifest_resp = httpx.get(\n            f\"{base}/SHA256SUMS\", follow_redirects=True, timeout=10.0\n        )\n        manifest_resp.raise_for_status()\n        sig_resp = httpx.get(\n            f\"{base}/SHA256SUMS.sig\", follow_redirects=True, timeout=10.0\n        )\n        sig_resp.raise_for_status()\n    except Exception as exc:\n        # Fetch failure is transient, not tampering — raise a plain RuntimeError\n        # (the router reports it as \"unavailable, retry\") rather than a\n        # BinaryVerificationError (which it surfaces as a tampering signal).\n        raise RuntimeError(\n            f\"Could not fetch the signed SHA256SUMS for Pro {version} ({exc})\"\n        ) from exc\n\n    manifest_bytes = manifest_resp.content\n    # _verify_signature / _verify_checksum raise plain RuntimeError; convert to\n    # BinaryVerificationError so the Pro router treats them as tampering signals\n    # (re-raise) rather than transient failures (fall back to free).\n    try:\n        _verify_signature(manifest_bytes, sig_resp.content)\n    except RuntimeError as exc:\n        raise BinaryVerificationError(str(exc)) from exc\n    manifest_text = manifest_bytes.decode(\"utf-8\")\n\n    # Version binding: same forced-downgrade defense as the official path.\n    declared = _parse_manifest_version(manifest_text)\n    if declared != version:\n        raise BinaryVerificationError(\n            f\"Version mismatch in signed Pro SHA256SUMS: requested {version}, \"","sourceCodeStart":562,"sourceCodeEnd":598,"githubUrl":"https://github.com/CloakHQ/CloakBrowser/blob/d6bad5de261bedf025280ace1d14e800aee13923/cloakbrowser/download.py#L562-L598","documentation":"Fetching the signed SHA256SUMS manifest and its signature for a Pro version failed (network/HTTP error). This is treated as transient (plain RuntimeError) — distinct from tampering — so the caller can retry rather than abort.","triggerScenarios":"_verify_pro_download during a Pro download where the manifest or .sig HTTP fetch raises (timeout, 5xx, DNS).","commonSituations":"Flaky network mid-download; Pro CDN hiccup; firewall blocking the manifest URL specifically.","solutions":["Retry the download/install","Verify the manifest URL is reachable from your network","If persistent, report upstream"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"for attempt in range(3):\n    try:\n        return install()\n    except RuntimeError as e:\n        if \"Could not fetch the signed SHA256SUMS\" in str(e) and attempt < 2:\n            time.sleep(2 ** attempt); continue\n        raise","preventionTips":["Retry transient manifest fetches with exponential backoff","Whitelist the manifest/signature URLs in firewall rules, not just the tarball host"],"tags":["checksum","manifest","network","transient","pro-license"],"backgroundTag":"checksum-manifest-fetch-failed","analyzedSha":"d6bad5de261bedf025280ace1d14e800aee13923","analyzedAt":"2026-08-28T14:13:12.918Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}