{"record":{"id":"4a1191875ab5046c","repo":"CloakHQ/CloakBrowser","slug":"signature-verified-pro-sha256sums-has-no-entry-for-4a1191","errorCode":null,"errorMessage":"Signature-verified Pro SHA256SUMS has no entry for {tarball_name} — cannot confirm binary integrity.","messagePattern":"Signature-verified Pro SHA256SUMS has no entry for (.+?) — cannot confirm binary integrity\\.","errorType":"exception","errorClass":"BinaryVerificationError","httpStatus":null,"severity":"critical","filePath":"cloakbrowser/download.py","lineNumber":605,"sourceCode":"    # (re-raise) rather than transient failures (fall back to free).\n    try:\n        _verify_signature(manifest_bytes, sig_resp.content)\n    except RuntimeError as exc:\n        raise BinaryVerificationError(str(exc)) from exc\n    manifest_text = manifest_bytes.decode(\"utf-8\")\n\n    # Version binding: same forced-downgrade defense as the official path.\n    declared = _parse_manifest_version(manifest_text)\n    if declared != version:\n        raise BinaryVerificationError(\n            f\"Version mismatch in signed Pro SHA256SUMS: requested {version}, \"\n            f\"manifest declares {declared or 'none'}. Refusing (possible downgrade).\"\n        )\n\n    tarball_name = get_archive_name()\n    expected = _parse_checksums(manifest_text).get(tarball_name)\n    if expected is None:\n        raise BinaryVerificationError(\n            f\"Signature-verified Pro SHA256SUMS has no entry for {tarball_name} — \"\n            f\"cannot confirm binary integrity.\"\n        )\n    try:\n        _verify_checksum(file_path, expected)\n    except RuntimeError as exc:\n        raise BinaryVerificationError(str(exc)) from exc\n\n\ndef _verify_download_checksum(file_path: Path, version: str | None = None) -> None:\n    \"\"\"Verify the downloaded archive's integrity and authenticity.\n\n    Official path (cloakbrowser.dev / GitHub Releases): fetch SHA256SUMS plus\n    its detached Ed25519 signature SHA256SUMS.sig, verify the signature against\n    the pinned public keys FIRST, then verify the archive's SHA-256 against the\n    now-authenticated manifest. Mandatory and non-bypassable — a same-origin\n    manifest can no longer certify a tampered binary (#308).\n","sourceCodeStart":587,"sourceCodeEnd":623,"githubUrl":"https://github.com/CloakHQ/CloakBrowser/blob/d6bad5de261bedf025280ace1d14e800aee13923/cloakbrowser/download.py#L587-L623","documentation":"The signature-verified Pro manifest has no checksum entry for this platform's archive name (get_archive_name()), so binary integrity cannot be confirmed; raised as BinaryVerificationError (tampering-class).","triggerScenarios":"Pro download where _parse_checksums(manifest_text).get(tarball_name) is None — manifest lacks a line for the current platform's tarball.","commonSituations":"Platform tarball added but manifest not regenerated; manifest truncated by a proxy; new platform support gap in the release.","solutions":["Retry with caches cleared","Verify the archive name matches your platform tag via get_platform_tag()","Report upstream — likely a release packaging gap"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"from cloakbrowser.download import BinaryVerificationError\ntry:\n    install()\nexcept BinaryVerificationError as e:\n    if \"no entry for\" in str(e):\n        report_upstream(platform_tag(), e)  # packaging gap\n    raise","preventionTips":["Smoke-test installs on every platform you ship to","Treat missing manifest entries as release blockers in CI"],"tags":["security","checksum","manifest","platform"],"backgroundTag":"checksum-entry-missing","analyzedSha":"d6bad5de261bedf025280ace1d14e800aee13923","analyzedAt":"2026-08-28T14:13:12.918Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}