{"record":{"id":"71fcb6408f73dab9","repo":"CloakHQ/CloakBrowser","slug":"could-not-fetch-a-signed-sha256sums-sha256sums-71fcb6","errorCode":null,"errorMessage":"Could not fetch a signed SHA256SUMS (SHA256SUMS + SHA256SUMS.sig) for this release — refusing to use an unverified binary. Retry, or report at https://github.com/CloakHQ/cloakbrowser/issues","messagePattern":"Could not fetch a signed SHA256SUMS \\(SHA256SUMS \\+ SHA256SUMS\\.sig\\) for this release — refusing to use an unverified binary\\. Retry, or report at https://github\\.com/CloakHQ/cloakbrowser/issues","errorType":"exception","errorClass":"RuntimeError","httpStatus":null,"severity":"error","filePath":"cloakbrowser/download.py","lineNumber":657,"sourceCode":"        if checksums is None:\n            logger.warning(\n                \"SHA256SUMS not available from custom URL — skipping checksum verification\"\n            )\n            return\n        expected = checksums.get(tarball_name)\n        if expected is None:\n            logger.warning(\n                \"SHA256SUMS found but no entry for %s — skipping verification\",\n                tarball_name,\n            )\n            return\n        _verify_checksum(file_path, expected)\n        return\n\n    # Official path: signature is the trust root and is non-bypassable.\n    manifest = _fetch_signed_manifest(version)\n    if manifest is None:\n        raise RuntimeError(\n            \"Could not fetch a signed SHA256SUMS (SHA256SUMS + SHA256SUMS.sig) \"\n            \"for this release — refusing to use an unverified binary. \"\n            \"Retry, or report at https://github.com/CloakHQ/cloakbrowser/issues\"\n        )\n    manifest_bytes, sig_bytes = manifest\n    _verify_signature(manifest_bytes, sig_bytes)\n    manifest_text = manifest_bytes.decode(\"utf-8\")\n\n    # Version binding: the signed manifest must declare the version we asked for.\n    # The signature proves \"we made this manifest\", not \"this is the version you\n    # requested\" — without this check a mirror could serve a genuinely-signed\n    # older release in place of the requested one (forced downgrade).\n    requested = version or get_chromium_version()\n    declared = _parse_manifest_version(manifest_text)\n    if declared != requested:\n        raise RuntimeError(\n            f\"Version mismatch in signed SHA256SUMS: requested {requested}, \"\n            f\"manifest declares {declared or 'none'}. Refusing (possible downgrade).\"","sourceCodeStart":639,"sourceCodeEnd":675,"githubUrl":"https://github.com/CloakHQ/CloakBrowser/blob/d6bad5de261bedf025280ace1d14e800aee13923/cloakbrowser/download.py#L639-L675","documentation":"On the official (free) download path, the signed SHA256SUMS + .sig pair could not be fetched. Signature is the trust root and non-bypassable, so the library refuses to use an unverified binary.","triggerScenarios":"_verify_download_checksum after downloading the official archive when _fetch_signed_manifest returns None (network failure or 404 on the manifest).","commonSituations":"GitHub Releases/CDN outage; firewall blocking the manifest URL while allowing the tarball; retryable transient fetch failure.","solutions":["Retry the install/download","Verify the manifest URL is reachable (proxy/firewall rules)","Report at https://github.com/CloakHQ/cloakbrowser/issues if persistent"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"for attempt in range(3):\n    try:\n        return install()\n    except RuntimeError as e:\n        if \"Could not fetch a signed SHA256SUMS\" in str(e) and attempt < 2:\n            time.sleep(2 ** attempt); continue\n        raise","preventionTips":["Retry installs with backoff on manifest fetch failures","Ensure CI egress allows both tarball and SHA256SUMS URLs"],"tags":["checksum","manifest","network","security"],"backgroundTag":"checksum-manifest-fetch-failed","analyzedSha":"d6bad5de261bedf025280ace1d14e800aee13923","analyzedAt":"2026-08-28T14:13:12.918Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}