CloakBrowser

mirror of https://github.com/CloakHQ/CloakBrowser.git synced 2026-06-23 11:41:46 +02:00

Files

T

CloakHQ 660b6bf58c feat(security): verify binaries with pinned Ed25519 signature on SHA256SUMS

Replace the same-origin checksum with a detached Ed25519 signature
(SHA256SUMS.sig) verified against a pinned public key before extraction,
closing #308: a compromised download mirror can no longer certify a
tampered binary. The signed manifest also binds the release version,
rejecting a forced downgrade to an older signed build.

Verification is mandatory and non-bypassable on the official download path;
custom CLOAKBROWSER_DOWNLOAD_URL mirrors keep the legacy skippable checksum.
Silent auto-update is preserved for everyone because only a constant public
key is pinned, not per-version hashes. Older installed wrappers are
unaffected — the version= line is ignored by their checksum parser.

Python uses cryptography; JS uses node:crypto. Adds tamper, downgrade, and
fail-closed tests in both languages.

2026-06-21 02:42:18 +02:00

human

fix(humanize): port #303 iframe pointer-events fix to Python

2026-05-25 01:17:05 +02:00

__init__.py

feat: add launch_context_async() + JS contextOptions escape hatch (#141 )

2026-04-16 21:30:40 +02:00

__main__.py

feat: add CLI for binary management (Python + JavaScript)

2026-03-11 04:33:37 +01:00

_version.py

release: v0.3.32 — Windows extraction security fix, Widevine CDM seeding, cloakserve fixes