From ff5756ca467b2b9722c1a1ad6e10d2c669ffe043 Mon Sep 17 00:00:00 2001 From: germondai Date: Mon, 10 Aug 2026 19:20:57 +0200 Subject: [PATCH] fix(browser): update pinned runtime assets --- apps/api/Dockerfile | 24 +++++++++++------------- apps/api/Dockerfile.baseline | 24 +++++++++++------------- packages/browser/src/fingerprint.ts | 12 ++++++------ 3 files changed, 28 insertions(+), 32 deletions(-) diff --git a/apps/api/Dockerfile b/apps/api/Dockerfile index 4dee112..9ef18b7 100644 --- a/apps/api/Dockerfile +++ b/apps/api/Dockerfile @@ -49,25 +49,22 @@ ARG UBO_SHA256=bccc51a773150af4af6e1fd62c7bfdeb7238b79ff2381b998fa9f2e38f64786a RUN apt-get update && apt-get install -y --no-install-recommends \ curl unzip ca-certificates && rm -rf /var/lib/apt/lists/* -# Pin Camoufox to v150.0.2-beta.25 (verified working). The camoufox-js `fetch` always -# downloads the latest release, which broke in 152.x (browser binary no longer in the -# zip — see Camoufox upstream release notes). Direct curl keeps builds reproducible. -# -# Asset naming: arm64 = alpha.25 build, x86_64 = alpha.26 rebuild (only x86_64 was -# rebuilt in the v150.0.2-beta.25 release). +# Pin the browser release and verify the architecture-specific asset before extracting it. +# Direct downloads keep builds reproducible and avoid camoufox-js resolving "latest". ARG TARGETARCH RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \ case "$TARGETARCH" in \ - amd64) RELEASE="alpha.26"; ZIP="camoufox-150.0.2-${RELEASE}-lin.x86_64.zip" ;; \ - arm64) RELEASE="alpha.25"; ZIP="camoufox-150.0.2-${RELEASE}-lin.arm64.zip" ;; \ + amd64) ZIP="camoufox-152.0.4-beta.28-lin.x86_64.zip"; SHA256="924f3109ccd6d47cd6a0384d67a345fadf975d48b6319f8dbbd5954c588982bd" ;; \ + arm64) ZIP="camoufox-152.0.4-beta.28-lin.arm64.zip"; SHA256="3a105a2fc929e80a79b4b7fce2c93ed62c4fb2c877f3c1ed2a5d66a1c4fe968f" ;; \ *) echo "unsupported arch: $TARGETARCH"; exit 1 ;; \ esac && \ curl -fsSL \ - "https://github.com/daijro/camoufox/releases/download/v150.0.2-beta.25/${ZIP}" \ + "https://github.com/daijro/camoufox/releases/download/v152.0.4-beta.28/${ZIP}" \ -o /tmp/camoufox.zip && \ + echo "${SHA256} /tmp/camoufox.zip" | sha256sum --check --strict - && \ unzip -q /tmp/camoufox.zip -d /opt/camoufox && \ rm /tmp/camoufox.zip && \ - printf '{"version":"150.0.2","release":"%s"}\n' "$RELEASE" > /opt/camoufox/version.json && \ + printf '{"version":"152.0.4","release":"beta.28"}\n' > /opt/camoufox/version.json && \ chmod -R 755 /opt/camoufox && \ rm -rf /opt/camoufox/fonts/macos /opt/camoufox/fonts/windows @@ -80,11 +77,12 @@ RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \ # Baking a verified copy into the image makes startup deterministic and removes the # runtime GitHub dependency + first-launch download latency. The size check fails the # build if the download is truncated, so a corrupt file can never be baked in. +ARG GEOLITE_RELEASE=2026.08.07 +ARG GEOLITE_CITY_SHA256=5c32206cd9a67d3b8995e8ca010191a802e9cb06d3c089963f08b55deb1bd921 RUN curl -fsSL \ - "https://github.com/P3TERX/GeoLite.mmdb/releases/latest/download/GeoLite2-City.mmdb" \ + "https://github.com/P3TERX/GeoLite.mmdb/releases/download/${GEOLITE_RELEASE}/GeoLite2-City.mmdb" \ -o /opt/camoufox/GeoLite2-City.mmdb && \ - [ "$(stat -c%s /opt/camoufox/GeoLite2-City.mmdb)" -gt 10000000 ] || \ - { echo "GeoLite2-City.mmdb download too small / failed"; exit 1; } + echo "${GEOLITE_CITY_SHA256} /opt/camoufox/GeoLite2-City.mmdb" | sha256sum --check --strict - # Bake uBlock Origin into Camoufox's expected addon directory. camoufox-js still # performs its normal addon registration at startup, but no runtime download or diff --git a/apps/api/Dockerfile.baseline b/apps/api/Dockerfile.baseline index 128530f..5f0bacf 100644 --- a/apps/api/Dockerfile.baseline +++ b/apps/api/Dockerfile.baseline @@ -49,25 +49,22 @@ ARG UBO_SHA256=bccc51a773150af4af6e1fd62c7bfdeb7238b79ff2381b998fa9f2e38f64786a RUN apt-get update && apt-get install -y --no-install-recommends \ curl unzip ca-certificates && rm -rf /var/lib/apt/lists/* -# Pin Camoufox to v150.0.2-beta.25 (verified working). The camoufox-js `fetch` always -# downloads the latest release, which broke in 152.x (browser binary no longer in the -# zip — see Camoufox upstream release notes). Direct curl keeps builds reproducible. -# -# Asset naming: arm64 = alpha.25 build, x86_64 = alpha.26 rebuild (only x86_64 was -# rebuilt in the v150.0.2-beta.25 release). +# Pin the browser release and verify the architecture-specific asset before extracting it. +# Direct downloads keep builds reproducible and avoid camoufox-js resolving "latest". ARG TARGETARCH RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \ case "$TARGETARCH" in \ - amd64) RELEASE="alpha.26"; ZIP="camoufox-150.0.2-${RELEASE}-lin.x86_64.zip" ;; \ - arm64) RELEASE="alpha.25"; ZIP="camoufox-150.0.2-${RELEASE}-lin.arm64.zip" ;; \ + amd64) ZIP="camoufox-152.0.4-beta.28-lin.x86_64.zip"; SHA256="924f3109ccd6d47cd6a0384d67a345fadf975d48b6319f8dbbd5954c588982bd" ;; \ + arm64) ZIP="camoufox-152.0.4-beta.28-lin.arm64.zip"; SHA256="3a105a2fc929e80a79b4b7fce2c93ed62c4fb2c877f3c1ed2a5d66a1c4fe968f" ;; \ *) echo "unsupported arch: $TARGETARCH"; exit 1 ;; \ esac && \ curl -fsSL \ - "https://github.com/daijro/camoufox/releases/download/v150.0.2-beta.25/${ZIP}" \ + "https://github.com/daijro/camoufox/releases/download/v152.0.4-beta.28/${ZIP}" \ -o /tmp/camoufox.zip && \ + echo "${SHA256} /tmp/camoufox.zip" | sha256sum --check --strict - && \ unzip -q /tmp/camoufox.zip -d /opt/camoufox && \ rm /tmp/camoufox.zip && \ - printf '{"version":"150.0.2","release":"%s"}\n' "$RELEASE" > /opt/camoufox/version.json && \ + printf '{"version":"152.0.4","release":"beta.28"}\n' > /opt/camoufox/version.json && \ chmod -R 755 /opt/camoufox && \ rm -rf /opt/camoufox/fonts/macos /opt/camoufox/fonts/windows @@ -80,11 +77,12 @@ RUN --mount=type=secret,id=GITHUB_TOKEN,env=GITHUB_TOKEN \ # Baking a verified copy into the image makes startup deterministic and removes the # runtime GitHub dependency + first-launch download latency. The size check fails the # build if the download is truncated, so a corrupt file can never be baked in. +ARG GEOLITE_RELEASE=2026.08.07 +ARG GEOLITE_CITY_SHA256=5c32206cd9a67d3b8995e8ca010191a802e9cb06d3c089963f08b55deb1bd921 RUN curl -fsSL \ - "https://github.com/P3TERX/GeoLite.mmdb/releases/latest/download/GeoLite2-City.mmdb" \ + "https://github.com/P3TERX/GeoLite.mmdb/releases/download/${GEOLITE_RELEASE}/GeoLite2-City.mmdb" \ -o /opt/camoufox/GeoLite2-City.mmdb && \ - [ "$(stat -c%s /opt/camoufox/GeoLite2-City.mmdb)" -gt 10000000 ] || \ - { echo "GeoLite2-City.mmdb download too small / failed"; exit 1; } + echo "${GEOLITE_CITY_SHA256} /opt/camoufox/GeoLite2-City.mmdb" | sha256sum --check --strict - # Bake uBlock Origin into Camoufox's expected addon directory. camoufox-js still # performs its normal addon registration at startup, but no runtime download or diff --git a/packages/browser/src/fingerprint.ts b/packages/browser/src/fingerprint.ts index 264a301..f2b33bf 100644 --- a/packages/browser/src/fingerprint.ts +++ b/packages/browser/src/fingerprint.ts @@ -5,9 +5,9 @@ import type { BrowserFingerprint } from "@trawl/types" // flag the mismatch. Per-request the orchestrator picks one of these UAs at random // (see `FINGERPRINT_POOL` in pool.ts). export const FINGERPRINT = { - // Firefox 150 (matches Camoufox 150.0.2-alpha.26 shipped in the image). + // Firefox 152 (matches the pinned Camoufox 152.0.4 browser shipped in the image). // Three UAs — one per "OS" — so HTTP headers + browser fingerprint look consistent. - userAgent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:150.0) Gecko/20100101 Firefox/150.0", + userAgent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:152.0) Gecko/20100101 Firefox/152.0", viewport: { width: 1920, height: 1080 }, locale: "en-US", timezone: "America/New_York", @@ -19,25 +19,25 @@ export const FINGERPRINT = { // fingerprint (OS, navigator.platform) stay consistent. export const FINGERPRINT_POOL: ReadonlyArray = [ { - userAgent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:150.0) Gecko/20100101 Firefox/150.0", + userAgent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:152.0) Gecko/20100101 Firefox/152.0", platform: "Win32", locale: "en-US", timezone: "America/New_York", }, { - userAgent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:150.0) Gecko/20100101 Firefox/150.0", + userAgent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:152.0) Gecko/20100101 Firefox/152.0", platform: "MacIntel", locale: "en-US", timezone: "America/Los_Angeles", }, { - userAgent: "Mozilla/5.0 (X11; Linux x86_64; rv:150.0) Gecko/20100101 Firefox/150.0", + userAgent: "Mozilla/5.0 (X11; Linux x86_64; rv:152.0) Gecko/20100101 Firefox/152.0", platform: "Linux x86_64", locale: "en-US", timezone: "Europe/London", }, { - userAgent: "Mozilla/5.0 (X11; Linux armv8; rv:150.0) Gecko/20100101 Firefox/150.0", + userAgent: "Mozilla/5.0 (X11; Linux armv8; rv:152.0) Gecko/20100101 Firefox/152.0", platform: "Linux armv8", locale: "en-US", timezone: "Asia/Tokyo",