mirror of
https://github.com/daijro/camoufox.git
synced 2026-10-04 00:00:26 +00:00
Jake WriterandClaude Opus 5
859000ded2
fpgen supplies every synthetic fingerprint, and it does not ship its model --
it downloads one on first import, and again whenever the files are over five
weeks old. Four things are wrong with that fetch, all in fpgen/pkgman.py:
* TLS verification is disabled on BOTH the API call and the download
(verify=False), so anyone on the path can serve the model;
* the archive is never checksummed, and goes straight into extractall()
with no path-traversal guard;
* the GitHub API is called unauthenticated, on a rate limit shared by every
job on the runner's IP;
* it takes the FIRST release the API lists. model-4/2025 and model-2/2026
carry an identical created_at (2025-03-22, inherited from the tag's
commit), so the sort ties and resolves to the lower id -- model-4/2025.
The consequence is that every Camoufox generates from an April-2025 corpus and
cannot be talked into anything newer: newest Firefox 137, newest GPU an RTX 40,
no RDNA4. The 2026 model has been sitting unreachable for seven months.
scripts/pin-fpgen-model.py installs the model named by scripts/data/fpgen-model.json
before anything imports fpgen, with verification on and the sha256 checked, and
refuses any member that escapes the data directory. Finding fpgen's data dir
must not import fpgen -- importing is what triggers the download -- so it reads
the module origin via find_spec without executing it. Wired into all seven CI
jobs that install pythonlib.
Pinning to model-2/2026 then failed tests/test_launch_geometry.py about 30% of
the time, on `availHeight < height`. That turned out to be our bug, not the
model's: fix_screen_no_taskbar only fired when avail equalled screen on BOTH
axes, so `availWidth < width, availHeight == height` -- a Windows taskbar
docked left or right -- passed straight through and the identity claimed no
vertical chrome at all. Rare shape, but the 2026 corpus produces it in ~30% of
draws once conditioned on a small display, against under 1% unconditioned.
Trigger on the height alone: a side dock is far rarer than a Mac menu bar, a
bottom taskbar or a Linux panel, so the vertical delta is worth more than the
few genuine side-docked machines it overwrites.
316 passed, 2 skipped with the 2026 model pinned.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>