Repository navigation
Conversation
Since Chrome 152, every ClientHello carries the Trust Anchor IDs extension (0xca34) and a GREASE value first in signature_algorithms. chrome155 is chrome_151 plus those two, with 155 headers (accept gains image/jxl). It lists only the 13 roots from Chrome's trust anchor list, not Chrome's intermediates, so a server can't pick a chain impit can't verify. This adds ExtensionType::TrustAnchors, SignatureAlgorithm::Grease and TlsExtensions::with_trust_anchors, and a test that chrome155's JA4_r equals real Chrome 155's (155.0.8059.80, Windows 11). The ClientHello parser it shares with the Firefox tests moves to database.rs. Needs the apify/rustls change that adds both (apify/rustls#27); it doesn't build against the pinned rev until a later commit bumps it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
chrome151 and chrome155 now send Chrome's two GREASE extensions, an empty one first and a 1-byte one last, through the new `TlsExtensions::with_grease_first_and_last` opt-in. chrome151 also gets the empty `trust_anchors` (0xca34) that Chrome for Testing 151 sends with the field-trial testing config. chrome151's JA4 is now t13d1517h2_8daaf6152771_cb7bf5808d99. Needs apify/rustls#27. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
chrome156 is chrome155 with Chrome 156's headers: sec-ch-ua and the user agent carry 156, and sec-ch-ua has a new GREASE brand and brand order. Consumer Chrome 156.0.8078.48 (Windows 11) sends the same TLS and HTTP/2 as 155, including the same Trust Anchor IDs list, so the JA4_r test checks it against Chrome 155's value. Both were checked on tls.peet.ws and in a decrypted Wireshark capture. Needs apify/rustls#27; it doesn't build against the pinned rev until a later commit bumps it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Adds `Browser.Chrome155` / `Browser.Chrome156` to impit-node (with `index.d.ts` regenerated by `pnpm build:debug`) and `'chrome155'` / `'chrome156'` to impit-python. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Points the rustls patch at 2b5779e2, the squash merge of apify/rustls#27. Only the rustls source line in Cargo.lock changes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
chrome157 is chrome156 with Chrome 157's headers: sec-ch-ua and the user agent carry 157, and sec-ch-ua has a new GREASE brand and brand order. Consumer Chrome 157.0.8103.51 (Windows 11) sends the same TLS and HTTP/2 as 156, including the same Trust Anchor IDs list, so the JA4_r test checks it against Chrome 155's value. Checked on tls.peet.ws and in a decrypted Wireshark capture. Also adds chrome157 to the Node and Python bindings. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Codex Review Summary: ❌ FailedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #588.
Adds
chrome155,chrome156andchrome157fingerprints (Rust, Node and Python), using the Trust Anchor IDs extension, signature GREASE and GREASE extensions from apify/rustls#27 (rev bumped to its merge commit). They advertise only the 13 roots from Chrome's trust anchor list (all in the Mozilla set impit trusts), not Chrome's intermediates, so a server can't pick a chain impit can't verify. JA4 matches real Chrome 155–157.As you suggested in #588, chrome151 now also sends the empty
0xca34and Chrome's two GREASE extensions, so its JA4 changes fromt13d1516h2_8daaf6152771_806a8c22fdeatot13d1517h2_8daaf6152771_cb7bf5808d99.