Repository navigation
feat: add Chrome 152 TLS fingerprint - #2
Merged
Merged
Conversation
Chrome 152 sends trust_anchors (0xCA 8000 34) and GREASE in signature_algorithms. Compile BoringSSL from vendor/boringssl so SSL_CTX_set_grease_sigalgs_enabled is available. CI fetches the submodule and, on tags, uploads wheels to GitHub Releases. Forks skip PyPI because the utls name is taken by upstream.
Un-overindent the trust_anchors doc list so clippy -D all passes. Ruff-format chrome_152.py. Bump version so tag CI can build wheels.
Keep jawah/utls as the project homepage and PyPI install path so this branch can be reviewed against origin/main without fork branding.
main and pull requests keep lint and tests. Packaging, GitHub Release, and PyPI already ran only on tags; stop rebuilding every platform twice when a release push also tags the same commit.
Ousret
self-requested a review
September 8, 2026 06:35
Ousret
approved these changes
Sep 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add a
chrome:152profile and pointchrome:stableat it.Chrome 152 is the first stable major that sends the
trust_anchorsextension (0xCA34, draft-ietf-tls-trust-anchor-ids) with the Chrome Root Store ID list, and prepends a per-connection GREASE value tosignature_algorithms. Cipher suites, groups, and ML-DSA schemes are unchanged fromchrome:150. The extra extension changes JA4 fromt13d1516h2_…tot13d1517h2_8daaf6152771_cb7bf5808d99.trust_anchorsis a first-classFingerprintfield, applied with BoringSSL'sSSL_set1_requested_trust_anchors. GREASE insignature_algorithmsis applied withSSL_CTX_set_grease_sigalgs_enabled. That API is not in the BoringSSL snapshot vendored bycloudflare/boring(e2a57cfb4), so builds compile C fromvendor/boringsslviaBORING_BSSL_SOURCE_PATH(git submodule, currentlyc66572ad4).CI checkouts now use
submodules: recursiveso the overlay is present on lint/test/wheel jobs. PyPI publish is gated tojawah/utlsso forks cannot collide on theutlspackage name; upstream publish behavior is unchanged.The ClientHello was captured from a live Chrome 152 tab against
tls.peet.ws.