Concept
A coherent persona for every browsing context.
A fingerprint profile is the combination of browser engine, persona OS, locale, and patched browser build presented to a target site. Weles rotates fingerprints to stop agents running into CAPTCHAs and bans.
What composes a profile#
| Input | Default | Effect |
|---|---|---|
--browser <name> | chromium | Engine passed to AsyncNewBrowser; chromium or firefox. |
--os <name> | macos | Persona OS passed to AsyncNewBrowser. |
--locale <locale> | (unset) | Locale passed to AsyncNewBrowser. |
--chromium-path <path> | CHROMIUM_PATH or bundled build | Custom Chromium binary path. |
--proxy <url> | (unset) | Proxy server URL for the browsing context. |
Patched builds#
The engines themselves are custom C++-patched Chromium and Firefox forks (the public wisent-ai/weles-chromium and firefox sources). They launch only when the host's local receipt matches the exact Stado release coordinate and checksum selected for the worker, so the stealth surface is pinned like everything else. Setting WELES_USE_STOCK_CHROMIUM opts out of the managed build — doctor reports whether it is set.
Apple-signed Firefox archives#
The Firefox producer packages a previously built macOS app with python3 -m weles_firefox package --app /path/to/Firefox.app --version 142.0a1-weles.N, from the weles-firefox checkout. Replace N with the candidate revision. The command copies the input, preserves CFBundleIdentifier, signs native code through Wisent Products, verifies the complete bundle with codesign, and only then creates the archive, checksum and release-metadata.json. It neither opens a browser nor changes the installed browser.
The builder needs an available Apple Development or Developer ID Application identity. Missing signing tools or identities remain errors; ad-hoc signing is refused. A dirty producer checkout, an incompatible Firefox version or an existing candidate output is refused. The metadata retains the producer revision, patch tree, input executable digest and Apple designated requirement. Candidate publication and browser execution keep their existing authorization and dedicated-host requirements.
Weles verifies the publisher-signed archive without replacing its code signature. It must not sign an installed checksum-selected browser in place, because that would invalidate the recorded release bytes.