openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-09-08 15:50:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

app-server: require keychain entitlements before macOS fallback

Browse Source
This commit is contained in:
Ruslan Nigmatullin
2026-04-23 12:56:57 -07:00
parent 972149926d
commit 8d431c0c50
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
codex-rs/device-key/src/platform/macos_provider.m
View File

@@ -78,8 +78,7 @@ static BOOL CodexDeviceKeyMacClassIsValid(int32_t keyClass) {
static BOOL CodexDeviceKeyMacSecureEnclaveUnavailableStatus(OSStatus status) {
return status == errSecUnimplemented ||
status == errSecParam ||
status == CodexDeviceKeyErrSecMissingEntitlement;
status == errSecParam;
}
static NSData *CodexDeviceKeyMacTagData(NSString *keyTag) {
@@ -186,6 +185,13 @@ static SecKeyRef CodexDeviceKeyMacCreatePrivateKey(
NSError *nsError = createError == NULL ? nil : CFBridgingRelease(createError);
OSStatus code = nsError == nil ? 0 : (OSStatus)nsError.code;
// Missing Keychain entitlements affect both Secure Enclave and OS-protected permanent keys, so
// do not classify this as degraded hardware availability and retry with the fallback class.
if (code == CodexDeviceKeyErrSecMissingEntitlement) {
*status = CodexDeviceKeyMacStatusPlatformError;
*errorMessage = @"macOS Keychain entitlements are required to create persistent device keys";
return NULL;
}
if (keyClass == CodexDeviceKeyMacKeyClassSecureEnclave &&
CodexDeviceKeyMacSecureEnclaveUnavailableStatus(code)) {
*status = CodexDeviceKeyMacStatusHardwareUnavailable;