openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-11-12 21:20:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

Include bundled bubblewrap in the root metadata test fixture (#60898)

Browse Source 
## Why

The root metadata test copies the sandbox executable into an isolated root, which also needs access to the bundled bubblewrap fallback.

## What changed

Copy the discovered bundled binary into the fixture's `codex-resources/bwrap`. Allow the system binary as a fallback when `CODEX_BWRAP_SHA256` is absent or all zeros; require a matching bundle for digest-verified builds.

GitOrigin-RevId: 6d61fa212d8ecfd05f482a219dfc4f1c5911e08c
This commit is contained in:
sayan-oai
2026-11-11 23:23:09 +00:00
committed by copyberry
parent 14e039906c
commit 9248df5978
1 changed files with 19 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/linux-sandbox/tests/suite/root_metadata_tests.rs
+19 -2
View File
@@ -33,8 +33,25 @@ async fn root_metadata_symlinks_cannot_reopen_approved_denials() {
fs::write(work.join("public/secret"), "outside").unwrap();
fs::write(private.join("reopened/secret"), "private").unwrap();
fs::write(private.join("sibling"), "sibling").unwrap();
codex_utils_cargo_bin::copy_executable(&codex_linux_sandbox_exe(), &work.join("sandbox"))
.unwrap();
let sandbox_exe = codex_linux_sandbox_exe();
codex_utils_cargo_bin::copy_executable(&sandbox_exe, &work.join("sandbox")).unwrap();
// Carry the bundled fallback into the isolated root. Cargo builds without
// an embedded digest can use the system binary when no bundle is available.
let fixture_bwrap = codex_linux_sandbox::find_bundled_bwrap_for_exe(
&sandbox_exe,
&std::env::current_dir().expect("current directory"),
|key| std::env::var_os(key),
)
.map(AbsolutePathBuf::into_path_buf)
.or_else(|| {
option_env!("CODEX_BWRAP_SHA256")
.is_none_or(|digest| digest.chars().all(|character| character == '0'))
.then(|| bwrap.clone())
})
.expect("digest-verified builds require the matching bundled bubblewrap");
let resources = work.join("codex-resources");
fs::create_dir(&resources).unwrap();
codex_utils_cargo_bin::copy_executable(&fixture_bwrap, &resources.join("bwrap")).unwrap();
let path_entry = |path: &str, access| {
FileSystemSandboxEntry::new(