From 9248df5978cfc7186b3311eec932c006615adf29 Mon Sep 17 00:00:00 2001 From: sayan-oai Date: Wed, 11 Nov 2026 23:08:34 +0000 Subject: [PATCH] Include bundled bubblewrap in the root metadata test fixture (#60898) ## Why The root metadata test copies the sandbox executable into an isolated root, which also needs access to the bundled bubblewrap fallback. ## What changed Copy the discovered bundled binary into the fixture's `codex-resources/bwrap`. Allow the system binary as a fallback when `CODEX_BWRAP_SHA256` is absent or all zeros; require a matching bundle for digest-verified builds. GitOrigin-RevId: 6d61fa212d8ecfd05f482a219dfc4f1c5911e08c --- .../tests/suite/root_metadata_tests.rs | 21 +++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) diff --git a/codex-rs/linux-sandbox/tests/suite/root_metadata_tests.rs b/codex-rs/linux-sandbox/tests/suite/root_metadata_tests.rs index fe7d4dcc20..5566b292ea 100644 --- a/codex-rs/linux-sandbox/tests/suite/root_metadata_tests.rs +++ b/codex-rs/linux-sandbox/tests/suite/root_metadata_tests.rs @@ -33,8 +33,25 @@ async fn root_metadata_symlinks_cannot_reopen_approved_denials() { fs::write(work.join("public/secret"), "outside").unwrap(); fs::write(private.join("reopened/secret"), "private").unwrap(); fs::write(private.join("sibling"), "sibling").unwrap(); - codex_utils_cargo_bin::copy_executable(&codex_linux_sandbox_exe(), &work.join("sandbox")) - .unwrap(); + let sandbox_exe = codex_linux_sandbox_exe(); + codex_utils_cargo_bin::copy_executable(&sandbox_exe, &work.join("sandbox")).unwrap(); + // Carry the bundled fallback into the isolated root. Cargo builds without + // an embedded digest can use the system binary when no bundle is available. + let fixture_bwrap = codex_linux_sandbox::find_bundled_bwrap_for_exe( + &sandbox_exe, + &std::env::current_dir().expect("current directory"), + |key| std::env::var_os(key), + ) + .map(AbsolutePathBuf::into_path_buf) + .or_else(|| { + option_env!("CODEX_BWRAP_SHA256") + .is_none_or(|digest| digest.chars().all(|character| character == '0')) + .then(|| bwrap.clone()) + }) + .expect("digest-verified builds require the matching bundled bubblewrap"); + let resources = work.join("codex-resources"); + fs::create_dir(&resources).unwrap(); + codex_utils_cargo_bin::copy_executable(&fixture_bwrap, &resources.join("bwrap")).unwrap(); let path_entry = |path: &str, access| { FileSystemSandboxEntry::new(