openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-11-13 21:30:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add opt-in signer-service support for macOS releases (#61371)

Browse Source 
## What changed

Wire signer-service settings from repository variables into the PKCS11 setup action for macOS binary, DMG, and provisioned bundle releases. Keep the feature disabled by default; Azure continues to supply tools, certificates, and notarization.

Require signing mode, a pinned certificate, GitHub OIDC, and valid endpoint, purpose, and key ID inputs when enabled. Reject pre-supplied OIDC tokens and providers missing signer-service support markers, then export the signer-service backend configuration.

GitOrigin-RevId: d6c9f2f65512892b286e4bbeb271633e23a96a24
This commit is contained in:
tarunoai
2026-11-13 20:24:01 +00:00
committed by copyberry
parent ba3071a66d
commit 9e48702b3a
3 changed files with 87 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/rust-release-provisioned-macos.yml
+4
View File
@@ -98,6 +98,10 @@ jobs:
key-name: ${{ secrets.AKV_CODESIGN_KEY_NAME }}
key-version: ${{ secrets.AKV_CODESIGN_KEY_VERSION || '' }}
certificate-sha256: ${{ secrets.AKV_CODESIGN_CERTIFICATE_SHA256 }}
signer-service-enabled: ${{ vars.CODEX_PUBLIC_MACOS_SIGNER_SERVICE_ENABLED || 'false' }}
signer-service-endpoint: ${{ vars.CODEX_PUBLIC_MACOS_SIGNER_SERVICE_ENDPOINT }}
signer-service-purpose: ${{ vars.CODEX_PUBLIC_MACOS_SIGNER_SERVICE_PURPOSE }}
signer-service-key-id: ${{ vars.CODEX_PUBLIC_MACOS_SIGNER_SERVICE_KEY_ID }}
- name: Sign and notarize the provisioned bundle
env:
APPLE_NOTARIZATION_AKV_KEY_NAME: ${{ secrets.AKV_NOTARIZATION_KEY_NAME }}
.github/workflows/rust-release.yml
+8
View File
@@ -711,6 +711,10 @@ jobs:
key-name: ${{ secrets.AKV_CODESIGN_KEY_NAME }}
key-version: ${{ secrets.AKV_CODESIGN_KEY_VERSION || '' }}
certificate-sha256: ${{ secrets.AKV_CODESIGN_CERTIFICATE_SHA256 || '' }}
signer-service-enabled: ${{ vars.CODEX_PUBLIC_MACOS_SIGNER_SERVICE_ENABLED || 'false' }}
signer-service-endpoint: ${{ vars.CODEX_PUBLIC_MACOS_SIGNER_SERVICE_ENDPOINT }}
signer-service-purpose: ${{ vars.CODEX_PUBLIC_MACOS_SIGNER_SERVICE_PURPOSE }}
signer-service-key-id: ${{ vars.CODEX_PUBLIC_MACOS_SIGNER_SERVICE_KEY_ID }}
- name: Sign and notarize macOS binaries
shell: bash
@@ -1223,6 +1227,10 @@ jobs:
key-name: ${{ secrets.AKV_CODESIGN_KEY_NAME }}
key-version: ${{ secrets.AKV_CODESIGN_KEY_VERSION || '' }}
certificate-sha256: ${{ secrets.AKV_CODESIGN_CERTIFICATE_SHA256 || '' }}
signer-service-enabled: ${{ vars.CODEX_PUBLIC_MACOS_SIGNER_SERVICE_ENABLED || 'false' }}
signer-service-endpoint: ${{ vars.CODEX_PUBLIC_MACOS_SIGNER_SERVICE_ENDPOINT }}
signer-service-purpose: ${{ vars.CODEX_PUBLIC_MACOS_SIGNER_SERVICE_PURPOSE }}
signer-service-key-id: ${{ vars.CODEX_PUBLIC_MACOS_SIGNER_SERVICE_KEY_ID }}
- name: Sign, notarize, and staple macOS DMG
shell: bash