openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-10-18 17:18:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

Stop bundling patched zsh in Codex packages (#52213)

Browse Source 
## What changed

Remove the patched `zsh` resource from package assembly and macOS signing, along with the `--zsh-bin` and `--zsh-manifest` packaging options.

Delete the standalone `codex-zsh` release workflow, build scripts, and DotSlash manifests. Update package documentation and layout and signing tests to match the remaining resources.

GitOrigin-RevId: 429a8db55048fed7facec89957910206523b6013
This commit is contained in:
jif
2026-10-08 18:17:04 +00:00
committed by copyberry
parent ade12342e2
commit a645742bb5
18 changed files with 12 additions and 577 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/actions/build-codex-packages/action.yml
-12
View File
@@ -103,16 +103,6 @@ runs:
cp "$underscored_pdb" "$expected_pdb"
done
- name: Download packaged zsh manifest
if: ${{ runner.os != 'Windows' }}
shell: bash
working-directory: codex-rs
run: |
set -euo pipefail
curl -fsSL \
"https://github.com/openai/codex/releases/download/codex-zsh-v0.1.0/codex-zsh" \
-o "${RUNNER_TEMP}/codex-zsh"
- name: Archive symbols and strip binaries
shell: bash
working-directory: codex-rs
@@ -160,8 +150,6 @@ runs:
--codex-command-runner-bin "${release_dir}/codex-command-runner.exe"
--codex-windows-sandbox-setup-bin "${release_dir}/codex-windows-sandbox-setup.exe"
)
else
package_args+=(--zsh-manifest "${RUNNER_TEMP}/codex-zsh")
fi
python3 "${PACKAGE_SOURCE_ROOT}/scripts/build_codex_package.py" \
.github/dotslash-zsh-config.json
-32
View File
@@ -1,32 +0,0 @@
{
"outputs": {
"codex-zsh": {
"platforms": {
"macos-aarch64": {
"name": "codex-zsh-aarch64-apple-darwin.tar.gz",
"format": "tar.gz",
"hash": "sha256",
"path": "codex-zsh/bin/zsh"
},
"macos-x86_64": {
"name": "codex-zsh-x86_64-apple-darwin.tar.gz",
"format": "tar.gz",
"hash": "sha256",
"path": "codex-zsh/bin/zsh"
},
"linux-x86_64": {
"name": "codex-zsh-x86_64-unknown-linux-musl.tar.gz",
"format": "tar.gz",
"hash": "sha256",
"path": "codex-zsh/bin/zsh"
},
"linux-aarch64": {
"name": "codex-zsh-aarch64-unknown-linux-musl.tar.gz",
"format": "tar.gz",
"hash": "sha256",
"path": "codex-zsh/bin/zsh"
}
}
}
}
}
.github/scripts/build-codex-package-archive.sh
-10
View File
@@ -11,8 +11,6 @@ Usage: build-codex-package-archive.sh \
[--bwrap-bin <path>] \
[--code-mode-host-bin <path>] \
[--rg-bin <path>] \
[--zsh-bin <path>] \
[--zsh-manifest <path>] \
[--codex-command-runner-bin <path>] \
[--codex-windows-sandbox-setup-bin <path>] \
[--voice-release-dir <path> --release-version <release-version>] \
@@ -65,14 +63,6 @@ while [[ $# -gt 0 ]]; do
resource_args+=(--rg-bin "${2:?--rg-bin requires a value}")
shift 2
;;
--zsh-bin)
resource_args+=(--zsh-bin "${2:?--zsh-bin requires a value}")
shift 2
;;
--zsh-manifest)
resource_args+=(--zsh-manifest "${2:?--zsh-manifest requires a value}")
shift 2
;;
--codex-command-runner-bin)
resource_args+=(
--codex-command-runner-bin
.github/scripts/build-zsh-release-artifact.sh
-61
View File
@@ -1,61 +0,0 @@
#!/usr/bin/env bash
set -euo pipefail
if [[ "$#" -ne 1 ]]; then
echo "usage: $0 <archive-path>" >&2
exit 1
fi
archive_path="$1"
workspace="${GITHUB_WORKSPACE:?missing GITHUB_WORKSPACE}"
zsh_commit="${ZSH_COMMIT:?missing ZSH_COMMIT}"
zsh_patch="${ZSH_PATCH:?missing ZSH_PATCH}"
temp_root="${RUNNER_TEMP:-/tmp}"
work_root="$(mktemp -d "${temp_root%/}/codex-zsh-release.XXXXXX")"
trap 'rm -rf "$work_root"' EXIT
source_root="${work_root}/zsh"
package_root="${work_root}/codex-zsh"
wrapper_path="${work_root}/exec-wrapper"
stdout_path="${work_root}/stdout.txt"
wrapper_log_path="${work_root}/wrapper.log"
git clone https://git.code.sf.net/p/zsh/code "$source_root"
cd "$source_root"
git checkout "$zsh_commit"
git apply "${workspace}/${zsh_patch}"
./Util/preconfig
./configure
cores="$(command -v nproc >/dev/null 2>&1 && nproc || getconf _NPROCESSORS_ONLN)"
make -j"${cores}"
cat > "$wrapper_path" <<'EOF'
#!/usr/bin/env bash
set -euo pipefail
: "${CODEX_WRAPPER_LOG:?missing CODEX_WRAPPER_LOG}"
printf '%s\n' "$@" > "$CODEX_WRAPPER_LOG"
file="$1"
shift
if [[ "$#" -eq 0 ]]; then
exec "$file"
fi
arg0="$1"
shift
exec -a "$arg0" "$file" "$@"
EOF
chmod +x "$wrapper_path"
CODEX_WRAPPER_LOG="$wrapper_log_path" \
EXEC_WRAPPER="$wrapper_path" \
"${source_root}/Src/zsh" -fc '/bin/echo smoke-zsh' > "$stdout_path"
grep -Fx "smoke-zsh" "$stdout_path"
grep -Fx "/bin/echo" "$wrapper_log_path"
mkdir -p "$package_root/bin" "$(dirname "${workspace}/${archive_path}")"
cp "${source_root}/Src/zsh" "$package_root/bin/zsh"
chmod +x "$package_root/bin/zsh"
(cd "$work_root" && tar -czf "${workspace}/${archive_path}" codex-zsh)
.github/scripts/macos-signing/provisioned_macos_cli_package.py
+1 -1
View File
@@ -19,7 +19,7 @@ CODE_SIGNING_ID = "codex"
APP = Path("CodexCLI.app")
EXECUTABLE = APP / "Contents/MacOS/codex"
SIGNING = Path(__file__).resolve().parent
HELPERS = ("bin/codex-code-mode-host", "codex-path/rg", "codex-resources/zsh/bin/zsh")
HELPERS = ("bin/codex-code-mode-host", "codex-path/rg")
LAUNCHER = """#!/bin/sh
set -eu
entry="$0"
.github/scripts/macos-signing/test_sign_macos_cli_package.py
+2 -2
View File
@@ -189,13 +189,13 @@ class MacosSigningTests(ProvisioningTestCase):
)
self.assertEqual(
["--entitlements" in call for call in signing],
[True, True, False, False],
[True, True, False],
)
self.assertEqual(
[call[0] for call in calls if call[0].startswith("notarize")],
["notarize_with_akv.py"]
if provisioned
else ["notarize_macos_binary_with_akv.sh"] * 4,
else ["notarize_macos_binary_with_akv.sh"] * 3,
)
self.assertEqual(
[call[1:] for call in calls if call[0] == "lipo"],
.github/scripts/verify-zsh-manifest.sh
-12
View File
@@ -1,12 +0,0 @@
#!/usr/bin/env bash
set -euo pipefail
manifest="${1:?missing zsh manifest path}"
expected_sha256="${2:?missing expected zsh manifest SHA-256}"
if command -v sha256sum >/dev/null 2>&1; then
printf '%s %s\n' "$expected_sha256" "$manifest" | sha256sum --check -
else
printf '%s %s\n' "$expected_sha256" "$manifest" | shasum -a 256 --check -
fi
.github/workflows/rust-release-zsh.yml
-182
View File
@@ -1,182 +0,0 @@
name: rust-release-zsh
on:
push:
tags:
- "codex-zsh-v*.*.*"
env:
ZSH_COMMIT: 77045ef899e53b9598bebc5a41db93a548a40ca6
ZSH_PATCH: codex-rs/shell-escalation/patches/zsh-exec-wrapper.patch
concurrency:
group: ${{ github.workflow }}::${{ github.ref_name }}
cancel-in-progress: false
jobs:
metadata:
runs-on: ubuntu-latest
outputs:
release_tag: ${{ steps.release_tag.outputs.release_tag }}
steps:
- name: Validate release tag
id: release_tag
env:
RELEASE_TAG: ${{ github.ref_name }}
shell: bash
run: |
set -euo pipefail
if [[ ! "${RELEASE_TAG}" =~ ^codex-zsh-v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
echo "Tag ${RELEASE_TAG} does not match codex-zsh-vX.Y.Z." >&2
exit 1
fi
echo "release_tag=${RELEASE_TAG}" >> "${GITHUB_OUTPUT}"
- name: Ensure release does not exist
env:
GH_TOKEN: ${{ github.token }}
RELEASE_TAG: ${{ steps.release_tag.outputs.release_tag }}
shell: bash
run: |
set -euo pipefail
if gh release view "${RELEASE_TAG}" --repo "${GITHUB_REPOSITORY}" > /dev/null 2>&1; then
echo "Release ${RELEASE_TAG} already exists; publish changed artifacts under a new tag." >&2
exit 1
fi
linux:
name: Build zsh (Linux) - ${{ matrix.variant }} - ${{ matrix.target }}
needs: metadata
runs-on: ${{ matrix.runner }}
timeout-minutes: 30
container:
image: ${{ matrix.image }}
strategy:
fail-fast: false
matrix:
include:
- runner: ubuntu-24.04
target: x86_64-unknown-linux-musl
variant: ubuntu-24.04
image: ubuntu:24.04
archive_name: codex-zsh-x86_64-unknown-linux-musl.tar.gz
- runner: ubuntu-24.04-arm
target: aarch64-unknown-linux-musl
variant: ubuntu-24.04
image: arm64v8/ubuntu:24.04
archive_name: codex-zsh-aarch64-unknown-linux-musl.tar.gz
steps:
- name: Install build prerequisites
shell: bash
run: |
set -euo pipefail
apt-get update
DEBIAN_FRONTEND=noninteractive apt-get install -y \
autoconf \
bison \
build-essential \
ca-certificates \
gettext \
git \
libncursesw5-dev
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- name: Build, smoke-test, and stage zsh artifact
shell: bash
run: |
"${GITHUB_WORKSPACE}/.github/scripts/build-zsh-release-artifact.sh" \
"dist/zsh/${{ matrix.target }}/${{ matrix.archive_name }}"
- uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
with:
name: codex-zsh-${{ matrix.target }}
path: dist/zsh/${{ matrix.target }}/*
darwin:
name: Build zsh (macOS) - ${{ matrix.variant }} - ${{ matrix.target }}
needs: metadata
runs-on: ${{ matrix.runner }}
timeout-minutes: 30
strategy:
fail-fast: false
matrix:
include:
- runner: macos-15-large
target: x86_64-apple-darwin
variant: macos-15
archive_name: codex-zsh-x86_64-apple-darwin.tar.gz
- runner: macos-15-xlarge
target: aarch64-apple-darwin
variant: macos-15
archive_name: codex-zsh-aarch64-apple-darwin.tar.gz
steps:
- name: Install build prerequisites
shell: bash
run: |
set -euo pipefail
if ! command -v autoconf >/dev/null 2>&1; then
brew install autoconf
fi
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- name: Build, smoke-test, and stage zsh artifact
shell: bash
run: |
"${GITHUB_WORKSPACE}/.github/scripts/build-zsh-release-artifact.sh" \
"dist/zsh/${{ matrix.target }}/${{ matrix.archive_name }}"
- uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
with:
name: codex-zsh-${{ matrix.target }}
path: dist/zsh/${{ matrix.target }}/*
publish-release:
needs:
- metadata
- linux
- darwin
runs-on: ubuntu-latest
permissions:
contents: write
actions: read
steps:
- name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
path: dist
- name: Create GitHub Release
uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
with:
tag_name: ${{ needs.metadata.outputs.release_tag }}
name: ${{ needs.metadata.outputs.release_tag }}
files: dist/**
# Keep zsh artifact releases out of Codex's normal "latest release" channel.
prerelease: true
- name: Publish DotSlash manifest
uses: ./.github/actions/publish-dotslash
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
with:
tag: ${{ needs.metadata.outputs.release_tag }}
configs: .github/dotslash-zsh-config.json
.github/workflows/rust-release.yml
+6 -35
View File
@@ -16,8 +16,6 @@ on:
env:
CODEX_REPO_ROOT: ${{ github.workspace }}
CODEX_ZSH_RELEASE_TAG: codex-zsh-v0.1.0
CODEX_ZSH_MANIFEST_SHA256: c534eab89dcea7e3d8a5e5b3f49c025c7c64cd4e4d9814ee24871de58a9359a1
# The launcher uses this per-tag group as the migration boundary. Keep shared
# publication jobs on the original queued group below when changing this.
@@ -415,17 +413,6 @@ jobs:
cp target/${{ matrix.target }}/release/codex-${{ matrix.target }}.dmg "$dest/codex-${{ matrix.target }}.dmg"
fi
- name: Download packaged zsh manifest
if: ${{ runner.os != 'macOS' }}
shell: bash
run: |
set -euo pipefail
curl -fsSL \
"https://github.com/${GITHUB_REPOSITORY}/releases/download/${CODEX_ZSH_RELEASE_TAG}/codex-zsh" \
-o "${RUNNER_TEMP}/codex-zsh"
bash "${GITHUB_WORKSPACE}/.github/scripts/verify-zsh-manifest.sh" \
"${RUNNER_TEMP}/codex-zsh" "$CODEX_ZSH_MANIFEST_SHA256"
- name: Build Codex package archive
if: ${{ runner.os != 'macOS' }}
shell: bash
@@ -444,7 +431,6 @@ jobs:
--bundle "$BUNDLE" \
--entrypoint-dir "target/${TARGET}/release" \
--archive-dir "dist/${TARGET}" \
--zsh-manifest "${RUNNER_TEMP}/codex-zsh" \
"${voice_args[@]}"
- name: Cosign Linux voice package archives
@@ -493,8 +479,7 @@ jobs:
--target "${{ matrix.target }}" \
--bundle primary \
--entrypoint-dir "target/${{ matrix.target }}/release" \
--archive-dir "$wheel_archives" \
--zsh-manifest "${RUNNER_TEMP}/codex-zsh"
--archive-dir "$wheel_archives"
wheel_archive="${wheel_archives}/codex-package-${{ matrix.target }}.tar.gz"
python3 - "$wheel_archive" <<'PY'
import sys
@@ -774,33 +759,22 @@ jobs:
set -euo pipefail
signed_root="${GITHUB_WORKSPACE}/signed-resources/${TARGET}"
zsh_manifest="${RUNNER_TEMP}/codex-zsh-${TARGET}"
mkdir -p "$signed_root"
curl -fsSL \
"https://github.com/${GITHUB_REPOSITORY}/releases/download/${CODEX_ZSH_RELEASE_TAG}/codex-zsh" \
-o "$zsh_manifest"
bash "${GITHUB_WORKSPACE}/.github/scripts/verify-zsh-manifest.sh" \
"$zsh_manifest" "$CODEX_ZSH_MANIFEST_SHA256"
PYTHONPATH="${GITHUB_WORKSPACE}/scripts" python3 - "$TARGET" "$signed_root" "$zsh_manifest" <<'PY'
PYTHONPATH="${GITHUB_WORKSPACE}/scripts" python3 - "$TARGET" "$signed_root" <<'PY'
import shutil
import sys
from pathlib import Path
from codex_package.ripgrep import fetch_rg
from codex_package.targets import TARGET_SPECS
from codex_package.zsh import resolve_zsh_bin
spec = TARGET_SPECS[sys.argv[1]]
signed_root = Path(sys.argv[2])
zsh_bin = resolve_zsh_bin(spec, Path(sys.argv[3]))
if zsh_bin is None:
raise RuntimeError(f"Pinned zsh release is missing {spec.target}")
shutil.copy2(fetch_rg(spec), signed_root / "rg")
shutil.copy2(zsh_bin, signed_root / "zsh")
PY
for resource in rg zsh; do
for resource in rg; do
binary="${signed_root}/${resource}"
report_dir="${GITHUB_WORKSPACE}/macos-binary-signing-verification/${TARGET}/${resource}"
mkdir -p "$report_dir"
@@ -1001,7 +975,7 @@ jobs:
codesign --verify --strict --verbose=2 "$binary_path"
done
for resource in rg zsh; do
for resource in rg; do
resource_path="signed-resources/${{ matrix.target }}/${resource}"
chmod 0755 "$resource_path"
codesign --verify --strict --verbose=2 "$resource_path"
@@ -1041,7 +1015,6 @@ jobs:
--entrypoint-dir "target/${TARGET}/release" \
--archive-dir "dist/${TARGET}" \
--rg-bin "signed-resources/${TARGET}/rg" \
--zsh-bin "signed-resources/${TARGET}/zsh" \
${voice_args[@]+"${voice_args[@]}"}
- name: Build unsigned macOS DMG
@@ -1129,8 +1102,7 @@ jobs:
--bundle primary \
--entrypoint-dir "target/${{ matrix.target }}/release" \
--archive-dir "$wheel_archives" \
--rg-bin "signed-resources/${{ matrix.target }}/rg" \
--zsh-bin "signed-resources/${{ matrix.target }}/zsh"
--rg-bin "signed-resources/${{ matrix.target }}/rg"
wheel_archive="${wheel_archives}/codex-package-${{ matrix.target }}.tar.gz"
python3 - "$wheel_archive" <<'PY'
import sys
@@ -1436,8 +1408,7 @@ jobs:
verify_signed_binary "${package_dir}/bin/codex-code-mode-host" "codex-code-mode-host"
for resource in \
"${package_dir}/codex-path/rg" \
"${package_dir}/codex-resources/zsh/bin/zsh"
"${package_dir}/codex-path/rg"
do
chmod 0755 "$resource"
lipo "$resource" -verify_arch "$expected_arch"
scripts/codex_package/README.md
-9
View File
@@ -22,7 +22,6 @@ The builder creates a canonical Codex package directory:
│ └── codex-code-mode-host[.exe]
├── codex-resources
│ ├── bwrap # Linux only
│ ├── zsh/bin/zsh # supported Unix targets only
│ ├── codex-command-runner.exe # Windows only
│ └── codex-windows-sandbox-setup.exe # Windows only
└── codex-path
@@ -100,11 +99,3 @@ DotSlash manifest at `scripts/codex_package/rg`. Downloaded archives are cached
under `$TMPDIR/codex-package/<target>-rg` and are reused only after the recorded
size and SHA-256 digest have been verified. Pass `--rg-bin` to use a local
ripgrep executable instead.
The patched zsh fork used by `shell_zsh_fork` is fetched from the DotSlash
manifest at `scripts/codex_package/codex-zsh` when the selected target has a
matching prebuilt artifact. Downloaded archives are cached under
`$TMPDIR/codex-package/<target>-zsh` and installed at
`codex-resources/zsh/bin/zsh`. Pass `--zsh-bin` to package a prebuilt, signed
executable, or `--zsh-manifest` to use a different DotSlash manifest, such as
the manifest published with a standalone zsh artifact release.
scripts/codex_package/cli.py
+1 -19
View File
@@ -17,7 +17,6 @@ from .targets import TARGET_SPECS
from .targets import PackageInputs
from .targets import default_target
from .targets import resolve_input_path
from .zsh import resolve_zsh_bin
from .version import read_workspace_version
@@ -149,20 +148,6 @@ def create_parser() -> argparse.ArgumentParser:
"targets, bwrap is built with Cargo."
),
)
zsh_source = parser.add_mutually_exclusive_group()
zsh_source.add_argument(
"--zsh-manifest",
type=Path,
help=(
"Optional DotSlash manifest for the patched zsh fork instead of "
"scripts/codex_package/codex-zsh."
),
)
zsh_source.add_argument(
"--zsh-bin",
type=Path,
help="Optional prebuilt zsh executable instead of fetching from a manifest.",
)
parser.add_argument(
"--codex-command-runner-bin",
type=Path,
@@ -245,7 +230,6 @@ def assemble_package(args: argparse.Namespace) -> Path:
entrypoint_bin=source_outputs.entrypoint_bin,
code_mode_host_bin=source_outputs.code_mode_host_bin,
rg_bin=resolve_rg_bin(spec, args.rg_bin),
zsh_bin=resolve_zsh_bin(spec, args.zsh_manifest, zsh_bin=args.zsh_bin),
bwrap_bin=source_outputs.bwrap_bin,
codex_command_runner_bin=source_outputs.codex_command_runner_bin,
codex_windows_sandbox_setup_bin=source_outputs.codex_windows_sandbox_setup_bin,
@@ -262,9 +246,7 @@ def assemble_package(args: argparse.Namespace) -> Path:
and prebuilt is None
):
strip_binary(package_dir / "bin" / filename, spec, tool=args.strip_tool)
validate_package_dir(
package_dir, variant, spec, include_zsh=inputs.zsh_bin is not None
)
validate_package_dir(package_dir, variant, spec)
return package_dir
scripts/codex_package/codex-zsh
-55
View File
@@ -1,55 +0,0 @@
#!/usr/bin/env dotslash
{
"name": "codex-zsh",
"platforms": {
"macos-aarch64": {
"size": 358776,
"hash": "sha256",
"digest": "49dec9832379688c9090666694a3449502ac5ebd4d76b9ffde1d0999cd088205",
"format": "tar.gz",
"path": "codex-zsh/bin/zsh",
"providers": [
{
"url": "https://github.com/openai/codex/releases/download/rust-v0.134.0-alpha.3/codex-zsh-aarch64-apple-darwin.tar.gz"
}
]
},
"macos-x86_64": {
"size": 391161,
"hash": "sha256",
"digest": "0246fd4703bb540ae74f13ec739ca365ebd607df44a1f21e335eb7a421352923",
"format": "tar.gz",
"path": "codex-zsh/bin/zsh",
"providers": [
{
"url": "https://github.com/openai/codex/releases/download/rust-v0.134.0-alpha.3/codex-zsh-x86_64-apple-darwin.tar.gz"
}
]
},
"linux-x86_64": {
"size": 433412,
"hash": "sha256",
"digest": "e7f760998c9644448d2cb8a821084a0134d6820c14b284bd7f39d7f32262ad40",
"format": "tar.gz",
"path": "codex-zsh/bin/zsh",
"providers": [
{
"url": "https://github.com/openai/codex/releases/download/rust-v0.134.0-alpha.3/codex-zsh-x86_64-unknown-linux-musl.tar.gz"
}
]
},
"linux-aarch64": {
"size": 411655,
"hash": "sha256",
"digest": "8d50cff5dfabc97e37e1138513da022d9247a802c2ff996ab91654bf1892c7d5",
"format": "tar.gz",
"path": "codex-zsh/bin/zsh",
"providers": [
{
"url": "https://github.com/openai/codex/releases/download/rust-v0.134.0-alpha.3/codex-zsh-aarch64-unknown-linux-musl.tar.gz"
}
]
}
}
}
scripts/codex_package/layout.py
-15
View File
@@ -8,7 +8,6 @@ from pathlib import Path
from .targets import PackageInputs
from .targets import PackageVariant
from .targets import TargetSpec
from .zsh import ZSH_RESOURCE_PATH
LAYOUT_VERSION = 1
@@ -58,13 +57,6 @@ def build_package_dir(
)
copy_executable(inputs.rg_bin, path_dir / spec.rg_name, is_windows=spec.is_windows)
if inputs.zsh_bin is not None:
copy_executable(
inputs.zsh_bin,
resources_dir / ZSH_RESOURCE_PATH,
is_windows=False,
)
if inputs.bwrap_bin is not None:
copy_executable(inputs.bwrap_bin, resources_dir / "bwrap", is_windows=False)
@@ -98,8 +90,6 @@ def validate_package_dir(
package_dir: Path,
variant: PackageVariant,
spec: TargetSpec,
*,
include_zsh: bool,
) -> None:
required_dirs = [
Path("bin"),
@@ -140,11 +130,6 @@ def validate_package_dir(
]
executable_files = list(required_files)
if include_zsh:
zsh_path = Path("codex-resources") / ZSH_RESOURCE_PATH
required_files.append(zsh_path)
executable_files.append(zsh_path)
if spec.is_linux:
required_files.append(Path("codex-resources") / "bwrap")
executable_files.append(Path("codex-resources") / "bwrap")
scripts/codex_package/smoke_tests/test_codex_package.py
-1
View File
@@ -12,7 +12,6 @@ ROOT_OF_EXTRACTED_PACKAGE
├── bwrap # Linux only
├── codex-command-runner.exe # Windows only
├── codex-windows-sandbox-setup.exe # Windows only
└── zsh/bin/zsh # supported Unix targets only
Debug symbols for all shipped binaries arrive in a separate companion archive.
Each package contains one entrypoint, not both codex and codex-app-server.
scripts/codex_package/targets.py
-1
View File
@@ -46,7 +46,6 @@ class PackageInputs:
entrypoint_bin: Path
code_mode_host_bin: Path
rg_bin: Path
zsh_bin: Path | None
bwrap_bin: Path | None
codex_command_runner_bin: Path | None
codex_windows_sandbox_setup_bin: Path | None
scripts/codex_package/test_layout.py
+2 -19
View File
@@ -64,7 +64,6 @@ int main(void) {
"--entrypoint-bin",
"--code-mode-host-bin",
"--rg-bin",
"--zsh-bin",
]
if "linux" in target:
flags.append("--bwrap-bin")
@@ -85,8 +84,7 @@ int main(void) {
else:
self.assertLess(executable.stat().st_size, len(original))
self.assertEqual(source.read_bytes(), original)
for resource in ("codex-path/rg", "codex-resources/zsh/bin/zsh"):
self.assertEqual((package / resource).read_bytes(), original)
self.assertEqual((package / "codex-path/rg").read_bytes(), original)
if "linux" in target:
self.assertEqual(
(package / "codex-resources/bwrap").read_bytes(), original
@@ -164,9 +162,7 @@ int main(void) {
package_dir = root / "package"
package_dir.mkdir()
rg_bin = touch_executable(root / "signed-rg")
zsh_bin = touch_executable(root / "signed-zsh")
rg_bin.write_bytes(b"signed ripgrep binary")
zsh_bin.write_bytes(b"signed zsh binary")
variant = PACKAGE_VARIANTS[variant_name]
spec = TARGET_SPECS[target]
inputs = PackageInputs(
@@ -177,31 +173,20 @@ int main(void) {
root / "codex-code-mode-host"
),
rg_bin=rg_bin,
zsh_bin=zsh_bin,
bwrap_bin=None,
codex_command_runner_bin=None,
codex_windows_sandbox_setup_bin=None,
)
build_package_dir(package_dir, "1.2.3", variant, spec, inputs)
validate_package_dir(
package_dir, variant, spec, include_zsh=True
)
validate_package_dir(package_dir, variant, spec)
self.assertEqual(
{
"rg": (package_dir / "codex-path" / "rg").read_bytes(),
"zsh": (
package_dir
/ "codex-resources"
/ "zsh"
/ "bin"
/ "zsh"
).read_bytes(),
},
{
"rg": b"signed ripgrep binary",
"zsh": b"signed zsh binary",
},
)
@@ -214,7 +199,6 @@ int main(void) {
entrypoint_bin=touch_executable(root / "codex-app-server"),
code_mode_host_bin=touch_executable(root / "codex-code-mode-host"),
rg_bin=touch_executable(root / "rg"),
zsh_bin=None,
bwrap_bin=touch_executable(root / "bwrap"),
codex_command_runner_bin=None,
codex_windows_sandbox_setup_bin=None,
@@ -231,7 +215,6 @@ int main(void) {
package_dir,
PACKAGE_VARIANTS["codex-app-server"],
TARGET_SPECS["x86_64-unknown-linux-musl"],
include_zsh=False,
)
self.assertTrue((package_dir / "bin" / "codex-code-mode-host").is_file())
scripts/codex_package/test_zsh.py
-83
View File
@@ -1,83 +0,0 @@
#!/usr/bin/env python3
import gzip
import hashlib
import json
from pathlib import Path
import sys
import tarfile
import tempfile
import unittest
from unittest.mock import patch
sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
from codex_package.targets import TARGET_SPECS
from codex_package.zsh import resolve_zsh_bin
class ResolveZshBinTest(unittest.TestCase):
def test_uses_prebuilt_executable_override(self) -> None:
with tempfile.TemporaryDirectory() as temp_dir:
signed_zsh = Path(temp_dir) / "signed-zsh"
signed_zsh.write_bytes(b"signed zsh binary")
signed_zsh.chmod(0o755)
with patch("codex_package.zsh.fetch_dotslash_executable") as fetch:
zsh_bin = resolve_zsh_bin(
TARGET_SPECS["aarch64-apple-darwin"], zsh_bin=signed_zsh
)
self.assertEqual(zsh_bin, signed_zsh.resolve())
fetch.assert_not_called()
def test_uses_manifest_override(self) -> None:
for archive_format in ("tar.gz", "gz"):
with self.subTest(archive_format=archive_format):
with tempfile.TemporaryDirectory() as temp_dir:
root = Path(temp_dir)
archive = root / f"codex-zsh.{archive_format}"
source = root / "zsh"
source.write_bytes(b"standalone zsh")
if archive_format == "gz":
archive.write_bytes(gzip.compress(source.read_bytes()))
else:
with tarfile.open(archive, "w:gz") as tar:
tar.add(source, arcname="codex-zsh/bin/zsh")
manifest = root / "codex-zsh"
manifest.write_text(
json.dumps(
{
"platforms": {
"linux-x86_64": {
"size": archive.stat().st_size,
"hash": "sha256",
"digest": hashlib.sha256(
archive.read_bytes()
).hexdigest(),
"format": archive_format,
"path": "codex-zsh/bin/zsh",
"providers": [{"url": archive.as_uri()}],
}
}
}
),
encoding="utf-8",
)
with patch(
"codex_package.dotslash.default_cache_root",
return_value=root / "cache",
):
zsh_bin = resolve_zsh_bin(
TARGET_SPECS["x86_64-unknown-linux-musl"], manifest
)
self.assertIsNotNone(zsh_bin)
assert zsh_bin is not None
self.assertEqual(zsh_bin.read_bytes(), b"standalone zsh")
if __name__ == "__main__":
unittest.main()
scripts/codex_package/zsh.py
-28
View File
@@ -1,28 +0,0 @@
"""Fetch the patched zsh fork used by shell_zsh_fork."""
from pathlib import Path
from .dotslash import fetch_dotslash_executable
from .targets import TargetSpec, resolve_input_path
ZSH_MANIFEST = Path(__file__).with_name("codex-zsh")
ZSH_RESOURCE_PATH = Path("zsh") / "bin" / "zsh"
def resolve_zsh_bin(
spec: TargetSpec,
manifest_path: Path | None = None,
*,
zsh_bin: Path | None = None,
) -> Path | None:
if zsh_bin is not None:
return resolve_input_path(zsh_bin, "zsh executable", "--zsh-bin")
return fetch_dotslash_executable(
spec,
manifest_path=manifest_path or ZSH_MANIFEST,
artifact_label="codex-zsh",
cache_key=f"{spec.target}-zsh",
dest_name="zsh",
missing_ok=True,
)