From afb1b3c98435d228f516f4ed7c79cd04e8c493c5 Mon Sep 17 00:00:00 2001
From: Charlie Marsh <charliemarsh@openai.com>
Date: Mon, 17 Aug 2026 18:58:03 +0000
Subject: [PATCH] Verify the pinned zsh manifest in release builds (#39056)

## Why

Release jobs download the `codex-zsh` manifest before packaging or signing its
bundled binaries. Verify that download against a pinned digest so an unexpected
manifest cannot enter release artifacts.

## What changed

- Pin the SHA-256 digest for the `codex-zsh-v0.1.0` manifest.
- Add a portable verification script that uses `sha256sum` or macOS `shasum`.
- Run verification in both the package archive and macOS helper signing flows.

GitOrigin-RevId: a404bb897c8cc0bf3c0ff38e8a6e1cce059d7fab
---
 .github/scripts/verify-zsh-manifest.sh | 12 ++++++++++++
 .github/workflows/rust-release.yml     |  5 +++++
 2 files changed, 17 insertions(+)
 create mode 100644 .github/scripts/verify-zsh-manifest.sh

diff --git a/.github/scripts/verify-zsh-manifest.sh b/.github/scripts/verify-zsh-manifest.sh
new file mode 100644
index 0000000000..cb9bab0922
--- /dev/null
+++ b/.github/scripts/verify-zsh-manifest.sh
@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+manifest="${1:?missing zsh manifest path}"
+expected_sha256="${2:?missing expected zsh manifest SHA-256}"
+
+if command -v sha256sum >/dev/null 2>&1; then
+  printf '%s  %s\n' "$expected_sha256" "$manifest" | sha256sum --check -
+else
+  printf '%s  %s\n' "$expected_sha256" "$manifest" | shasum -a 256 --check -
+fi
diff --git a/.github/workflows/rust-release.yml b/.github/workflows/rust-release.yml
index f6c10f7a09..c154a8aed4 100644
--- a/.github/workflows/rust-release.yml
+++ b/.github/workflows/rust-release.yml
@@ -16,6 +16,7 @@ on:
 
 env:
   CODEX_ZSH_RELEASE_TAG: codex-zsh-v0.1.0
+  CODEX_ZSH_MANIFEST_SHA256: c534eab89dcea7e3d8a5e5b3f49c025c7c64cd4e4d9814ee24871de58a9359a1
 
 concurrency:
   group: ${{ github.workflow }}
@@ -361,6 +362,8 @@ jobs:
           curl -fsSL \
             "https://github.com/${GITHUB_REPOSITORY}/releases/download/${CODEX_ZSH_RELEASE_TAG}/codex-zsh" \
             -o "${RUNNER_TEMP}/codex-zsh"
+          bash "${GITHUB_WORKSPACE}/.github/scripts/verify-zsh-manifest.sh" \
+            "${RUNNER_TEMP}/codex-zsh" "$CODEX_ZSH_MANIFEST_SHA256"
 
       - name: Build Codex package archive
         if: ${{ runner.os != 'macOS' }}
@@ -599,6 +602,8 @@ jobs:
           curl -fsSL \
             "https://github.com/${GITHUB_REPOSITORY}/releases/download/${CODEX_ZSH_RELEASE_TAG}/codex-zsh" \
             -o "$zsh_manifest"
+          bash "${GITHUB_WORKSPACE}/.github/scripts/verify-zsh-manifest.sh" \
+            "$zsh_manifest" "$CODEX_ZSH_MANIFEST_SHA256"
 
           PYTHONPATH="${GITHUB_WORKSPACE}/scripts" python3 - "$TARGET" "$signed_root" "$zsh_manifest" <<'PY'
           import shutil