openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-10-31 19:28:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

plugins: verify installed cache provenance

Browse Source
This commit is contained in:
Chris Hayduk
2026-06-24 08:52:49 -04:00
parent f959e7fc98
commit bbca0efa26
9 changed files with 412 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/core-plugins/src/store_tests.rs
+30
View File
@@ -192,6 +192,36 @@ fn install_with_version_uses_requested_cache_version() {
assert!(installed_path.join(".codex-plugin/plugin.json").is_file());
}
#[test]
fn install_records_and_verifies_exact_source_bytes() {
let tmp = tempdir().unwrap();
write_plugin_with_version(tmp.path(), "sample-plugin", "sample-plugin", Some("1.2.3"));
let plugin_id = PluginId::new("sample-plugin".to_string(), "debug".to_string()).unwrap();
let store = PluginStore::new(tmp.path().to_path_buf());
let source = AbsolutePathBuf::try_from(tmp.path().join("sample-plugin")).unwrap();
let result = store
.install(source.clone(), plugin_id.clone())
.expect("install plugin");
let matches_source = || {
store
.active_plugin_matches_source(&plugin_id, source.as_path())
.expect("verify installed bytes")
};
assert!(matches_source());
let provenance_path = store
.plugin_base_root(&plugin_id)
.join(crate::install_provenance::INSTALL_PROVENANCE_FILE);
assert!(provenance_path.is_file());
fs::write(result.installed_path.join("skills/SKILL.md"), "tampered")
.expect("tamper installed file");
assert!(!matches_source());
store.install(source.clone(), plugin_id.clone()).unwrap();
fs::write(&provenance_path, "corrupt").expect("corrupt install provenance");
assert!(!matches_source());
store.install(source.clone(), plugin_id.clone()).unwrap();
fs::write(source.join("skills/SKILL.md"), "updated source").expect("update source file");
assert!(!matches_source());
}
#[test]
fn remote_plugin_install_metadata_follows_installed_cache_lifecycle() {
let tmp = tempdir().unwrap();