openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-09-20 12:47:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

Preserve the provisioned macOS CLI's code-signing identity (#46495)

Browse Source 
## Why

Existing login-keychain access rules identify the CLI as `codex`. Packaging it in an app bundle must preserve that code-signing identifier independently of the bundle identifier and provisioned App ID.

## What changed

- Sign the provisioned CLI with the identifier `codex`, retaining `com.openai.codex.cli` as its bundle identifier.
- Require the expected signing identifier and team during signature verification, and reject unexpected bundle identifiers, executable names, or package types.
- Document the identity distinction and keychain compatibility limits.

## Testing

Extend signing-driver tests to check the signing identifier, verification requirement, bundle metadata, and provisioned entitlements, and to reject altered bundle identity fields. These tests use generated credentials and stubbed native tools; they do not verify runtime keychain access or credential recovery.

GitOrigin-RevId: ab00072e48189551adb0e70008210fee6d36241d
This commit is contained in:
riley-oai
2026-09-18 02:53:21 +00:00
committed by copyberry
parent 6d29cc6bac
commit c0e1b78253
5 changed files with 134 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
.github/scripts/macos-signing/sign_macos_cli_package.py vendored
View File

@@ -41,7 +41,7 @@ def main(configuration: bundle.ProfileConfiguration | None = None):
if provisioned and relative == "bin/codex":
binary = package / bundle.EXECUTABLE
target = package / bundle.APP
identifier = bundle.BUNDLE_ID
identifier = bundle.CODE_SIGNING_ID
entitlements = reports / "codex-provisioned-entitlements.plist"
if args.operation == "sign":
command = [
@@ -95,6 +95,18 @@ def main(configuration: bundle.ProfileConfiguration | None = None):
["lipo", str(binary), "-verify_arch", architectures[target_triple]],
check=True,
)
# Preserve the CLI's existing login-keychain identity while checking
# its bundle/App ID and provisioning independently in bundle.verify.
requirement = (
"=anchor apple generic"
" and certificate 1[field.1.2.840.113635.100.6.2.6] exists"
" and certificate leaf[field.1.2.840.113635.100.6.1.13] exists"
)
if provisioned and relative == "bin/codex":
requirement += (
f' and identifier "{bundle.CODE_SIGNING_ID}"'
f' and certificate leaf[subject.OU] = "{configuration.team_id}"'
)
subprocess.run(
[
"codesign",
@@ -102,12 +114,7 @@ def main(configuration: bundle.ProfileConfiguration | None = None):
"--strict",
"--verbose=2",
"--test-requirement",
# Require Apple's Developer ID Application certificate chain.
(
"=anchor apple generic"
" and certificate 1[field.1.2.840.113635.100.6.2.6] exists"
" and certificate leaf[field.1.2.840.113635.100.6.1.13] exists"
),
requirement,
str(target),
],
check=True,