openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-10-28 18:58:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

Ship codex-exec-server in CLI and app-server packages (#57590)

Browse Source 
## What changed

- Build and bundle the standalone executor in `bin/` for both package variants, and advertise its path through `execServer` in `codex-package.json`.
- Include the executor in Cargo and Bazel release packaging, macOS signing and notarization, and Windows signing verification. Preserve prebuilt signed binaries during packaging.
- Make installers detect a missing advertised executor while continuing to accept older packages without it.

## Testing

Add coverage for executor archive contents and executable permissions, signed binary preservation, and macOS entitlement verification. Add package smoke tests for initialization, version reporting, filesystem and process sandbox enforcement, and startup error parity with `codex exec-server`.

GitOrigin-RevId: 5c0027fc19f16cf9c2a5bb52dbd065a9776bc2af
This commit is contained in:
Dmitriy Kovalenko
2026-10-27 23:14:18 +00:00
committed by copyberry
parent a9ea49e78b
commit cf2c04b325
23 changed files with 497 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/rust-release-windows.yml
+25 -5
View File
@@ -4,7 +4,7 @@ on:
workflow_call:
env:
WINDOWS_BINARIES: "codex codex-code-mode-host codex-responses-api-proxy codex-windows-sandbox-setup codex-windows-sandbox-service codex-command-runner codex-app-server"
WINDOWS_BINARIES: "codex codex-code-mode-host codex-exec-server codex-responses-api-proxy codex-windows-sandbox-setup codex-windows-sandbox-service codex-command-runner codex-app-server"
jobs:
build-windows-binaries:
@@ -39,14 +39,14 @@ jobs:
- runner: windows-x64
target: x86_64-pc-windows-msvc
bundle: primary
binaries: "codex codex-code-mode-host codex-responses-api-proxy"
binaries: "codex codex-code-mode-host codex-exec-server codex-responses-api-proxy"
runs_on:
group: ${{ github.event.repository.name }}-runners
labels: ${{ github.event.repository.name }}-windows-x64
- runner: windows-arm64
target: aarch64-pc-windows-msvc
bundle: primary
binaries: "codex codex-code-mode-host codex-responses-api-proxy"
binaries: "codex codex-code-mode-host codex-exec-server codex-responses-api-proxy"
runs_on:
group: ${{ github.event.repository.name }}-runners
labels: ${{ github.event.repository.name }}-windows-arm64
@@ -67,14 +67,14 @@ jobs:
- runner: windows-x64
target: x86_64-pc-windows-msvc
bundle: app-server
binaries: "codex-app-server codex-code-mode-host"
binaries: "codex-app-server codex-code-mode-host codex-exec-server"
runs_on:
group: ${{ github.event.repository.name }}-runners
labels: ${{ github.event.repository.name }}-windows-x64
- runner: windows-arm64
target: aarch64-pc-windows-msvc
bundle: app-server
binaries: "codex-app-server codex-code-mode-host"
binaries: "codex-app-server codex-code-mode-host codex-exec-server"
runs_on:
group: ${{ github.event.repository.name }}-runners
labels: ${{ github.event.repository.name }}-windows-arm64
@@ -549,6 +549,26 @@ jobs:
--entrypoint-dir "$CARGO_TARGET_DIR/$target/release" \
--archive-dir "dist/$target"
- name: Verify packaged executor signatures and bytes
shell: pwsh
run: |
$target = "${{ matrix.target }}"
$source = Join-Path $env:CARGO_TARGET_DIR "$target/release/codex-exec-server.exe"
foreach ($stem in @("codex-package", "codex-app-server-package")) {
$package = Join-Path $env:RUNNER_TEMP "verify-executor-$stem-$target"
New-Item -ItemType Directory -Path $package | Out-Null
tar -xzf "dist/$target/$stem-$target.tar.gz" -C $package
if ($LASTEXITCODE -ne 0) { throw "Cannot extract executor package" }
$binary = Join-Path $package "bin/codex-exec-server.exe"
if ((Get-FileHash $binary).Hash -ne (Get-FileHash $source).Hash) {
throw "Packaged executor differs from the signed input"
}
$signature = Get-AuthenticodeSignature $binary
if ($signature.Status -ne "Valid" -or $null -eq $signature.TimeStamperCertificate) {
throw "Invalid or untimestamped executor signature"
}
}
- name: Verify packaged Windows voice closure
shell: pwsh
run: |
.github/workflows/rust-release.yml
+36 -26
View File
@@ -96,50 +96,50 @@ jobs:
target: aarch64-apple-darwin
bundle: primary
artifact_name: aarch64-apple-darwin
binaries: "codex codex-code-mode-host codex-responses-api-proxy"
binaries: "codex codex-code-mode-host codex-exec-server codex-responses-api-proxy"
build_dmg: "true"
- runner: macos-15-xlarge
target: aarch64-apple-darwin
bundle: app-server
artifact_name: aarch64-apple-darwin-app-server
binaries: "codex-app-server codex-code-mode-host"
binaries: "codex-app-server codex-code-mode-host codex-exec-server"
build_dmg: "false"
- runner: macos-15-xlarge
target: x86_64-apple-darwin
bundle: primary
artifact_name: x86_64-apple-darwin
binaries: "codex codex-code-mode-host codex-responses-api-proxy"
binaries: "codex codex-code-mode-host codex-exec-server codex-responses-api-proxy"
build_dmg: "true"
- runner: macos-15-xlarge
target: x86_64-apple-darwin
bundle: app-server
artifact_name: x86_64-apple-darwin-app-server
binaries: "codex-app-server codex-code-mode-host"
binaries: "codex-app-server codex-code-mode-host codex-exec-server"
build_dmg: "false"
# Release artifacts intentionally ship MUSL-linked Linux binaries.
- runner: ${{ github.event.repository.name }}-linux-x64-xl
target: x86_64-unknown-linux-musl
bundle: primary
artifact_name: x86_64-unknown-linux-musl
binaries: "codex codex-code-mode-host codex-responses-api-proxy bwrap"
binaries: "codex codex-code-mode-host codex-exec-server codex-responses-api-proxy bwrap"
build_dmg: "false"
- runner: ${{ github.event.repository.name }}-linux-x64-xl
target: x86_64-unknown-linux-musl
bundle: app-server
artifact_name: x86_64-unknown-linux-musl-app-server
binaries: "codex-app-server codex-code-mode-host"
binaries: "codex-app-server codex-code-mode-host codex-exec-server"
build_dmg: "false"
- runner: ${{ github.event.repository.name }}-linux-arm64
target: aarch64-unknown-linux-musl
bundle: primary
artifact_name: aarch64-unknown-linux-musl
binaries: "codex codex-code-mode-host codex-responses-api-proxy bwrap"
binaries: "codex codex-code-mode-host codex-exec-server codex-responses-api-proxy bwrap"
build_dmg: "false"
- runner: ${{ github.event.repository.name }}-linux-arm64
target: aarch64-unknown-linux-musl
bundle: app-server
artifact_name: aarch64-unknown-linux-musl-app-server
binaries: "codex-app-server codex-code-mode-host"
binaries: "codex-app-server codex-code-mode-host codex-exec-server"
build_dmg: "false"
steps:
@@ -398,9 +398,9 @@ jobs:
mkdir -p "$dest"
for binary in ${{ matrix.binaries }}; do
# Both variants package the host, but only the primary bundle publishes
# Both variants package the host and executor; only the primary publishes
# standalone binary archives to avoid duplicate release asset names.
if [[ "${{ matrix.bundle }}" == "app-server" && "$binary" == "codex-code-mode-host" ]]; then
if [[ "${{ matrix.bundle }}" == "app-server" && ( "$binary" == "codex-code-mode-host" || "$binary" == "codex-exec-server" ) ]]; then
continue
fi
cp "target/${{ matrix.target }}/release/${binary}" "$dest/${binary}-${{ matrix.target }}"
@@ -662,19 +662,19 @@ jobs:
- target: aarch64-apple-darwin
bundle: primary
artifact_name: aarch64-apple-darwin
binaries: "codex codex-code-mode-host codex-responses-api-proxy"
binaries: "codex codex-code-mode-host codex-exec-server codex-responses-api-proxy"
- target: aarch64-apple-darwin
bundle: app-server
artifact_name: aarch64-apple-darwin-app-server
binaries: "codex-app-server codex-code-mode-host"
binaries: "codex-app-server codex-code-mode-host codex-exec-server"
- target: x86_64-apple-darwin
bundle: primary
artifact_name: x86_64-apple-darwin
binaries: "codex codex-code-mode-host codex-responses-api-proxy"
binaries: "codex codex-code-mode-host codex-exec-server codex-responses-api-proxy"
- target: x86_64-apple-darwin
bundle: app-server
artifact_name: x86_64-apple-darwin-app-server
binaries: "codex-app-server codex-code-mode-host"
binaries: "codex-app-server codex-code-mode-host codex-exec-server"
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -907,22 +907,22 @@ jobs:
- target: aarch64-apple-darwin
bundle: primary
artifact_name: aarch64-apple-darwin
binaries: "codex codex-code-mode-host codex-responses-api-proxy"
binaries: "codex codex-code-mode-host codex-exec-server codex-responses-api-proxy"
build_dmg: "true"
- target: aarch64-apple-darwin
bundle: app-server
artifact_name: aarch64-apple-darwin-app-server
binaries: "codex-app-server codex-code-mode-host"
binaries: "codex-app-server codex-code-mode-host codex-exec-server"
build_dmg: "false"
- target: x86_64-apple-darwin
bundle: primary
artifact_name: x86_64-apple-darwin
binaries: "codex codex-code-mode-host codex-responses-api-proxy"
binaries: "codex codex-code-mode-host codex-exec-server codex-responses-api-proxy"
build_dmg: "true"
- target: x86_64-apple-darwin
bundle: app-server
artifact_name: x86_64-apple-darwin-app-server
binaries: "codex-app-server codex-code-mode-host"
binaries: "codex-app-server codex-code-mode-host codex-exec-server"
build_dmg: "false"
steps:
@@ -1001,9 +1001,9 @@ jobs:
mkdir -p "$dest"
for binary in ${{ matrix.binaries }}; do
# Both variants package the host, but only the primary bundle publishes
# Both variants package the host and executor; only the primary publishes
# standalone binary archives to avoid duplicate release asset names.
if [[ "${{ matrix.bundle }}" == "app-server" && "$binary" == "codex-code-mode-host" ]]; then
if [[ "${{ matrix.bundle }}" == "app-server" && ( "$binary" == "codex-code-mode-host" || "$binary" == "codex-exec-server" ) ]]; then
continue
fi
cp "target/${{ matrix.target }}/release/${binary}" "$dest/${binary}-${{ matrix.target }}"
@@ -1300,22 +1300,22 @@ jobs:
- target: aarch64-apple-darwin
bundle: primary
artifact_name: aarch64-apple-darwin
binaries: "codex codex-code-mode-host codex-responses-api-proxy"
binaries: "codex codex-code-mode-host codex-exec-server codex-responses-api-proxy"
verify_dmg: "true"
- target: aarch64-apple-darwin
bundle: app-server
artifact_name: aarch64-apple-darwin-app-server
binaries: "codex-app-server codex-code-mode-host"
binaries: "codex-app-server codex-code-mode-host codex-exec-server"
verify_dmg: "false"
- target: x86_64-apple-darwin
bundle: primary
artifact_name: x86_64-apple-darwin
binaries: "codex codex-code-mode-host codex-responses-api-proxy"
binaries: "codex codex-code-mode-host codex-exec-server codex-responses-api-proxy"
verify_dmg: "true"
- target: x86_64-apple-darwin
bundle: app-server
artifact_name: x86_64-apple-darwin-app-server
binaries: "codex-app-server codex-code-mode-host"
binaries: "codex-app-server codex-code-mode-host codex-exec-server"
verify_dmg: "false"
steps:
@@ -1376,6 +1376,15 @@ jobs:
normalized_actual="$(mktemp)"
normalized_expected="$(mktemp)"
codesign -d --entitlements :- "$path" >"$actual_entitlements"
# An omitted entitlement blob is valid only when the expected plist is empty.
python3 - "$expected_entitlements" "$actual_entitlements" <<'PY'
import plistlib
import sys
from pathlib import Path
expected, actual = map(Path, sys.argv[1:])
if not actual.stat().st_size and plistlib.loads(expected.read_bytes()) == {}:
actual.write_bytes(expected.read_bytes())
PY
plutil -convert xml1 -o "$normalized_actual" "$actual_entitlements"
plutil -convert xml1 -o "$normalized_expected" "$expected_entitlements"
diff -u "$normalized_expected" "$normalized_actual"
@@ -1386,9 +1395,9 @@ jobs:
binary_path="${RUNNER_TEMP}/signed-binaries/${binary}"
verify_signed_binary "$binary_path" "$binary"
# The app-server package contains the host, but its standalone archives
# The app-server package contains both helpers, but their standalone archives
# are omitted above to avoid duplicate release asset names.
if [[ "${{ matrix.bundle }}" == "app-server" && "$binary" == "codex-code-mode-host" ]]; then
if [[ "${{ matrix.bundle }}" == "app-server" && ( "$binary" == "codex-code-mode-host" || "$binary" == "codex-exec-server" ) ]]; then
continue
fi
@@ -1424,6 +1433,7 @@ jobs:
tar -xzf "${packaged_dir}/${package_stem}-${target}.tar.gz" -C "$package_dir"
verify_signed_binary "${package_dir}/bin/${package_entrypoint}" "$package_entrypoint"
verify_signed_binary "${package_dir}/bin/codex-code-mode-host" "codex-code-mode-host"
verify_signed_binary "${package_dir}/bin/codex-exec-server" "codex-exec-server"
for resource in \
"${package_dir}/codex-path/rg"