mirror of
https://github.com/openai/codex.git
synced 2026-08-25 13:28:55 +00:00
a453588416
## Why The macOS release workflow fetched `rg` and zsh while assembling package archives, after the signing stage. This left the bundled helper executables outside the workflow's signing and notarization checks. ## What changed - Fetch, sign, notarize, and upload the pinned macOS `rg` and zsh binaries with the other release artifacts. - Build package archives from those signed helpers via `--rg-bin` and the new `--zsh-bin` override. - Verify the helpers' architecture, signatures, and absence of entitlements in the final package. ## Testing - Cover the prebuilt zsh override and verify that package assembly preserves the supplied helper binaries. GitOrigin-RevId: a3865c04fa2f0f4df32e627ee7202bc87bdc3241
32 lines
836 B
Python
32 lines
836 B
Python
"""Fetch the patched zsh fork used by shell_zsh_fork."""
|
|
|
|
from pathlib import Path
|
|
|
|
from .dotslash import fetch_dotslash_executable
|
|
from .targets import REPO_ROOT
|
|
from .targets import TargetSpec
|
|
from .targets import resolve_input_path
|
|
|
|
|
|
ZSH_MANIFEST = REPO_ROOT / "scripts" / "codex_package" / "codex-zsh"
|
|
ZSH_RESOURCE_PATH = Path("zsh") / "bin" / "zsh"
|
|
|
|
|
|
def resolve_zsh_bin(
|
|
spec: TargetSpec,
|
|
manifest_path: Path | None = None,
|
|
*,
|
|
zsh_bin: Path | None = None,
|
|
) -> Path | None:
|
|
if zsh_bin is not None:
|
|
return resolve_input_path(zsh_bin, "zsh executable", "--zsh-bin")
|
|
|
|
return fetch_dotslash_executable(
|
|
spec,
|
|
manifest_path=manifest_path or ZSH_MANIFEST,
|
|
artifact_label="codex-zsh",
|
|
cache_key=f"{spec.target}-zsh",
|
|
dest_name="zsh",
|
|
missing_ok=True,
|
|
)
|