mirror of
https://github.com/openai/codex.git
synced 2026-08-23 13:09:46 +00:00
a453588416
## Why The macOS release workflow fetched `rg` and zsh while assembling package archives, after the signing stage. This left the bundled helper executables outside the workflow's signing and notarization checks. ## What changed - Fetch, sign, notarize, and upload the pinned macOS `rg` and zsh binaries with the other release artifacts. - Build package archives from those signed helpers via `--rg-bin` and the new `--zsh-bin` override. - Verify the helpers' architecture, signatures, and absence of entitlements in the final package. ## Testing - Cover the prebuilt zsh override and verify that package assembly preserves the supplied helper binaries. GitOrigin-RevId: a3865c04fa2f0f4df32e627ee7202bc87bdc3241
78 lines
2.6 KiB
Python
78 lines
2.6 KiB
Python
#!/usr/bin/env python3
|
|
|
|
import hashlib
|
|
import json
|
|
from pathlib import Path
|
|
import sys
|
|
import tarfile
|
|
import tempfile
|
|
import unittest
|
|
from unittest.mock import patch
|
|
|
|
sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
|
|
|
|
from codex_package.targets import TARGET_SPECS
|
|
from codex_package.zsh import resolve_zsh_bin
|
|
|
|
|
|
class ResolveZshBinTest(unittest.TestCase):
|
|
def test_uses_prebuilt_executable_override(self) -> None:
|
|
with tempfile.TemporaryDirectory() as temp_dir:
|
|
signed_zsh = Path(temp_dir) / "signed-zsh"
|
|
signed_zsh.write_bytes(b"signed zsh binary")
|
|
signed_zsh.chmod(0o755)
|
|
|
|
with patch("codex_package.zsh.fetch_dotslash_executable") as fetch:
|
|
zsh_bin = resolve_zsh_bin(
|
|
TARGET_SPECS["aarch64-apple-darwin"], zsh_bin=signed_zsh
|
|
)
|
|
|
|
self.assertEqual(zsh_bin, signed_zsh.resolve())
|
|
fetch.assert_not_called()
|
|
|
|
def test_uses_manifest_override(self) -> None:
|
|
with tempfile.TemporaryDirectory() as temp_dir:
|
|
root = Path(temp_dir)
|
|
archive = root / "codex-zsh.tar.gz"
|
|
source = root / "zsh"
|
|
source.write_bytes(b"standalone zsh")
|
|
with tarfile.open(archive, "w:gz") as tar:
|
|
tar.add(source, arcname="codex-zsh/bin/zsh")
|
|
|
|
manifest = root / "codex-zsh"
|
|
manifest.write_text(
|
|
json.dumps(
|
|
{
|
|
"platforms": {
|
|
"linux-x86_64": {
|
|
"size": archive.stat().st_size,
|
|
"hash": "sha256",
|
|
"digest": hashlib.sha256(
|
|
archive.read_bytes()
|
|
).hexdigest(),
|
|
"format": "tar.gz",
|
|
"path": "codex-zsh/bin/zsh",
|
|
"providers": [{"url": archive.as_uri()}],
|
|
}
|
|
}
|
|
}
|
|
),
|
|
encoding="utf-8",
|
|
)
|
|
|
|
with patch(
|
|
"codex_package.dotslash.default_cache_root",
|
|
return_value=root / "cache",
|
|
):
|
|
zsh_bin = resolve_zsh_bin(
|
|
TARGET_SPECS["x86_64-unknown-linux-musl"], manifest
|
|
)
|
|
|
|
self.assertIsNotNone(zsh_bin)
|
|
assert zsh_bin is not None
|
|
self.assertEqual(zsh_bin.read_bytes(), b"standalone zsh")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|