mirror of
https://github.com/openai/codex.git
synced 2026-09-05 15:18:41 +00:00
110 lines
3.4 KiB
Bash
Executable File
110 lines
3.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
set -euo pipefail
|
|
|
|
if [[ "$#" -ne 1 ]]; then
|
|
echo "usage: $0 <archive-path>" >&2
|
|
exit 1
|
|
fi
|
|
|
|
archive_path="$1"
|
|
workspace="${GITHUB_WORKSPACE:?missing GITHUB_WORKSPACE}"
|
|
bash_commit="${BASH_COMMIT:?missing BASH_COMMIT}"
|
|
bash_patch="${BASH_PATCH:?missing BASH_PATCH}"
|
|
temp_root="${RUNNER_TEMP:-/tmp}"
|
|
work_root="$(mktemp -d "${temp_root%/}/codex-bash-release.XXXXXX")"
|
|
trap 'rm -rf "$work_root"' EXIT
|
|
|
|
source_root="${work_root}/bash"
|
|
package_root="${work_root}/codex-bash"
|
|
wrapper_path="${work_root}/exec-wrapper"
|
|
stdout_path="${work_root}/stdout.txt"
|
|
wrapper_log_path="${work_root}/wrapper.log"
|
|
socket_probe_path="${work_root}/socket-probe.txt"
|
|
|
|
git clone https://git.savannah.gnu.org/git/bash "$source_root"
|
|
cd "$source_root"
|
|
git checkout "$bash_commit"
|
|
git apply "${workspace}/${bash_patch}"
|
|
|
|
configure_args=(--without-bash-malloc)
|
|
if [[ -n "${BASH_HOST:-}" ]]; then
|
|
configure_args+=(
|
|
--host="$BASH_HOST"
|
|
--disable-nls
|
|
--disable-readline
|
|
--enable-static-link
|
|
)
|
|
fi
|
|
if [[ -n "${MACOSX_DEPLOYMENT_TARGET:-}" ]]; then
|
|
# The macOS 15 SDK exposes strchrnul even though it is unavailable on our
|
|
# minimum supported macOS version. Use Bash's bundled implementation.
|
|
export bash_cv_func_strchrnul_works=no
|
|
fi
|
|
./configure "${configure_args[@]}"
|
|
|
|
cores="$(command -v nproc >/dev/null 2>&1 && nproc || getconf _NPROCESSORS_ONLN)"
|
|
make -j"${cores}"
|
|
|
|
# Stand in for codex-execve-wrapper: record each intercepted executable and
|
|
# prove that the inherited escalation-socket descriptor is still open.
|
|
cat > "$wrapper_path" <<'EOF'
|
|
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
: "${CODEX_WRAPPER_LOG:?missing CODEX_WRAPPER_LOG}"
|
|
: "${EXEC_WRAPPER:?missing EXEC_WRAPPER}"
|
|
: "${CODEX_ESCALATE_SOCKET:?missing CODEX_ESCALATE_SOCKET}"
|
|
printf 'socket-open\n' >&"${CODEX_ESCALATE_SOCKET}"
|
|
printf '%s\n' "$@" >> "$CODEX_WRAPPER_LOG"
|
|
file="$1"
|
|
shift
|
|
if [[ "$#" -eq 0 ]]; then
|
|
exec "$file"
|
|
fi
|
|
arg0="$1"
|
|
shift
|
|
exec -a "$arg0" "$file" "$@"
|
|
EOF
|
|
chmod +x "$wrapper_path"
|
|
|
|
# The nested bash and /bin/echo should each pass through EXEC_WRAPPER while
|
|
# retaining the same inherited descriptor.
|
|
CODEX_WRAPPER_LOG="$wrapper_log_path" \
|
|
CODEX_ESCALATE_SOCKET=9 \
|
|
EXEC_WRAPPER="$wrapper_path" \
|
|
"${source_root}/bash" \
|
|
-c "\"${source_root}/bash\" -c '/bin/echo smoke-bash'" \
|
|
> "$stdout_path" \
|
|
9> "$socket_probe_path"
|
|
|
|
grep -Fx "smoke-bash" "$stdout_path"
|
|
grep -Fx "${source_root}/bash" "$wrapper_log_path"
|
|
grep -Fx "/bin/echo" "$wrapper_log_path"
|
|
[[ "$(grep -Fxc "socket-open" "$socket_probe_path")" -eq 2 ]]
|
|
|
|
if [[ -n "${BASH_HOST:-}" ]]; then
|
|
file "${source_root}/bash" | grep -F "statically linked"
|
|
if readelf -l "${source_root}/bash" | grep -q "INTERP"; then
|
|
echo "bash contains an ELF interpreter despite requesting a static build" >&2
|
|
exit 1
|
|
fi
|
|
fi
|
|
|
|
if [[ -n "${MACOSX_DEPLOYMENT_TARGET:-}" ]]; then
|
|
minos="$(otool -l "${source_root}/bash" | awk '$1 == "minos" { print $2; exit }')"
|
|
if [[ "$minos" != "$MACOSX_DEPLOYMENT_TARGET" ]]; then
|
|
echo "bash has minimum macOS version ${minos}, expected ${MACOSX_DEPLOYMENT_TARGET}" >&2
|
|
exit 1
|
|
fi
|
|
if nm -u "${source_root}/bash" | grep -Eq '[[:space:]]_?strchrnul$'; then
|
|
echo "bash references strchrnul, which is unavailable on macOS 12" >&2
|
|
exit 1
|
|
fi
|
|
fi
|
|
|
|
mkdir -p "$package_root/bin" "$(dirname "${workspace}/${archive_path}")"
|
|
cp "${source_root}/bash" "$package_root/bin/bash"
|
|
chmod +x "$package_root/bin/bash"
|
|
|
|
(cd "$work_root" && tar -czf "${workspace}/${archive_path}" codex-bash)
|