riley-oai c0e1b78253 Preserve the provisioned macOS CLI's code-signing identity (#46495) ...

## Why

Existing login-keychain access rules identify the CLI as `codex`. Packaging it in an app bundle must preserve that code-signing identifier independently of the bundle identifier and provisioned App ID.

## What changed

- Sign the provisioned CLI with the identifier `codex`, retaining `com.openai.codex.cli` as its bundle identifier.
- Require the expected signing identifier and team during signature verification, and reject unexpected bundle identifiers, executable names, or package types.
- Document the identity distinction and keychain compatibility limits.

## Testing

Extend signing-driver tests to check the signing identifier, verification requirement, bundle metadata, and provisioned entitlements, and to reject altered bundle identity fields. These tests use generated credentials and stubbed native tools; they do not verify runtime keychain access or credential recovery.

GitOrigin-RevId: ab00072e48189551adb0e70008210fee6d36241d

2026-09-18 22:53:21 +00:00

..

macos-signing

Preserve the provisioned macOS CLI's code-signing identity (#46495)

2026-09-18 22:53:21 +00:00

archive-release-symbols-and-strip-binaries.sh

[codex] Restore release symbol artifacts with line tables (#26202)

2026-06-08 17:16:36 +00:00

build-codex-package-archive.sh

Bundle native voice runtimes in Windows releases (#44922)

2026-09-11 21:59:24 +00:00

build-zsh-release-artifact.sh

fix: keep zsh-fork release assets after removing shell-tool-mcp (#15644)

2026-03-24 12:56:26 -07:00

check_ci_results.py

[codex] group blocking and postmerge CI workflows (#30146)

2026-06-26 15:07:05 -07:00

compute-bazel-windows-path.ps1

ci: cross-compile Windows Bazel tests (#20585)

2026-05-01 15:55:28 -07:00

install-musl-build-tools.sh

Use OpenSSL 3.6.4 for musl builds (#45149)

2026-09-13 01:19:53 +00:00

install-musl-openssl.sh

Use OpenSSL 3.6.4 for musl builds (#45149)

2026-09-13 01:19:53 +00:00

publish_r2_release.py

Parallelize R2 asset publishing with DotSlash (#36871)

2026-08-04 10:05:24 +00:00

resolve_python_cli_release.py

Publish Python packages after stable CLI releases (#44067)

2026-09-09 05:39:52 +00:00

run_bazel_with_buildbuddy.py

ci: route build IO through Dev Drives (#31357)

2026-07-08 14:06:37 -07:00

run-argument-comment-lint-bazel.sh

Remove Windows Bazel lint toolchain overrides (#34827)

2026-07-22 21:07:34 +00:00

run-bazel-ci.sh

Bundle native voice runtimes in Windows releases (#44922)

2026-09-11 21:59:24 +00:00

run-bazel-query-ci.sh

[codex] Keep Bazel startup options stable across commands (#26256)

2026-06-04 20:23:37 -07:00

rusty_v8_bazel.py

Normalize rusty_v8 checksum manifest line endings (#36797)

2026-08-03 20:41:24 +00:00

rusty_v8_module_bazel.py

CI: Customize v8 building (#22086)

2026-05-18 21:33:05 -07:00

setup-dev-drive.ps1

ci: route build IO through Dev Drives (#31357)

2026-07-08 14:06:37 -07:00

setup-voice-windows.ps1

Bundle native voice runtimes in Windows releases (#44922)

2026-09-11 21:59:24 +00:00

test_macos_signing_entitlements.py

fix(release): add missing Intel V8 signing entitlement (#30953)

2026-07-07 16:47:21 +00:00

test_resolve_python_cli_release.py

Publish Python packages after stable CLI releases (#44067)

2026-09-09 05:39:52 +00:00

test_run_bazel_with_buildbuddy.py

ci: route build IO through Dev Drives (#31357)

2026-07-08 14:06:37 -07:00

test_rusty_v8_bazel.py

Format Python scripts across the repository (#42109)

2026-09-01 17:47:29 +00:00

test_v8_canary_changes.py

ci: route build IO through Dev Drives (#31357)

2026-07-08 14:06:37 -07:00

test_verify_pypi_release.py

Gate Python SDK publishing on runtime availability and verify PyPI files (#44055)

2026-09-09 04:47:38 +00:00

test_voice_cygwin_inputs.py

Bundle native voice runtimes in Windows releases (#44922)

2026-09-11 21:59:24 +00:00

v8_canary_changes.py

Format Python scripts across the repository (#42109)

2026-09-01 17:47:29 +00:00

verify_bazel_clippy_lints.py

ci: sync Bazel clippy lints and fix uncovered violations (#16351)

2026-03-31 17:09:48 -07:00

verify_cargo_workspace_manifests.py

Format Python scripts across the repository (#42109)

2026-09-01 17:47:29 +00:00

verify_pypi_release.py

Gate Python SDK publishing on runtime availability and verify PyPI files (#44055)

2026-09-09 04:47:38 +00:00

verify_tui_core_boundary.py

Format Python scripts across the repository (#42109)

2026-09-01 17:47:29 +00:00

verify-zsh-manifest.sh

Verify the pinned zsh manifest in release builds (#39056)

2026-08-17 19:30:38 +00:00

voice_windows_tools.py

Bundle native voice runtimes in Windows releases (#44922)

2026-09-11 21:59:24 +00:00

voice-cygwin-inputs.py

Bundle native voice runtimes in Windows releases (#44922)

2026-09-11 21:59:24 +00:00

voice-cygwin-snapshot.json

Bundle native voice runtimes in Windows releases (#44922)

2026-09-11 21:59:24 +00:00

watch_voice_bazel.py

Bundle native voice runtimes in Windows releases (#44922)

2026-09-11 21:59:24 +00:00