Benjamin Carlsson
721f46a07a
## What changed - Build, sign, and notarize `codex-voice-host` and its native runtime for Apple Silicon and Intel macOS release packages, granting the helper audio-input access. - Include voice resources in primary package archives and DMGs, with a root-level `codex` symlink to `bin/codex` so the runtime can be located. - Seal runtime receipts with post-signing hashes, require matching release versions and source builds, and bundle dependency notices, licenses, and source metadata. - Keep voice resources out of Python wheels to preserve their older macOS compatibility; the native voice build targets macOS 14. ## Testing Add packaging tests for alpha, beta, and stable versions, signed-byte preservation, license hashes, receipt validation, tamper detection, and exclusion of unlisted files. Extend release verification to check voice architectures, signatures, build identity, package hashes, and DMG contents. GitOrigin-RevId: 9f9415a8b2532d655a9a8740bcdf64066ddb7472
1.0 KiB
Native voice libraries in Codex releases
The macOS Codex release package includes dynamically linked GStreamer and GLib
libraries and selected plugins, plus their native library dependencies. These
components have their own copyrights and licenses. Their notices accompany
this file in licenses/: LGPL-2.1.txt for GStreamer and GLib,
proxy-libintl.txt for libintl, libffi.txt, PCRE2.md and sljit.txt
for PCRE2, Opus.txt, and zlib.txt. GVDB is included with GLib under LGPL.
The exact upstream versions, source archive URLs and SHA-256 digests are in
sources.json alongside this notice. The corresponding build, runtime
projection and package scripts are in the public Codex source tree under
third_party/voice/. The source commit for this package is recorded in
manifest.json. The native libraries remain separate dynamic libraries in
lib/ and plugins/; replacing them requires compatible binaries and valid
macOS code signatures. Build tools listed in sources.json are build inputs,
not bundled runtime libraries.