mirror of
https://github.com/openai/codex.git
synced 2026-11-12 21:20:34 +00:00
## What changed - Add a `sign-only` operation to sign macOS CLI packages without notarization. - Validate the configured signing certificate before signing both standard and provisioned packages. - Require the configured team ID for every executable during verification and extend leaf certificate fingerprint checks to standard packages. ## Testing Add coverage for signing a standard package without notarization and rejecting unexpected signing certificates in both standard and provisioned packages. GitOrigin-RevId: 0794c7666abfe981b59b47311e3a9108223b8f57