codex

mirror of https://github.com/openai/codex.git synced 2026-09-20 12:47:38 +00:00

Files

riley-oai c0e1b78253 Preserve the provisioned macOS CLI's code-signing identity (#46495 )

## Why

Existing login-keychain access rules identify the CLI as `codex`. Packaging it in an app bundle must preserve that code-signing identifier independently of the bundle identifier and provisioned App ID.

## What changed

- Sign the provisioned CLI with the identifier `codex`, retaining `com.openai.codex.cli` as its bundle identifier.
- Require the expected signing identifier and team during signature verification, and reject unexpected bundle identifiers, executable names, or package types.
- Document the identity distinction and keychain compatibility limits.

## Testing

Extend signing-driver tests to check the signing identifier, verification requirement, bundle metadata, and provisioned entitlements, and to reject altered bundle identity fields. These tests use generated credentials and stubbed native tools; they do not verify runtime keychain access or credential recovery.

GitOrigin-RevId: ab00072e48189551adb0e70008210fee6d36241d

2026-09-18 22:53:21 +00:00

actions

Run DotSlash publishing directly on Ubuntu runners (#45035 )

2026-09-12 13:07:13 +00:00

codex

Fix minor typos in comments and documentation (#10287 )

2026-01-30 22:11:02 -08:00

ISSUE_TEMPLATE

feat(cli): add codex doctor diagnostics (#22336 )

2026-05-13 21:23:19 +00:00

scripts

Preserve the provisioned macOS CLI's code-signing identity (#46495 )