mirror of
https://github.com/openai/codex.git
synced 2026-08-23 13:09:46 +00:00
636e505c5c
## Why Bazel builds did not embed the SHA-256 digest used to verify the bundled `bwrap` binary at launch. ## What changed - Strip the Bazel-built `bwrap`, generate its SHA-256 digest, and pass that digest to `codex-linux-sandbox` through a compiler environment file. - Report digest verification failures with exit code `8` instead of panicking. - Add a Bazel integration test that accepts the original bundled binary and rejects a tampered copy. GitOrigin-RevId: 224eeb6ae3d1bfb100e048b296f75fd8ba109581
54 lines
1.6 KiB
Python
54 lines
1.6 KiB
Python
load("@rules_cc//cc:defs.bzl", "cc_library")
|
|
load("//:defs.bzl", "codex_rust_crate")
|
|
|
|
codex_rust_crate(
|
|
name = "bwrap",
|
|
# Bazel wires vendored bubblewrap + libcap via :bwrap-ffi below and sets
|
|
# bwrap_available explicitly, so we skip Cargo's build.rs in Bazel builds.
|
|
build_script_enabled = False,
|
|
crate_name = "codex_bwrap",
|
|
deps_extra = select({
|
|
"@platforms//os:linux": [":bwrap-ffi"],
|
|
"//conditions:default": [],
|
|
}),
|
|
rustc_flags_extra = select({
|
|
"@platforms//os:linux": [
|
|
"--cfg=bwrap_available",
|
|
# TODO(anp) Extract bwrap symbols before stripping.
|
|
"-Cstrip=symbols",
|
|
],
|
|
"//conditions:default": [],
|
|
}),
|
|
)
|
|
|
|
genrule(
|
|
name = "bwrap-sha256-env",
|
|
srcs = [":bwrap"],
|
|
outs = ["bwrap.sha256.env"],
|
|
cmd = " && ".join([
|
|
'$(execpath @bazel_tools//tools/build_defs/hash:sha256) $(execpath :bwrap) "$@"',
|
|
'digest=$$(<"$@")',
|
|
'printf "CODEX_BWRAP_SHA256=%s\\n" "$$digest" > "$@"',
|
|
]),
|
|
target_compatible_with = ["@platforms//os:linux"],
|
|
tools = ["@bazel_tools//tools/build_defs/hash:sha256"],
|
|
visibility = ["//codex-rs/linux-sandbox:__pkg__"],
|
|
)
|
|
|
|
cc_library(
|
|
name = "bwrap-ffi",
|
|
srcs = ["//codex-rs/vendor:bubblewrap_c_sources"],
|
|
hdrs = [
|
|
"config.h",
|
|
"//codex-rs/vendor:bubblewrap_headers",
|
|
],
|
|
copts = [
|
|
"-D_GNU_SOURCE",
|
|
"-Dmain=bwrap_main",
|
|
],
|
|
includes = ["."],
|
|
target_compatible_with = ["@platforms//os:linux"],
|
|
visibility = ["//visibility:private"],
|
|
deps = ["@libcap"],
|
|
)
|