mirror of
https://github.com/openai/codex.git
synced 2026-08-23 13:09:46 +00:00
636e505c5c
## Why Bazel builds did not embed the SHA-256 digest used to verify the bundled `bwrap` binary at launch. ## What changed - Strip the Bazel-built `bwrap`, generate its SHA-256 digest, and pass that digest to `codex-linux-sandbox` through a compiler environment file. - Report digest verification failures with exit code `8` instead of panicking. - Add a Bazel integration test that accepts the original bundled binary and rejects a tampered copy. GitOrigin-RevId: 224eeb6ae3d1bfb100e048b296f75fd8ba109581
14 lines
339 B
Python
14 lines
339 B
Python
load("//:defs.bzl", "codex_rust_crate")
|
|
|
|
codex_rust_crate(
|
|
name = "linux-sandbox",
|
|
crate_name = "codex_linux_sandbox",
|
|
extra_binaries = [
|
|
"//codex-rs/bwrap:bwrap",
|
|
],
|
|
rustc_env_files = select({
|
|
"@platforms//os:linux": ["//codex-rs/bwrap:bwrap-sha256-env"],
|
|
"//conditions:default": [],
|
|
}),
|
|
)
|