mirror of
https://github.com/openai/codex.git
synced 2026-09-11 20:36:49 +00:00
c0b6285711
## Why Artifact checksums alone do not authenticate the downloaded checksum manifest. V8 downloads need a trusted digest recorded in the repository, and published releases should not have their assets overwritten. ## What changed - Pin the V8 `150.4.0` release manifest digests and verify manifests before downloading archives or bindings in packaging and `setup-rusty-v8`, preserving CRLF support. - Refuse to replace published V8 releases, remove unfinished drafts on retry, and use `gh release create` to upload assets before publication. - Install Windows `sccache` through a pinned `taiki-e/install-action` in the release and canary workflows. - Document independent manifest verification and digest recording for version updates. ## Testing Add five packaging tests covering successful downloads, CRLF manifests, tampered manifests, missing pins, and missing pin files. Rejection tests verify that artifacts are not downloaded. GitOrigin-RevId: 5c771cdcff376388e124faa4826bf81135d84b50
65 lines
2.8 KiB
YAML
65 lines
2.8 KiB
YAML
name: setup-rusty-v8
|
|
description: Download and verify Codex-built rusty_v8 artifacts for Cargo builds.
|
|
inputs:
|
|
target:
|
|
description: Rust target triple with Codex-built V8 release artifacts.
|
|
required: true
|
|
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
- name: Configure rusty_v8 artifact overrides and verify checksums
|
|
shell: bash
|
|
env:
|
|
TARGET: ${{ inputs.target }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
version="$(python3 "${GITHUB_WORKSPACE}/.github/scripts/rusty_v8_bazel.py" resolved-v8-crate-version)"
|
|
release_tag="rusty-v8-v${version}"
|
|
base_url="https://github.com/openai/codex/releases/download/${release_tag}"
|
|
binding_dir="${RUNNER_TEMP}/rusty_v8"
|
|
|
|
profile="ptrcomp_sandbox_release"
|
|
|
|
if [[ "$TARGET" == *-pc-windows-msvc ]]; then
|
|
archive_name="rusty_v8_${profile}_${TARGET}.lib.gz"
|
|
else
|
|
archive_name="librusty_v8_${profile}_${TARGET}.a.gz"
|
|
fi
|
|
binding_name="src_binding_${profile}_${TARGET}.rs"
|
|
checksums_name="rusty_v8_${profile}_${TARGET}.sha256"
|
|
|
|
archive_path="${binding_dir}/${archive_name}"
|
|
binding_path="${binding_dir}/${binding_name}"
|
|
checksums_path="${binding_dir}/${checksums_name}"
|
|
trusted_checksums="${GITHUB_WORKSPACE}/third_party/v8/rusty_v8_${version//./_}_release_manifests.sha256"
|
|
|
|
if command -v sha256sum >/dev/null 2>&1; then
|
|
checksum_command=(sha256sum --check -)
|
|
else
|
|
checksum_command=(shasum -a 256 --check -)
|
|
fi
|
|
|
|
mkdir -p "${binding_dir}"
|
|
curl -fsSL "${base_url}/${checksums_name}" -o "${checksums_path}"
|
|
# Check the original manifest bytes even when either checksum file uses CRLF.
|
|
expected_manifest_checksum="$(grep -F " ${checksums_name}" "${trusted_checksums}" | cut -d ' ' -f 1)"
|
|
actual_manifest_checksum="$(python3 -c 'import hashlib, pathlib, sys; print(hashlib.sha256(pathlib.Path(sys.argv[1]).read_bytes()).hexdigest())' "${checksums_path}")"
|
|
if [[ "${actual_manifest_checksum}" != "${expected_manifest_checksum}" ]]; then
|
|
echo "Checksum mismatch for ${checksums_name}: expected ${expected_manifest_checksum}, got ${actual_manifest_checksum}" >&2
|
|
exit 1
|
|
fi
|
|
curl -fsSL "${base_url}/${archive_name}" -o "${archive_path}"
|
|
curl -fsSL "${base_url}/${binding_name}" -o "${binding_path}"
|
|
|
|
if [[ "$(wc -l < "${checksums_path}")" -ne 2 ]]; then
|
|
echo "Expected exactly two checksums for ${TARGET} in ${checksums_path}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Existing Windows-built release manifests use CRLF line endings.
|
|
(cd "${binding_dir}" && tr -d '\r' < "${checksums_path}" | "${checksum_command[@]}")
|
|
echo "RUSTY_V8_ARCHIVE=${archive_path}" >> "${GITHUB_ENV}"
|
|
echo "RUSTY_V8_SRC_BINDING_PATH=${binding_path}" >> "${GITHUB_ENV}"
|