Benjamin Carlsson
ce7fbb373b
## Why Windows release packages need the voice helper and native audio libraries. Realtime TLS connections on fresh Windows installations also need platform certificate validation so Windows can retrieve missing trusted roots on demand. ## What changed - Build and sign the voice helper and audio DLLs for Windows x64 and ARM64, bundle a pinned Microsoft CRT DLL, and verify signatures and runtime receipts before packaging. - Add verified, pinned Cygwin and native build tools plus MSVC linker, compiler, and path handling fixes for the Windows Bazel builds. - Include voice resources in primary release archives and WinGet packages. Preserve WinGet executable names, update manifest hashes, and recognize the package root through matching entrypoint metadata. Keep Python runtime wheels voice-free to preserve their existing Windows support floor. - Use Windows platform TLS validation for realtime WebSockets when no custom CA bundle is configured, preserving custom CA behavior. ## Testing Add coverage for build-input integrity and unsafe paths, signed Windows runtime assembly, WinGet file and hash preservation, package discovery, and TLS trust selection, untrusted certificate rejection, and hostname validation. GitOrigin-RevId: 423da35872fa5549d69fd4ca97d922bb49599386
1.7 KiB
Native voice libraries in Codex releases
Codex release packages with voice include dynamically linked GStreamer and GLib
libraries and selected plugins, plus their native library dependencies. These
components have their own copyrights and licenses. Their notices accompany
this file in licenses/: LGPL-2.1.txt for GStreamer and GLib,
proxy-libintl.txt for libintl, libffi.txt, PCRE2.md and sljit.txt
for PCRE2, Opus.txt, and zlib.txt. GVDB is included with GLib under LGPL.
The exact upstream versions, source archive URLs and SHA-256 digests are in
sources.json alongside this notice. The corresponding build, runtime
projection and package scripts are in the public Codex source tree under
third_party/voice/. The source commit for this package is recorded in
manifest.json. The native libraries remain separate dynamic libraries in
platform-specific runtime directories. Replacements must be compatible with
the package and, on macOS, have valid code signatures. Build tools listed in
sources.json are build inputs, not bundled runtime libraries.
Windows packages also contain an unmodified Microsoft Visual C++ runtime DLL,
copyright Microsoft Corporation, under Microsoft's applicable software license
terms, separately from the open-source audio libraries. windows-crt.json
records its version, official download, hashes, and redistribution references.
The Apache and LGPL licenses for other components do not license this DLL.
Microsoft's runtime terms and separate developer redistribution terms apply
to the Microsoft component; the runtime terms alone do not grant redistribution.
Only retail redistributable files are included; Microsoft signatures are retained.
App-local runtime security updates must be delivered with Codex updates.