mirror of
https://github.com/openai/codex.git
synced 2026-08-23 13:09:46 +00:00
0c07c7ee47
## Why Keep the App Store Connect private key in Azure Key Vault instead of exporting it to release runners as a base64-encoded `.p8` secret. ## What changed - Add a notarization client that creates notary-scoped Apple JWTs with a pinned Azure Key Vault key, submits and streams artifacts to Apple's notarization service, polls for completion, and saves developer diagnostics. - Update the binary and DMG release wrappers to use the new client while continuing to staple accepted DMGs with `rcodesign`. - Configure release jobs with the notarization vault key name and version instead of private-key material. ## Testing - Add unit coverage for key validation, JWT signing, uploads, polling, diagnostic logs, and the binary and DMG wrapper contracts. GitOrigin-RevId: 8f526c5691d774964fd33f847f8420cac0840b05