mirror of
https://github.com/openai/codex.git
synced 2026-11-02 19:43:24 +00:00
malsamiri-oai
f363ed70cc
## Why Intel macOS release binaries crash on the first Code Mode tool call while V8 creates its code range. The x86_64 V8 allocator later makes a non-`MAP_JIT` reservation executable, which Hardened Runtime rejects when the signature contains only `com.apple.security.cs.allow-jit`. Tracks [SE-8006](https://linear.app/openai/issue/SE-8006/intel-macos-codex-cli-crashes-in-v8-startup-on-gpt-56-sol-tool-calls). Fixes #28390. ## What - add an expanded entitlement profile only for x86_64 `codex` and `codex-app-server`, the release binaries that link V8 - keep arm64 and `codex-responses-api-proxy` on the existing narrower profile - share one fail-closed target/binary selector between signing and final verification - verify the expected Mach-O architecture and exact entitlement dictionary for the signed binary, tar.gz, zstd, package, and DMG copies ## Verification - `just test-github-scripts` (34 tests) - `UV_CACHE_DIR=/private/tmp/codex-uv-cache just fmt-check` - `bash -n .github/scripts/macos-signing/select_codex_entitlements.sh` - `plutil -lint` on both entitlement profiles - parsed `rust-release.yml` as YAML - `git diff --check` - ad-hoc Hardened Runtime signing smoke on an x86_64 Mach-O slice: strict `codesign` verification passed; the Codex profile contained exactly both keys and the proxy profile retained exactly `allow-jit` ## Release validation Run a native Intel smoke of the final Developer ID-signed x86_64 Codex binary through V8 isolate creation before shipping. PR #30849 is diagnostic scaffolding, but its non-sandbox release job currently fails in the harness before V8 starts, so it is not counted as coverage here.
38 lines
1.1 KiB
Python
38 lines
1.1 KiB
Python
import plistlib
|
|
import unittest
|
|
from pathlib import Path
|
|
|
|
|
|
ROOT = Path(__file__).resolve().parents[2]
|
|
SIGNING_DIR = ROOT / ".github" / "scripts" / "macos-signing"
|
|
ALLOW_JIT = "com.apple.security.cs.allow-jit"
|
|
ALLOW_UNSIGNED_EXECUTABLE_MEMORY = (
|
|
"com.apple.security.cs.allow-unsigned-executable-memory"
|
|
)
|
|
|
|
|
|
class MacosSigningEntitlementsTest(unittest.TestCase):
|
|
def load(self, binary: str) -> dict[str, bool]:
|
|
path = SIGNING_DIR / f"{binary}.entitlements.plist"
|
|
with path.open("rb") as file:
|
|
return plistlib.load(file)
|
|
|
|
def test_v8_binaries_allow_unsigned_executable_memory(self) -> None:
|
|
expected = {
|
|
ALLOW_JIT: True,
|
|
ALLOW_UNSIGNED_EXECUTABLE_MEMORY: True,
|
|
}
|
|
for binary in ["codex", "codex-app-server", "codex-code-mode-host"]:
|
|
with self.subTest(binary=binary):
|
|
self.assertEqual(self.load(binary), expected)
|
|
|
|
def test_responses_proxy_keeps_existing_entitlements(self) -> None:
|
|
self.assertEqual(
|
|
self.load("codex-responses-api-proxy"),
|
|
{ALLOW_JIT: True},
|
|
)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|