codex

mirror of https://github.com/openai/codex.git synced 2026-09-07 15:40:00 +00:00

Files

Charlie Marsh c0b6285711 Pin V8 release manifests and prevent published release replacement (#43444 )

## Why

Artifact checksums alone do not authenticate the downloaded checksum manifest. V8 downloads need a trusted digest recorded in the repository, and published releases should not have their assets overwritten.

## What changed

- Pin the V8 `150.4.0` release manifest digests and verify manifests before downloading archives or bindings in packaging and `setup-rusty-v8`, preserving CRLF support.
- Refuse to replace published V8 releases, remove unfinished drafts on retry, and use `gh release create` to upload assets before publication.
- Install Windows `sccache` through a pinned `taiki-e/install-action` in the release and canary workflows.
- Document independent manifest verification and digest recording for version updates.

## Testing

Add five packaging tests covering successful downloads, CRLF manifests, tampered manifests, missing pins, and missing pin files. Rejection tests verify that artifacts are not downloaded.

GitOrigin-RevId: 5c771cdcff376388e124faa4826bf81135d84b50

2026-09-07 11:55:57 +00:00

codex_package

Pin V8 release manifests and prevent published release replacement (#43444 )

2026-09-07 11:55:57 +00:00

install

Prefer releases.openai.com in standalone installers (#34910 )

2026-07-23 09:21:31 +00:00

mcp_conformance

Add CIMD support to MCP OAuth registration (#38089 )

2026-08-12 00:01:01 +00:00

asciicheck.py

Enforce ASCII in README.md (#513 )