mirror of
https://github.com/openai/codex.git
synced 2026-08-23 13:09:46 +00:00
afb1b3c984
## Why Release jobs download the `codex-zsh` manifest before packaging or signing its bundled binaries. Verify that download against a pinned digest so an unexpected manifest cannot enter release artifacts. ## What changed - Pin the SHA-256 digest for the `codex-zsh-v0.1.0` manifest. - Add a portable verification script that uses `sha256sum` or macOS `shasum`. - Run verification in both the package archive and macOS helper signing flows. GitOrigin-RevId: a404bb897c8cc0bf3c0ff38e8a6e1cce059d7fab
13 lines
350 B
Bash
13 lines
350 B
Bash
#!/usr/bin/env bash
|
|
|
|
set -euo pipefail
|
|
|
|
manifest="${1:?missing zsh manifest path}"
|
|
expected_sha256="${2:?missing expected zsh manifest SHA-256}"
|
|
|
|
if command -v sha256sum >/dev/null 2>&1; then
|
|
printf '%s %s\n' "$expected_sha256" "$manifest" | sha256sum --check -
|
|
else
|
|
printf '%s %s\n' "$expected_sha256" "$manifest" | shasum -a 256 --check -
|
|
fi
|