mirror of
https://github.com/openai/codex.git
synced 2026-09-11 20:36:49 +00:00
85c2d4d921
## What changed - Build the voice host and native runtime with Bazel's `-c opt` configuration. - Resolve runtime paths before validating their contents in the release workflow. - Make `runtime.json` owner-writable before sealing the post-signing release receipt. - Use `scripts` in `PYTHONPATH` so archive creation can import `codex_package.archive`. GitOrigin-RevId: 02f960573a4151f52cde486e17e1d45b73435306
58 lines
2.2 KiB
Python
58 lines
2.2 KiB
Python
"""Stage verified macOS voice libraries and seal their post-signing release receipt."""
|
|
|
|
import argparse
|
|
import json
|
|
from pathlib import Path
|
|
import shutil
|
|
|
|
from package_runtime import runtime_files
|
|
from runtime import digest
|
|
|
|
|
|
def stage(source: Path, destination: Path, target: str) -> None:
|
|
if target not in {"aarch64-apple-darwin", "x86_64-apple-darwin"}:
|
|
raise ValueError("public voice runtime requires a macOS target")
|
|
source = source.resolve(strict=True)
|
|
files = runtime_files(source, target)
|
|
destination.mkdir()
|
|
try:
|
|
for relative, expected in files.items():
|
|
copied = destination / relative
|
|
copied.parent.mkdir(parents=True, exist_ok=True)
|
|
shutil.copy2(source / relative, copied)
|
|
if digest(copied) != expected:
|
|
raise ValueError("runtime changed while staging release inputs")
|
|
except BaseException:
|
|
shutil.rmtree(destination)
|
|
raise
|
|
|
|
|
|
def seal(root: Path, target: str) -> None:
|
|
root = root.resolve(strict=True)
|
|
manifest_path = root / "runtime.json"
|
|
manifest = json.loads(manifest_path.read_text(encoding="utf-8"))
|
|
if manifest.get("developmentOnly") is not True or manifest.get("target") != target:
|
|
raise ValueError("expected an unsealed development receipt for this target")
|
|
for record in manifest["libraries"]:
|
|
record["sha256"] = digest(root / record["path"])
|
|
manifest["developmentOnly"] = False
|
|
manifest["distribution"] = "publicRelease"
|
|
manifest_path.chmod(manifest_path.stat().st_mode | 0o200)
|
|
manifest_path.write_text(json.dumps(manifest, indent=2) + "\n", encoding="utf-8")
|
|
runtime_files(root, target, public_release=True)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
parser = argparse.ArgumentParser(description=__doc__)
|
|
parser.add_argument("operation", choices=("stage", "seal"))
|
|
parser.add_argument("--target", required=True)
|
|
parser.add_argument("--source", type=Path)
|
|
parser.add_argument("--output", type=Path, required=True)
|
|
args = parser.parse_args()
|
|
if args.operation == "stage":
|
|
if args.source is None:
|
|
parser.error("stage requires --source")
|
|
stage(args.source, args.output, args.target)
|
|
else:
|
|
seal(args.output, args.target)
|