mirror of
https://github.com/openai/codex.git
synced 2026-10-21 17:48:44 +00:00
jif
5fe32c0001
## Why Replacing rollout files can lose Unix ownership or macOS ACLs, changing who can read or append to a transcript. An ACL can also permit appending while denying explicit timestamp updates. ## What changed - Preserve Unix ownership, permissions, modification times, and macOS ACLs before publishing compressed or restored rollouts, and verify the replacement can be reopened. - Abort replacement on metadata failures, reject macOS delete-deny ACLs to keep temporary files removable, and detect Unix access metadata changes through `ctime` checks. - Use managed restoration temporary files whose names avoid stale `*.tmp` cleanup. - Allow appending when refreshing the rollout's modification time returns `PermissionDenied`. ## Testing Add regression coverage for macOS ACL preservation, inherited ACL removal, deletion-protected rollouts, append access despite denied timestamp changes, Unix group preservation, and restoration temporary files surviving stale-file cleanup. GitOrigin-RevId: 23f3de6e35c0b2e19f3491170e320159ea3bdb6f
60 lines
1.4 KiB
TOML
60 lines
1.4 KiB
TOML
[package]
|
|
edition.workspace = true
|
|
license.workspace = true
|
|
name = "codex-rollout"
|
|
version.workspace = true
|
|
|
|
[lib]
|
|
doctest = false
|
|
name = "codex_rollout"
|
|
path = "src/lib.rs"
|
|
|
|
[lints]
|
|
workspace = true
|
|
|
|
[dependencies]
|
|
codex-utils-process = { workspace = true }
|
|
anyhow = { workspace = true }
|
|
chrono = { workspace = true, features = ["serde"] }
|
|
codex-extension-items = { workspace = true }
|
|
codex-file-search = { workspace = true }
|
|
codex-git-utils = { workspace = true }
|
|
codex-history = { workspace = true }
|
|
codex-otel = { workspace = true }
|
|
codex-protocol = { workspace = true }
|
|
codex-state = { workspace = true }
|
|
codex-utils-absolute-path = { workspace = true }
|
|
codex-utils-output-truncation = { workspace = true }
|
|
codex-utils-path = { workspace = true }
|
|
codex-utils-string = { workspace = true }
|
|
memchr = { workspace = true }
|
|
regex = { workspace = true }
|
|
serde = { workspace = true, features = ["derive"] }
|
|
serde_json = { workspace = true }
|
|
tempfile = { workspace = true }
|
|
time = { workspace = true, features = [
|
|
"formatting",
|
|
"local-offset",
|
|
"macros",
|
|
"parsing",
|
|
] }
|
|
tokio = { workspace = true, features = [
|
|
"fs",
|
|
"io-util",
|
|
"macros",
|
|
"process",
|
|
"rt",
|
|
"sync",
|
|
"time",
|
|
] }
|
|
tracing = { workspace = true }
|
|
uuid = { workspace = true }
|
|
zstd = { workspace = true }
|
|
|
|
[target.'cfg(unix)'.dependencies]
|
|
libc = { workspace = true }
|
|
|
|
[dev-dependencies]
|
|
codex-utils-absolute-path = { workspace = true }
|
|
pretty_assertions = { workspace = true }
|