mirror of
https://github.com/openai/codex.git
synced 2026-08-23 13:09:46 +00:00
dc23c7bcc8
# Summary GitHub's latest-release endpoint can return compact, single-line JSON. The standalone installer treated release metadata as line-oriented text, so those responses could make asset lookup fail even though the requested assets were present. The regression was introduced by [#31056](https://github.com/openai/codex/pull/31056). That change reused the `/releases/latest` metadata response for both version resolution and asset lookup, exposing the existing formatting-sensitive asset parser to compact responses from that endpoint. This change parses the release metadata once with a one-pass POSIX awk scanner. The scanner tracks JSON strings and nesting, extracts the root release tag plus direct asset name/digest pairs, and produces the same result regardless of whitespace or object field order. It uses POSIX `fold` to bound awk record sizes so compact responses stay fast across awk implementations. Fixes #31520. ## Changes - replace line-oriented release metadata matching with structure-aware parsing - reuse the parsed metadata for latest-version and asset-digest lookup - add regression coverage for compact JSON, reordered fields, nested decoys, and JSON-looking release text ## Design decisions - Keep the installer dependency-free by using standard POSIX tools already required by the shell installer. - Parse only the GitHub release fields the installer consumes, in one pass, instead of vendoring a general JSON library. - Preserve asset-object boundaries so nested or string-encoded `name` and `digest` fields cannot be mistaken for release assets. ## Testing - Tests: focused installer suite locally and on Linux. - Smoke tests: real pretty and compact GitHub release metadata, latest-release resolution, and checksum-asset selection. - Portability: macOS awk plus Linux gawk, mawk, and nawk. - Stress coverage: randomized formatting and field order, adversarial nested/string content, and a synthetic 2,000-asset compact response.