Pin Codex 0.165.0 and read its archive layout from a reviewed listing file
This commit is contained in:
Gabriel Brown committed
1 parent
0add5af1b9
commit
44d32d78ae
5 files changed
+125
-64
No files matched your search
@@ -40,7 +40,7 @@ The key sources above are supported by these publisher-controlled records:
|
||||
- `https://github.com/oven-sh/bun/blob/main/dockerhub/distroless/Dockerfile`
|
||||
- `https://github.com/nodejs/node/releases/tag/v24.20.0`
|
||||
- `https://github.com/nodejs/node/blob/main/README.md`
|
||||
- `https://github.com/openai/codex/releases/tag/rust-v0.150.1`
|
||||
- `https://github.com/openai/codex/releases/tag/rust-v0.165.0`
|
||||
- `https://github.com/openai/codex/blob/main/.github/workflows/rust-release.yml`
|
||||
- `https://github.com/rustdesk/rustdesk/releases/tag/1.4.9`
|
||||
|
||||
@@ -50,8 +50,8 @@ The reviewed immutable artifact and repository URLs are:
|
||||
- `https://github.com/oven-sh/bun/releases/download/bun-v1.4.0/bun-linux-aarch64.zip`
|
||||
- `https://nodejs.org/dist/v24.20.0/node-v24.20.0-linux-x64.tar.xz`
|
||||
- `https://nodejs.org/dist/v24.20.0/node-v24.20.0-linux-arm64.tar.xz`
|
||||
- `https://github.com/openai/codex/releases/download/rust-v0.150.1/codex-package-x86_64-unknown-linux-musl.tar.gz`
|
||||
- `https://github.com/openai/codex/releases/download/rust-v0.150.1/codex-package-aarch64-unknown-linux-musl.tar.gz`
|
||||
- `https://github.com/openai/codex/releases/download/rust-v0.165.0/codex-package-x86_64-unknown-linux-musl.tar.gz`
|
||||
- `https://github.com/openai/codex/releases/download/rust-v0.165.0/codex-package-aarch64-unknown-linux-musl.tar.gz`
|
||||
- `https://github.com/rustdesk/rustdesk/releases/download/1.4.9/rustdesk-1.4.9-0.x86_64.rpm`
|
||||
- `https://mirrors.rpmfusion.org/free/fedora/rpmfusion-free-release-44.noarch.rpm`
|
||||
- `https://mirrors.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-44.noarch.rpm`
|
||||
@@ -72,6 +72,15 @@ record both the reviewed archive digest and this reviewed installed-byte digest
|
||||
in `.panama-provenance`; later runs require the receipt and re-hash the installed
|
||||
binary before treating an existing directory as trusted.
|
||||
|
||||
Codex was re-reviewed on 2026-10-29 for 0.165.0. Each archive's `sha256sum`
|
||||
matched the `digest` GitHub publishes for that release asset. The installer
|
||||
accepts a Codex archive only when `tar -tzf` prints exactly the entries in
|
||||
`codex-package.listing`. Both architectures share that listing. 0.165.0 dropped
|
||||
the bundled `codex-resources/zsh/` and added `codex-resources/voice/`, and the
|
||||
archives grew past 128 MiB, so `CODEX_*_MAX_BYTES` is 256 MiB. To bump Codex,
|
||||
update `installers.conf`, regenerate the listing with `tar -tzf ARTIFACT`, and
|
||||
run `tests/setup/package-provenance-contract`.
|
||||
|
||||
## Panama bootstrap
|
||||
|
||||
The public desktop and server commands use the same committed `boot` blob:
|
||||
|
||||
@@ -0,0 +1,51 @@
|
||||
bin/
|
||||
bin/codex
|
||||
bin/codex-code-mode-host
|
||||
codex-package.json
|
||||
codex-path/
|
||||
codex-path/rg
|
||||
codex-resources/
|
||||
codex-resources/bwrap
|
||||
codex-resources/voice/
|
||||
codex-resources/voice/NOTICE.md
|
||||
codex-resources/voice/bin/
|
||||
codex-resources/voice/bin/codex-voice-host
|
||||
codex-resources/voice/lib/
|
||||
codex-resources/voice/lib/gstreamer-1.0/
|
||||
codex-resources/voice/lib/gstreamer-1.0/libgstapp.so
|
||||
codex-resources/voice/lib/gstreamer-1.0/libgstaudioconvert.so
|
||||
codex-resources/voice/lib/gstreamer-1.0/libgstaudioresample.so
|
||||
codex-resources/voice/lib/gstreamer-1.0/libgstcoreelements.so
|
||||
codex-resources/voice/lib/gstreamer-1.0/libgstopus.so
|
||||
codex-resources/voice/lib/gstreamer-1.0/libgstrtp.so
|
||||
codex-resources/voice/lib/gstreamer-1.0/libgstrtpmanager.so
|
||||
codex-resources/voice/lib/libffi.so.8
|
||||
codex-resources/voice/lib/libgio-2.0.so.0
|
||||
codex-resources/voice/lib/libglib-2.0.so.0
|
||||
codex-resources/voice/lib/libgmodule-2.0.so.0
|
||||
codex-resources/voice/lib/libgobject-2.0.so.0
|
||||
codex-resources/voice/lib/libgstallocators-1.0.so.0
|
||||
codex-resources/voice/lib/libgstapp-1.0.so.0
|
||||
codex-resources/voice/lib/libgstaudio-1.0.so.0
|
||||
codex-resources/voice/lib/libgstbase-1.0.so.0
|
||||
codex-resources/voice/lib/libgstnet-1.0.so.0
|
||||
codex-resources/voice/lib/libgstpbutils-1.0.so.0
|
||||
codex-resources/voice/lib/libgstreamer-1.0.so.0
|
||||
codex-resources/voice/lib/libgstrtp-1.0.so.0
|
||||
codex-resources/voice/lib/libgsttag-1.0.so.0
|
||||
codex-resources/voice/lib/libgstvideo-1.0.so.0
|
||||
codex-resources/voice/lib/libintl.so.8
|
||||
codex-resources/voice/lib/libopus.so.0
|
||||
codex-resources/voice/lib/libpcre2-8.so.0
|
||||
codex-resources/voice/lib/libz.so.1
|
||||
codex-resources/voice/licenses/
|
||||
codex-resources/voice/licenses/LGPL-2.1.txt
|
||||
codex-resources/voice/licenses/Opus.txt
|
||||
codex-resources/voice/licenses/PCRE2.md
|
||||
codex-resources/voice/licenses/libffi.txt
|
||||
codex-resources/voice/licenses/proxy-libintl.txt
|
||||
codex-resources/voice/licenses/sljit.txt
|
||||
codex-resources/voice/licenses/zlib.txt
|
||||
codex-resources/voice/manifest.json
|
||||
codex-resources/voice/runtime.json
|
||||
codex-resources/voice/sources.json
|
||||
@@ -16,15 +16,15 @@ NODE_AARCH64_URL=https://nodejs.org/dist/v24.20.0/node-v24.20.0-linux-arm64.tar.
|
||||
NODE_AARCH64_SHA256=5f4ddab610c1ab2016b3c227cebdbf6d9495161487e4739c7b90090595f465f7
|
||||
NODE_AARCH64_BINARY_SHA256=23a5637c2470fde09fcc1acc77c1b92e04e3d7e3e6e80ff7df6f5831958d1477
|
||||
NODE_AARCH64_MAX_BYTES=67108864
|
||||
CODEX_VERSION=0.150.1
|
||||
CODEX_X86_64_URL=https://github.com/openai/codex/releases/download/rust-v0.150.1/codex-package-x86_64-unknown-linux-musl.tar.gz
|
||||
CODEX_X86_64_SHA256=00aba704f029f6dc0d948be407a756e0c97cc840132fd691353b2c6b0a505b17
|
||||
CODEX_X86_64_BINARY_SHA256=abf1bb1643a79f73aa78ee627e111e02d4f8c98f25813a0cf6ce277709664386
|
||||
CODEX_X86_64_MAX_BYTES=134217728
|
||||
CODEX_AARCH64_URL=https://github.com/openai/codex/releases/download/rust-v0.150.1/codex-package-aarch64-unknown-linux-musl.tar.gz
|
||||
CODEX_AARCH64_SHA256=1ecac3f87823efb98153233b076ea3d6e34a7a8cebe43c5285dc5f79e1514639
|
||||
CODEX_AARCH64_BINARY_SHA256=7a49aabe11fd95a1c968d79e16b5f1b17c3219002c5f7129d467f415f8460feb
|
||||
CODEX_AARCH64_MAX_BYTES=134217728
|
||||
CODEX_VERSION=0.165.0
|
||||
CODEX_X86_64_URL=https://github.com/openai/codex/releases/download/rust-v0.165.0/codex-package-x86_64-unknown-linux-musl.tar.gz
|
||||
CODEX_X86_64_SHA256=e97c4463d7f146692a955d7b0e1c8cf48f97cd4d616cd45c5dcab2e8d9743316
|
||||
CODEX_X86_64_BINARY_SHA256=c06a67fd8ac76508dc78bd99ce20c9f317b8d568beda59485f3f4134df9962d5
|
||||
CODEX_X86_64_MAX_BYTES=268435456
|
||||
CODEX_AARCH64_URL=https://github.com/openai/codex/releases/download/rust-v0.165.0/codex-package-aarch64-unknown-linux-musl.tar.gz
|
||||
CODEX_AARCH64_SHA256=c8b2844fdef57498572db960344aee8c836ce9f75c203379da0a9c3a334fc3b7
|
||||
CODEX_AARCH64_BINARY_SHA256=b32ece31af06440da980b733fb8fefdd1f193439595fda84096f1caaceec543f
|
||||
CODEX_AARCH64_MAX_BYTES=268435456
|
||||
RUSTDESK_VERSION=1.4.9
|
||||
RUSTDESK_X86_64_URL=https://github.com/rustdesk/rustdesk/releases/download/1.4.9/rustdesk-1.4.9-0.x86_64.rpm
|
||||
RUSTDESK_X86_64_SHA256=eb1b053ac5b2f774f2271f7fbbfd2ea475899f7a55135c5e172bc54b9388f108
|
||||
|
||||
@@ -452,7 +452,9 @@ _install_codex() (
|
||||
return 1
|
||||
fi
|
||||
listing="$(tar -tzf "$archive")" || { rm -rf -- "$stage"; return 1; }
|
||||
expected_listing=$'bin/\nbin/codex\nbin/codex-code-mode-host\ncodex-package.json\ncodex-path/\ncodex-path/rg\ncodex-resources/\ncodex-resources/bwrap\ncodex-resources/zsh/\ncodex-resources/zsh/bin/\ncodex-resources/zsh/bin/zsh'
|
||||
# The reviewed archive layout lives beside installers.conf and changes with it.
|
||||
expected_listing="$(<"$PANAMA_PATH/setup/provenance/codex-package.listing")" \
|
||||
|| { rm -rf -- "$stage"; return 1; }
|
||||
[[ "$listing" == "$expected_listing" ]] || { rm -rf -- "$stage"; return 1; }
|
||||
while IFS= read -r member; do
|
||||
_archive_path_is_safe "$member" || { rm -rf -- "$stage"; return 1; }
|
||||
|
||||
@@ -306,11 +306,11 @@ for reviewed_value in \
|
||||
'BUN_X86_64_BINARY_SHA256 33d56b070be6a9e3da0ab013038b43d1645d0534ca811ecdba4472599117eb4b' \
|
||||
'BUN_AARCH64_SHA256 4b1a332ee861983eb93bcfe6f770fff94e3e31b2c388bdaea3c8ed35e58eed0e' \
|
||||
'BUN_AARCH64_BINARY_SHA256 086c4121c8738a8e0f5ed730e8a461bc3973b4444e372ddb77aef9a747fa2ae9' \
|
||||
'CODEX_VERSION 0.150.1' \
|
||||
'CODEX_X86_64_SHA256 00aba704f029f6dc0d948be407a756e0c97cc840132fd691353b2c6b0a505b17' \
|
||||
'CODEX_X86_64_BINARY_SHA256 abf1bb1643a79f73aa78ee627e111e02d4f8c98f25813a0cf6ce277709664386' \
|
||||
'CODEX_AARCH64_SHA256 1ecac3f87823efb98153233b076ea3d6e34a7a8cebe43c5285dc5f79e1514639' \
|
||||
'CODEX_AARCH64_BINARY_SHA256 7a49aabe11fd95a1c968d79e16b5f1b17c3219002c5f7129d467f415f8460feb' \
|
||||
'CODEX_VERSION 0.165.0' \
|
||||
'CODEX_X86_64_SHA256 e97c4463d7f146692a955d7b0e1c8cf48f97cd4d616cd45c5dcab2e8d9743316' \
|
||||
'CODEX_X86_64_BINARY_SHA256 c06a67fd8ac76508dc78bd99ce20c9f317b8d568beda59485f3f4134df9962d5' \
|
||||
'CODEX_AARCH64_SHA256 c8b2844fdef57498572db960344aee8c836ce9f75c203379da0a9c3a334fc3b7' \
|
||||
'CODEX_AARCH64_BINARY_SHA256 b32ece31af06440da980b733fb8fefdd1f193439595fda84096f1caaceec543f' \
|
||||
'RUSTDESK_VERSION 1.4.9' \
|
||||
'RUSTDESK_X86_64_SHA256 eb1b053ac5b2f774f2271f7fbbfd2ea475899f7a55135c5e172bc54b9388f108'; do
|
||||
read -r name expected <<<"$reviewed_value"
|
||||
@@ -373,6 +373,7 @@ cp "$repo_dir/setup/lib/artifact-provenance" "$repo_dir/setup/lib/chatgpt-packag
|
||||
"$installer_fixture/setup/lib/"
|
||||
cp "$config" "$installer_fixture/setup/provenance/installers.conf"
|
||||
cp "$repo_dir"/setup/provenance/keys/*.asc "$installer_fixture/setup/provenance/keys/"
|
||||
cp "$repo_dir/setup/provenance/codex-package.listing" "$installer_fixture/setup/provenance/"
|
||||
sed '/^# --- The server path/,$d' "$repo_dir/setup/scripts/install-packages" \
|
||||
> "$installer_fixture/setup/scripts/install-packages"
|
||||
|
||||
@@ -401,26 +402,23 @@ for arch_spec in \
|
||||
"$bun_top/" "$bun_top/bun")
|
||||
rm -rf -- "$artifact_root/build/$bun_top"
|
||||
|
||||
mkdir -p "$artifact_root/build/bin" "$artifact_root/build/codex-path" \
|
||||
"$artifact_root/build/codex-resources/zsh/bin"
|
||||
printf '#!/usr/bin/env bash\n# fixture %s\nprintf "codex-cli 0.150.1\\n"\n' "$machine" \
|
||||
# Build the fixture from the reviewed listing so it always has the exact
|
||||
# layout the installer accepts.
|
||||
mapfile -t codex_entries < "$repo_dir/setup/provenance/codex-package.listing"
|
||||
for entry in "${codex_entries[@]}"; do
|
||||
if [[ "$entry" == */ ]]; then
|
||||
mkdir -p "$artifact_root/build/$entry"
|
||||
else
|
||||
printf '#!/usr/bin/env bash\nprintf "package resource\\n"\n' \
|
||||
> "$artifact_root/build/$entry"
|
||||
chmod +x "$artifact_root/build/$entry"
|
||||
fi
|
||||
done
|
||||
printf '#!/usr/bin/env bash\n# fixture %s\nprintf "codex-cli 0.165.0\\n"\n' "$machine" \
|
||||
> "$artifact_root/build/bin/codex"
|
||||
cp "$artifact_root/build/bin/codex" "$artifact_root/codex-$machine.bin"
|
||||
printf '#!/usr/bin/env bash\nprintf "code mode host\\n"\n' \
|
||||
> "$artifact_root/build/bin/codex-code-mode-host"
|
||||
printf '{"target":"%s"}\n' "$machine" > "$artifact_root/build/codex-package.json"
|
||||
for package_binary in codex-path/rg codex-resources/bwrap codex-resources/zsh/bin/zsh; do
|
||||
printf '#!/usr/bin/env bash\nprintf "package resource\\n"\n' \
|
||||
> "$artifact_root/build/$package_binary"
|
||||
done
|
||||
chmod +x "$artifact_root/build/bin/codex" \
|
||||
"$artifact_root/build/bin/codex-code-mode-host" \
|
||||
"$artifact_root/build/codex-path/rg" "$artifact_root/build/codex-resources/bwrap" \
|
||||
"$artifact_root/build/codex-resources/zsh/bin/zsh"
|
||||
tar -C "$artifact_root/build" --no-recursion -czf "$artifact_root/codex-$machine.tar.gz" \
|
||||
bin/ bin/codex bin/codex-code-mode-host codex-package.json \
|
||||
codex-path/ codex-path/rg codex-resources/ codex-resources/bwrap \
|
||||
codex-resources/zsh/ codex-resources/zsh/bin/ codex-resources/zsh/bin/zsh
|
||||
"${codex_entries[@]}"
|
||||
rm -rf -- "$artifact_root/build/bin" "$artifact_root/build/codex-path" \
|
||||
"$artifact_root/build/codex-resources"
|
||||
rm -f -- "$artifact_root/build/codex-package.json"
|
||||
@@ -448,7 +446,7 @@ for destination, directory_type, entry_type, content in (
|
||||
PY
|
||||
mkdir -p "$artifact_root/build/wrong-node/bin" "$artifact_root/build/wrong-codex"
|
||||
printf '#!/usr/bin/env bash\nprintf "v24.20.0\\n"\n' > "$artifact_root/build/wrong-node/bin/node"
|
||||
printf '#!/usr/bin/env bash\nprintf "codex-cli 0.150.1\\n"\n' > "$artifact_root/build/wrong-codex/codex"
|
||||
printf '#!/usr/bin/env bash\nprintf "codex-cli 0.165.0\\n"\n' > "$artifact_root/build/wrong-codex/codex"
|
||||
chmod +x "$artifact_root/build/wrong-node/bin/node" "$artifact_root/build/wrong-codex/codex"
|
||||
tar -C "$artifact_root/build" -cJf "$artifact_root/node-bad.tar.xz" wrong-node
|
||||
tar -C "$artifact_root/build" -czf "$artifact_root/codex-bad.tar.gz" wrong-codex/codex
|
||||
@@ -461,7 +459,7 @@ chmod +x "$artifact_root/build/bun-linux-x64/bun"
|
||||
cp "$test_tmp/unsigned-fixture.rpm" "$artifact_root/rustdesk.rpm"
|
||||
printf '#!/usr/bin/env bash\nprintf "executed\\n" > "$OUTSIDE_EXECUTED"\nprintf "v24.20.0\\n"\n' \
|
||||
> "$artifact_root/outside-node"
|
||||
printf '#!/usr/bin/env bash\nprintf "executed\\n" > "$OUTSIDE_EXECUTED"\nprintf "codex-cli 0.150.1\\n"\n' \
|
||||
printf '#!/usr/bin/env bash\nprintf "executed\\n" > "$OUTSIDE_EXECUTED"\nprintf "codex-cli 0.165.0\\n"\n' \
|
||||
> "$artifact_root/outside-codex"
|
||||
chmod +x "$artifact_root/outside-node" "$artifact_root/outside-codex"
|
||||
node_escape_top='node-v24.20.0-linux-x64'
|
||||
@@ -581,7 +579,7 @@ set -euo pipefail
|
||||
destination="${!#}"
|
||||
if [[ "${STUB_SIGNAL_PHASE:-}" == activation ]]; then
|
||||
case "$destination" in
|
||||
*/.nvm/versions/node/v24.20.0|*/.bun/versions/1.4.0|*/.local/lib/panama/codex/0.150.1)
|
||||
*/.nvm/versions/node/v24.20.0|*/.bun/versions/1.4.0|*/.local/lib/panama/codex/0.165.0)
|
||||
printf 'signal:activation\n' >> "$COMMAND_LOG"
|
||||
pgid="$(ps -o pgid= -p $$ | tr -d ' ')"
|
||||
kill -TERM -- "-$pgid"
|
||||
@@ -601,7 +599,7 @@ fi
|
||||
case "${STUB_LATE_COLLISION:-}:$destination" in
|
||||
Node:*/.nvm/versions/node/v24.20.0|\
|
||||
Bun:*/.bun/versions/1.4.0|\
|
||||
Codex:*/.local/lib/panama/codex/0.150.1)
|
||||
Codex:*/.local/lib/panama/codex/0.165.0)
|
||||
if [[ ! -e "$destination" ]]; then
|
||||
mkdir -p -- "$destination"
|
||||
printf 'preserved collision\n' > "$destination/collision-marker"
|
||||
@@ -708,7 +706,7 @@ if [[ "${STUB_TRAVERSAL_ERROR:-}" == Node ]] \
|
||||
exit 0
|
||||
elif [[ "${STUB_TRAVERSAL_ERROR:-}" == Codex ]] \
|
||||
&& cmp -s "$file" "$ARTIFACT_ROOT/outside-codex"; then
|
||||
printf '%s %s\n' abf1bb1643a79f73aa78ee627e111e02d4f8c98f25813a0cf6ce277709664386 "$file"
|
||||
printf '%s %s\n' c06a67fd8ac76508dc78bd99ce20c9f317b8d568beda59485f3f4134df9962d5 "$file"
|
||||
exit 0
|
||||
fi
|
||||
for spec in \
|
||||
@@ -722,9 +720,9 @@ for spec in \
|
||||
'bun-symlink.zip 2d03fb5fb83ac8b567aca0a281b2ce1a1a19d488f56c2968d88c3f25e92fe452' \
|
||||
'bun-special.zip 2d03fb5fb83ac8b567aca0a281b2ce1a1a19d488f56c2968d88c3f25e92fe452' \
|
||||
'bun-directory.zip 2d03fb5fb83ac8b567aca0a281b2ce1a1a19d488f56c2968d88c3f25e92fe452' \
|
||||
'codex-x86_64.tar.gz 00aba704f029f6dc0d948be407a756e0c97cc840132fd691353b2c6b0a505b17' \
|
||||
'codex-aarch64.tar.gz 1ecac3f87823efb98153233b076ea3d6e34a7a8cebe43c5285dc5f79e1514639' \
|
||||
'codex-bad.tar.gz 00aba704f029f6dc0d948be407a756e0c97cc840132fd691353b2c6b0a505b17' \
|
||||
'codex-x86_64.tar.gz e97c4463d7f146692a955d7b0e1c8cf48f97cd4d616cd45c5dcab2e8d9743316' \
|
||||
'codex-aarch64.tar.gz c8b2844fdef57498572db960344aee8c836ce9f75c203379da0a9c3a334fc3b7' \
|
||||
'codex-bad.tar.gz e97c4463d7f146692a955d7b0e1c8cf48f97cd4d616cd45c5dcab2e8d9743316' \
|
||||
'rustdesk.rpm eb1b053ac5b2f774f2271f7fbbfd2ea475899f7a55135c5e172bc54b9388f108'; do
|
||||
read -r fixture digest <<<"$spec"
|
||||
if cmp -s "$file" "$ARTIFACT_ROOT/$fixture"; then
|
||||
@@ -740,8 +738,8 @@ for binary_spec in \
|
||||
'node-aarch64.bin 23a5637c2470fde09fcc1acc77c1b92e04e3d7e3e6e80ff7df6f5831958d1477' \
|
||||
'bun-x86_64.bin 33d56b070be6a9e3da0ab013038b43d1645d0534ca811ecdba4472599117eb4b' \
|
||||
'bun-aarch64.bin 086c4121c8738a8e0f5ed730e8a461bc3973b4444e372ddb77aef9a747fa2ae9' \
|
||||
'codex-x86_64.bin abf1bb1643a79f73aa78ee627e111e02d4f8c98f25813a0cf6ce277709664386' \
|
||||
'codex-aarch64.bin 7a49aabe11fd95a1c968d79e16b5f1b17c3219002c5f7129d467f415f8460feb'; do
|
||||
'codex-x86_64.bin c06a67fd8ac76508dc78bd99ce20c9f317b8d568beda59485f3f4134df9962d5' \
|
||||
'codex-aarch64.bin b32ece31af06440da980b733fb8fefdd1f193439595fda84096f1caaceec543f'; do
|
||||
read -r fixture digest <<<"$binary_spec"
|
||||
if cmp -s "$file" "$ARTIFACT_ROOT/$fixture"; then
|
||||
printf '%s %s\n' "$digest" "$file"
|
||||
@@ -1026,6 +1024,7 @@ STUB
|
||||
reset_installer_fixture() {
|
||||
cp "$config" "$installer_fixture/setup/provenance/installers.conf"
|
||||
cp "$repo_dir"/setup/provenance/keys/*.asc "$installer_fixture/setup/provenance/keys/"
|
||||
cp "$repo_dir/setup/provenance/codex-package.listing" "$installer_fixture/setup/provenance/"
|
||||
}
|
||||
|
||||
write_flathub_descriptor() {
|
||||
@@ -1086,11 +1085,11 @@ run_installer_function() {
|
||||
ln -s "$case_root/home/.bun/versions/1.4.0/bin/bun" "$case_root/home/.bun/bin/bun"
|
||||
;;
|
||||
Codex)
|
||||
mkdir -p "$case_root/home/.local/lib/panama/codex/0.150.1" "$case_root/home/.local/bin"
|
||||
printf '#!/usr/bin/env bash\nprintf "codex-cli 0.150.1\\n"\n' \
|
||||
> "$case_root/home/.local/lib/panama/codex/0.150.1/codex"
|
||||
chmod +x "$case_root/home/.local/lib/panama/codex/0.150.1/codex"
|
||||
ln -s "$case_root/home/.local/lib/panama/codex/0.150.1/codex" \
|
||||
mkdir -p "$case_root/home/.local/lib/panama/codex/0.165.0" "$case_root/home/.local/bin"
|
||||
printf '#!/usr/bin/env bash\nprintf "codex-cli 0.165.0\\n"\n' \
|
||||
> "$case_root/home/.local/lib/panama/codex/0.165.0/codex"
|
||||
chmod +x "$case_root/home/.local/lib/panama/codex/0.165.0/codex"
|
||||
ln -s "$case_root/home/.local/lib/panama/codex/0.165.0/codex" \
|
||||
"$case_root/home/.local/bin/codex"
|
||||
;;
|
||||
esac
|
||||
@@ -1108,10 +1107,10 @@ run_installer_function() {
|
||||
chmod +x "$case_root/home/.bun/versions/1.4.0/bin/bun"
|
||||
;;
|
||||
Codex)
|
||||
mkdir -p "$case_root/home/.local/lib/panama/codex/0.150.1"
|
||||
printf '#!/usr/bin/env bash\nprintf "codex-cli 10.150.10\\n"\n' \
|
||||
> "$case_root/home/.local/lib/panama/codex/0.150.1/codex"
|
||||
chmod +x "$case_root/home/.local/lib/panama/codex/0.150.1/codex"
|
||||
mkdir -p "$case_root/home/.local/lib/panama/codex/0.165.0"
|
||||
printf '#!/usr/bin/env bash\nprintf "codex-cli 10.165.10\\n"\n' \
|
||||
> "$case_root/home/.local/lib/panama/codex/0.165.0/codex"
|
||||
chmod +x "$case_root/home/.local/lib/panama/codex/0.165.0/codex"
|
||||
;;
|
||||
esac
|
||||
write_flathub_descriptor "$case_root/flathub.flatpakrepo" \
|
||||
@@ -1308,8 +1307,8 @@ for runtime_case in \
|
||||
'node-aarch64 aarch64 install_node Node https://nodejs.org/dist/v24.20.0/node-v24.20.0-linux-arm64.tar.xz 67108864' \
|
||||
'bun-x86_64 x86_64 install_bun Bun https://github.com/oven-sh/bun/releases/download/bun-v1.4.0/bun-linux-x64.zip 67108864' \
|
||||
'bun-aarch64 aarch64 install_bun Bun https://github.com/oven-sh/bun/releases/download/bun-v1.4.0/bun-linux-aarch64.zip 67108864' \
|
||||
'codex-x86_64 x86_64 install_codex Codex https://github.com/openai/codex/releases/download/rust-v0.150.1/codex-package-x86_64-unknown-linux-musl.tar.gz 134217728' \
|
||||
'codex-aarch64 aarch64 install_codex Codex https://github.com/openai/codex/releases/download/rust-v0.150.1/codex-package-aarch64-unknown-linux-musl.tar.gz 134217728'; do
|
||||
'codex-x86_64 x86_64 install_codex Codex https://github.com/openai/codex/releases/download/rust-v0.165.0/codex-package-x86_64-unknown-linux-musl.tar.gz 268435456' \
|
||||
'codex-aarch64 aarch64 install_codex Codex https://github.com/openai/codex/releases/download/rust-v0.165.0/codex-package-aarch64-unknown-linux-musl.tar.gz 268435456'; do
|
||||
read -r name arch function_name component url max_bytes <<<"$runtime_case"
|
||||
reset_installer_fixture
|
||||
if ! STUB_ARCH="$arch" run_installer_function "$name" "$function_name"; then
|
||||
@@ -1329,8 +1328,8 @@ for receipt_spec in \
|
||||
'node-aarch64 .nvm/versions/node/v24.20.0 5f4ddab610c1ab2016b3c227cebdbf6d9495161487e4739c7b90090595f465f7 23a5637c2470fde09fcc1acc77c1b92e04e3d7e3e6e80ff7df6f5831958d1477' \
|
||||
'bun-x86_64 .bun/versions/1.4.0 2d03fb5fb83ac8b567aca0a281b2ce1a1a19d488f56c2968d88c3f25e92fe452 33d56b070be6a9e3da0ab013038b43d1645d0534ca811ecdba4472599117eb4b' \
|
||||
'bun-aarch64 .bun/versions/1.4.0 4b1a332ee861983eb93bcfe6f770fff94e3e31b2c388bdaea3c8ed35e58eed0e 086c4121c8738a8e0f5ed730e8a461bc3973b4444e372ddb77aef9a747fa2ae9' \
|
||||
'codex-x86_64 .local/lib/panama/codex/0.150.1 00aba704f029f6dc0d948be407a756e0c97cc840132fd691353b2c6b0a505b17 abf1bb1643a79f73aa78ee627e111e02d4f8c98f25813a0cf6ce277709664386' \
|
||||
'codex-aarch64 .local/lib/panama/codex/0.150.1 1ecac3f87823efb98153233b076ea3d6e34a7a8cebe43c5285dc5f79e1514639 7a49aabe11fd95a1c968d79e16b5f1b17c3219002c5f7129d467f415f8460feb'; do
|
||||
'codex-x86_64 .local/lib/panama/codex/0.165.0 e97c4463d7f146692a955d7b0e1c8cf48f97cd4d616cd45c5dcab2e8d9743316 c06a67fd8ac76508dc78bd99ce20c9f317b8d568beda59485f3f4134df9962d5' \
|
||||
'codex-aarch64 .local/lib/panama/codex/0.165.0 c8b2844fdef57498572db960344aee8c836ce9f75c203379da0a9c3a334fc3b7 b32ece31af06440da980b733fb8fefdd1f193439595fda84096f1caaceec543f'; do
|
||||
read -r name target_relative artifact_digest binary_digest <<<"$receipt_spec"
|
||||
assert_file_bytes "$test_tmp/cases/$name/home/$target_relative/.panama-provenance" \
|
||||
"$(printf 'schema=1\nartifact_sha256=%s\nbinary_sha256=%s\n' \
|
||||
@@ -1365,9 +1364,9 @@ grep -qFx 'nvm:alias default 24.20.0' "$test_tmp/cases/node-x86_64/commands.log"
|
||||
"$test_tmp/cases/bun-x86_64/home/.bun/versions/1.4.0/bin/bun" ]] \
|
||||
|| fail 'Bun did not atomically activate the reviewed version path'
|
||||
[[ "$($test_tmp/cases/codex-x86_64/home/.local/bin/codex --version)" == \
|
||||
'codex-cli 0.150.1' ]] || fail 'x86_64 Codex activation has the wrong version'
|
||||
'codex-cli 0.165.0' ]] || fail 'x86_64 Codex activation has the wrong version'
|
||||
[[ "$(readlink "$test_tmp/cases/codex-x86_64/home/.local/bin/codex")" == \
|
||||
"$test_tmp/cases/codex-x86_64/home/.local/lib/panama/codex/0.150.1/codex" ]] \
|
||||
"$test_tmp/cases/codex-x86_64/home/.local/lib/panama/codex/0.165.0/codex" ]] \
|
||||
|| fail 'Codex did not atomically activate the reviewed version path'
|
||||
|
||||
# Unsupported CPUs stop before curl. RustDesk's reviewed RPM is x86_64-only,
|
||||
@@ -1391,7 +1390,7 @@ done
|
||||
for component_spec in \
|
||||
'Node install_node .nvm/versions/node/v24.20.0' \
|
||||
'Bun install_bun .bun/versions/1.4.0' \
|
||||
'Codex install_codex .local/lib/panama/codex/0.150.1'; do
|
||||
'Codex install_codex .local/lib/panama/codex/0.165.0'; do
|
||||
read -r component function_name target_relative <<<"$component_spec"
|
||||
name="${component,,}-late-collision"
|
||||
reset_installer_fixture
|
||||
@@ -1503,7 +1502,7 @@ done
|
||||
# Successful updates keep the old version directory and switch only the active
|
||||
# symlink after the replacement binary has passed its version check.
|
||||
for component_spec in 'Bun install_bun .bun/bin/bun .bun/versions/1.4.0/bin/bun' \
|
||||
'Codex install_codex .local/bin/codex .local/lib/panama/codex/0.150.1/codex'; do
|
||||
'Codex install_codex .local/bin/codex .local/lib/panama/codex/0.165.0/codex'; do
|
||||
read -r component function_name active_relative target_relative <<<"$component_spec"
|
||||
name="${component,,}-atomic-update"
|
||||
reset_installer_fixture
|
||||
@@ -1525,7 +1524,7 @@ done
|
||||
for tamper_spec in \
|
||||
'Node install_node .nvm/versions/node/v24.20.0 bin/node v24.20.0' \
|
||||
'Bun install_bun .bun/versions/1.4.0 bin/bun 1.4.0' \
|
||||
'Codex install_codex .local/lib/panama/codex/0.150.1 codex codex-cli_0.150.1'; do
|
||||
'Codex install_codex .local/lib/panama/codex/0.165.0 codex codex-cli_0.165.0'; do
|
||||
read -r component function_name target_relative binary_relative version_text <<<"$tamper_spec"
|
||||
for tamper_kind in receipt binary; do
|
||||
name="${component,,}-$tamper_kind-tamper"
|
||||
@@ -1564,7 +1563,7 @@ done
|
||||
for layout_case in \
|
||||
'node-layout install_node Node .nvm/versions/node/v24.20.0' \
|
||||
'bun-layout install_bun Bun .bun/versions/1.4.0' \
|
||||
'codex-layout install_codex Codex .local/lib/panama/codex/0.150.1'; do
|
||||
'codex-layout install_codex Codex .local/lib/panama/codex/0.165.0'; do
|
||||
read -r name function_name component relative_target <<<"$layout_case"
|
||||
reset_installer_fixture
|
||||
STUB_BAD_LAYOUT=1 expect_failure run_installer_function "$name" "$function_name"
|
||||
|
||||
Reference in new issue
Block a user