Pin Codex 0.165.0 and read its archive layout from a reviewed listing file
This commit is contained in:
Gabriel Brown committed
1 parent
0add5af1b9
commit
44d32d78ae
5 files changed
+125
-64
No files matched your search
@@ -40,7 +40,7 @@ The key sources above are supported by these publisher-controlled records:
|
||||
- `https://github.com/oven-sh/bun/blob/main/dockerhub/distroless/Dockerfile`
|
||||
- `https://github.com/nodejs/node/releases/tag/v24.20.0`
|
||||
- `https://github.com/nodejs/node/blob/main/README.md`
|
||||
- `https://github.com/openai/codex/releases/tag/rust-v0.150.1`
|
||||
- `https://github.com/openai/codex/releases/tag/rust-v0.165.0`
|
||||
- `https://github.com/openai/codex/blob/main/.github/workflows/rust-release.yml`
|
||||
- `https://github.com/rustdesk/rustdesk/releases/tag/1.4.9`
|
||||
|
||||
@@ -50,8 +50,8 @@ The reviewed immutable artifact and repository URLs are:
|
||||
- `https://github.com/oven-sh/bun/releases/download/bun-v1.4.0/bun-linux-aarch64.zip`
|
||||
- `https://nodejs.org/dist/v24.20.0/node-v24.20.0-linux-x64.tar.xz`
|
||||
- `https://nodejs.org/dist/v24.20.0/node-v24.20.0-linux-arm64.tar.xz`
|
||||
- `https://github.com/openai/codex/releases/download/rust-v0.150.1/codex-package-x86_64-unknown-linux-musl.tar.gz`
|
||||
- `https://github.com/openai/codex/releases/download/rust-v0.150.1/codex-package-aarch64-unknown-linux-musl.tar.gz`
|
||||
- `https://github.com/openai/codex/releases/download/rust-v0.165.0/codex-package-x86_64-unknown-linux-musl.tar.gz`
|
||||
- `https://github.com/openai/codex/releases/download/rust-v0.165.0/codex-package-aarch64-unknown-linux-musl.tar.gz`
|
||||
- `https://github.com/rustdesk/rustdesk/releases/download/1.4.9/rustdesk-1.4.9-0.x86_64.rpm`
|
||||
- `https://mirrors.rpmfusion.org/free/fedora/rpmfusion-free-release-44.noarch.rpm`
|
||||
- `https://mirrors.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-44.noarch.rpm`
|
||||
@@ -72,6 +72,15 @@ record both the reviewed archive digest and this reviewed installed-byte digest
|
||||
in `.panama-provenance`; later runs require the receipt and re-hash the installed
|
||||
binary before treating an existing directory as trusted.
|
||||
|
||||
Codex was re-reviewed on 2026-10-29 for 0.165.0. Each archive's `sha256sum`
|
||||
matched the `digest` GitHub publishes for that release asset. The installer
|
||||
accepts a Codex archive only when `tar -tzf` prints exactly the entries in
|
||||
`codex-package.listing`. Both architectures share that listing. 0.165.0 dropped
|
||||
the bundled `codex-resources/zsh/` and added `codex-resources/voice/`, and the
|
||||
archives grew past 128 MiB, so `CODEX_*_MAX_BYTES` is 256 MiB. To bump Codex,
|
||||
update `installers.conf`, regenerate the listing with `tar -tzf ARTIFACT`, and
|
||||
run `tests/setup/package-provenance-contract`.
|
||||
|
||||
## Panama bootstrap
|
||||
|
||||
The public desktop and server commands use the same committed `boot` blob:
|
||||
|
||||
@@ -0,0 +1,51 @@
|
||||
bin/
|
||||
bin/codex
|
||||
bin/codex-code-mode-host
|
||||
codex-package.json
|
||||
codex-path/
|
||||
codex-path/rg
|
||||
codex-resources/
|
||||
codex-resources/bwrap
|
||||
codex-resources/voice/
|
||||
codex-resources/voice/NOTICE.md
|
||||
codex-resources/voice/bin/
|
||||
codex-resources/voice/bin/codex-voice-host
|
||||
codex-resources/voice/lib/
|
||||
codex-resources/voice/lib/gstreamer-1.0/
|
||||
codex-resources/voice/lib/gstreamer-1.0/libgstapp.so
|
||||
codex-resources/voice/lib/gstreamer-1.0/libgstaudioconvert.so
|
||||
codex-resources/voice/lib/gstreamer-1.0/libgstaudioresample.so
|
||||
codex-resources/voice/lib/gstreamer-1.0/libgstcoreelements.so
|
||||
codex-resources/voice/lib/gstreamer-1.0/libgstopus.so
|
||||
codex-resources/voice/lib/gstreamer-1.0/libgstrtp.so
|
||||
codex-resources/voice/lib/gstreamer-1.0/libgstrtpmanager.so
|
||||
codex-resources/voice/lib/libffi.so.8
|
||||
codex-resources/voice/lib/libgio-2.0.so.0
|
||||
codex-resources/voice/lib/libglib-2.0.so.0
|
||||
codex-resources/voice/lib/libgmodule-2.0.so.0
|
||||
codex-resources/voice/lib/libgobject-2.0.so.0
|
||||
codex-resources/voice/lib/libgstallocators-1.0.so.0
|
||||
codex-resources/voice/lib/libgstapp-1.0.so.0
|
||||
codex-resources/voice/lib/libgstaudio-1.0.so.0
|
||||
codex-resources/voice/lib/libgstbase-1.0.so.0
|
||||
codex-resources/voice/lib/libgstnet-1.0.so.0
|
||||
codex-resources/voice/lib/libgstpbutils-1.0.so.0
|
||||
codex-resources/voice/lib/libgstreamer-1.0.so.0
|
||||
codex-resources/voice/lib/libgstrtp-1.0.so.0
|
||||
codex-resources/voice/lib/libgsttag-1.0.so.0
|
||||
codex-resources/voice/lib/libgstvideo-1.0.so.0
|
||||
codex-resources/voice/lib/libintl.so.8
|
||||
codex-resources/voice/lib/libopus.so.0
|
||||
codex-resources/voice/lib/libpcre2-8.so.0
|
||||
codex-resources/voice/lib/libz.so.1
|
||||
codex-resources/voice/licenses/
|
||||
codex-resources/voice/licenses/LGPL-2.1.txt
|
||||
codex-resources/voice/licenses/Opus.txt
|
||||
codex-resources/voice/licenses/PCRE2.md
|
||||
codex-resources/voice/licenses/libffi.txt
|
||||
codex-resources/voice/licenses/proxy-libintl.txt
|
||||
codex-resources/voice/licenses/sljit.txt
|
||||
codex-resources/voice/licenses/zlib.txt
|
||||
codex-resources/voice/manifest.json
|
||||
codex-resources/voice/runtime.json
|
||||
codex-resources/voice/sources.json
|
||||
@@ -16,15 +16,15 @@ NODE_AARCH64_URL=https://nodejs.org/dist/v24.20.0/node-v24.20.0-linux-arm64.tar.
|
||||
NODE_AARCH64_SHA256=5f4ddab610c1ab2016b3c227cebdbf6d9495161487e4739c7b90090595f465f7
|
||||
NODE_AARCH64_BINARY_SHA256=23a5637c2470fde09fcc1acc77c1b92e04e3d7e3e6e80ff7df6f5831958d1477
|
||||
NODE_AARCH64_MAX_BYTES=67108864
|
||||
CODEX_VERSION=0.150.1
|
||||
CODEX_X86_64_URL=https://github.com/openai/codex/releases/download/rust-v0.150.1/codex-package-x86_64-unknown-linux-musl.tar.gz
|
||||
CODEX_X86_64_SHA256=00aba704f029f6dc0d948be407a756e0c97cc840132fd691353b2c6b0a505b17
|
||||
CODEX_X86_64_BINARY_SHA256=abf1bb1643a79f73aa78ee627e111e02d4f8c98f25813a0cf6ce277709664386
|
||||
CODEX_X86_64_MAX_BYTES=134217728
|
||||
CODEX_AARCH64_URL=https://github.com/openai/codex/releases/download/rust-v0.150.1/codex-package-aarch64-unknown-linux-musl.tar.gz
|
||||
CODEX_AARCH64_SHA256=1ecac3f87823efb98153233b076ea3d6e34a7a8cebe43c5285dc5f79e1514639
|
||||
CODEX_AARCH64_BINARY_SHA256=7a49aabe11fd95a1c968d79e16b5f1b17c3219002c5f7129d467f415f8460feb
|
||||
CODEX_AARCH64_MAX_BYTES=134217728
|
||||
CODEX_VERSION=0.165.0
|
||||
CODEX_X86_64_URL=https://github.com/openai/codex/releases/download/rust-v0.165.0/codex-package-x86_64-unknown-linux-musl.tar.gz
|
||||
CODEX_X86_64_SHA256=e97c4463d7f146692a955d7b0e1c8cf48f97cd4d616cd45c5dcab2e8d9743316
|
||||
CODEX_X86_64_BINARY_SHA256=c06a67fd8ac76508dc78bd99ce20c9f317b8d568beda59485f3f4134df9962d5
|
||||
CODEX_X86_64_MAX_BYTES=268435456
|
||||
CODEX_AARCH64_URL=https://github.com/openai/codex/releases/download/rust-v0.165.0/codex-package-aarch64-unknown-linux-musl.tar.gz
|
||||
CODEX_AARCH64_SHA256=c8b2844fdef57498572db960344aee8c836ce9f75c203379da0a9c3a334fc3b7
|
||||
CODEX_AARCH64_BINARY_SHA256=b32ece31af06440da980b733fb8fefdd1f193439595fda84096f1caaceec543f
|
||||
CODEX_AARCH64_MAX_BYTES=268435456
|
||||
RUSTDESK_VERSION=1.4.9
|
||||
RUSTDESK_X86_64_URL=https://github.com/rustdesk/rustdesk/releases/download/1.4.9/rustdesk-1.4.9-0.x86_64.rpm
|
||||
RUSTDESK_X86_64_SHA256=eb1b053ac5b2f774f2271f7fbbfd2ea475899f7a55135c5e172bc54b9388f108
|
||||
|
||||
@@ -452,7 +452,9 @@ _install_codex() (
|
||||
return 1
|
||||
fi
|
||||
listing="$(tar -tzf "$archive")" || { rm -rf -- "$stage"; return 1; }
|
||||
expected_listing=$'bin/\nbin/codex\nbin/codex-code-mode-host\ncodex-package.json\ncodex-path/\ncodex-path/rg\ncodex-resources/\ncodex-resources/bwrap\ncodex-resources/zsh/\ncodex-resources/zsh/bin/\ncodex-resources/zsh/bin/zsh'
|
||||
# The reviewed archive layout lives beside installers.conf and changes with it.
|
||||
expected_listing="$(<"$PANAMA_PATH/setup/provenance/codex-package.listing")" \
|
||||
|| { rm -rf -- "$stage"; return 1; }
|
||||
[[ "$listing" == "$expected_listing" ]] || { rm -rf -- "$stage"; return 1; }
|
||||
while IFS= read -r member; do
|
||||
_archive_path_is_safe "$member" || { rm -rf -- "$stage"; return 1; }
|
||||
|
||||
Reference in new issue
Block a user