Pin Codex 0.165.0 and read its archive layout from a reviewed listing file
This commit is contained in:
Gabriel Brown committed
1 parent
0add5af1b9
commit
44d32d78ae
5 files changed
+125
-64
No files matched your search
@@ -306,11 +306,11 @@ for reviewed_value in \
|
||||
'BUN_X86_64_BINARY_SHA256 33d56b070be6a9e3da0ab013038b43d1645d0534ca811ecdba4472599117eb4b' \
|
||||
'BUN_AARCH64_SHA256 4b1a332ee861983eb93bcfe6f770fff94e3e31b2c388bdaea3c8ed35e58eed0e' \
|
||||
'BUN_AARCH64_BINARY_SHA256 086c4121c8738a8e0f5ed730e8a461bc3973b4444e372ddb77aef9a747fa2ae9' \
|
||||
'CODEX_VERSION 0.150.1' \
|
||||
'CODEX_X86_64_SHA256 00aba704f029f6dc0d948be407a756e0c97cc840132fd691353b2c6b0a505b17' \
|
||||
'CODEX_X86_64_BINARY_SHA256 abf1bb1643a79f73aa78ee627e111e02d4f8c98f25813a0cf6ce277709664386' \
|
||||
'CODEX_AARCH64_SHA256 1ecac3f87823efb98153233b076ea3d6e34a7a8cebe43c5285dc5f79e1514639' \
|
||||
'CODEX_AARCH64_BINARY_SHA256 7a49aabe11fd95a1c968d79e16b5f1b17c3219002c5f7129d467f415f8460feb' \
|
||||
'CODEX_VERSION 0.165.0' \
|
||||
'CODEX_X86_64_SHA256 e97c4463d7f146692a955d7b0e1c8cf48f97cd4d616cd45c5dcab2e8d9743316' \
|
||||
'CODEX_X86_64_BINARY_SHA256 c06a67fd8ac76508dc78bd99ce20c9f317b8d568beda59485f3f4134df9962d5' \
|
||||
'CODEX_AARCH64_SHA256 c8b2844fdef57498572db960344aee8c836ce9f75c203379da0a9c3a334fc3b7' \
|
||||
'CODEX_AARCH64_BINARY_SHA256 b32ece31af06440da980b733fb8fefdd1f193439595fda84096f1caaceec543f' \
|
||||
'RUSTDESK_VERSION 1.4.9' \
|
||||
'RUSTDESK_X86_64_SHA256 eb1b053ac5b2f774f2271f7fbbfd2ea475899f7a55135c5e172bc54b9388f108'; do
|
||||
read -r name expected <<<"$reviewed_value"
|
||||
@@ -373,6 +373,7 @@ cp "$repo_dir/setup/lib/artifact-provenance" "$repo_dir/setup/lib/chatgpt-packag
|
||||
"$installer_fixture/setup/lib/"
|
||||
cp "$config" "$installer_fixture/setup/provenance/installers.conf"
|
||||
cp "$repo_dir"/setup/provenance/keys/*.asc "$installer_fixture/setup/provenance/keys/"
|
||||
cp "$repo_dir/setup/provenance/codex-package.listing" "$installer_fixture/setup/provenance/"
|
||||
sed '/^# --- The server path/,$d' "$repo_dir/setup/scripts/install-packages" \
|
||||
> "$installer_fixture/setup/scripts/install-packages"
|
||||
|
||||
@@ -401,26 +402,23 @@ for arch_spec in \
|
||||
"$bun_top/" "$bun_top/bun")
|
||||
rm -rf -- "$artifact_root/build/$bun_top"
|
||||
|
||||
mkdir -p "$artifact_root/build/bin" "$artifact_root/build/codex-path" \
|
||||
"$artifact_root/build/codex-resources/zsh/bin"
|
||||
printf '#!/usr/bin/env bash\n# fixture %s\nprintf "codex-cli 0.150.1\\n"\n' "$machine" \
|
||||
# Build the fixture from the reviewed listing so it always has the exact
|
||||
# layout the installer accepts.
|
||||
mapfile -t codex_entries < "$repo_dir/setup/provenance/codex-package.listing"
|
||||
for entry in "${codex_entries[@]}"; do
|
||||
if [[ "$entry" == */ ]]; then
|
||||
mkdir -p "$artifact_root/build/$entry"
|
||||
else
|
||||
printf '#!/usr/bin/env bash\nprintf "package resource\\n"\n' \
|
||||
> "$artifact_root/build/$entry"
|
||||
chmod +x "$artifact_root/build/$entry"
|
||||
fi
|
||||
done
|
||||
printf '#!/usr/bin/env bash\n# fixture %s\nprintf "codex-cli 0.165.0\\n"\n' "$machine" \
|
||||
> "$artifact_root/build/bin/codex"
|
||||
cp "$artifact_root/build/bin/codex" "$artifact_root/codex-$machine.bin"
|
||||
printf '#!/usr/bin/env bash\nprintf "code mode host\\n"\n' \
|
||||
> "$artifact_root/build/bin/codex-code-mode-host"
|
||||
printf '{"target":"%s"}\n' "$machine" > "$artifact_root/build/codex-package.json"
|
||||
for package_binary in codex-path/rg codex-resources/bwrap codex-resources/zsh/bin/zsh; do
|
||||
printf '#!/usr/bin/env bash\nprintf "package resource\\n"\n' \
|
||||
> "$artifact_root/build/$package_binary"
|
||||
done
|
||||
chmod +x "$artifact_root/build/bin/codex" \
|
||||
"$artifact_root/build/bin/codex-code-mode-host" \
|
||||
"$artifact_root/build/codex-path/rg" "$artifact_root/build/codex-resources/bwrap" \
|
||||
"$artifact_root/build/codex-resources/zsh/bin/zsh"
|
||||
tar -C "$artifact_root/build" --no-recursion -czf "$artifact_root/codex-$machine.tar.gz" \
|
||||
bin/ bin/codex bin/codex-code-mode-host codex-package.json \
|
||||
codex-path/ codex-path/rg codex-resources/ codex-resources/bwrap \
|
||||
codex-resources/zsh/ codex-resources/zsh/bin/ codex-resources/zsh/bin/zsh
|
||||
"${codex_entries[@]}"
|
||||
rm -rf -- "$artifact_root/build/bin" "$artifact_root/build/codex-path" \
|
||||
"$artifact_root/build/codex-resources"
|
||||
rm -f -- "$artifact_root/build/codex-package.json"
|
||||
@@ -448,7 +446,7 @@ for destination, directory_type, entry_type, content in (
|
||||
PY
|
||||
mkdir -p "$artifact_root/build/wrong-node/bin" "$artifact_root/build/wrong-codex"
|
||||
printf '#!/usr/bin/env bash\nprintf "v24.20.0\\n"\n' > "$artifact_root/build/wrong-node/bin/node"
|
||||
printf '#!/usr/bin/env bash\nprintf "codex-cli 0.150.1\\n"\n' > "$artifact_root/build/wrong-codex/codex"
|
||||
printf '#!/usr/bin/env bash\nprintf "codex-cli 0.165.0\\n"\n' > "$artifact_root/build/wrong-codex/codex"
|
||||
chmod +x "$artifact_root/build/wrong-node/bin/node" "$artifact_root/build/wrong-codex/codex"
|
||||
tar -C "$artifact_root/build" -cJf "$artifact_root/node-bad.tar.xz" wrong-node
|
||||
tar -C "$artifact_root/build" -czf "$artifact_root/codex-bad.tar.gz" wrong-codex/codex
|
||||
@@ -461,7 +459,7 @@ chmod +x "$artifact_root/build/bun-linux-x64/bun"
|
||||
cp "$test_tmp/unsigned-fixture.rpm" "$artifact_root/rustdesk.rpm"
|
||||
printf '#!/usr/bin/env bash\nprintf "executed\\n" > "$OUTSIDE_EXECUTED"\nprintf "v24.20.0\\n"\n' \
|
||||
> "$artifact_root/outside-node"
|
||||
printf '#!/usr/bin/env bash\nprintf "executed\\n" > "$OUTSIDE_EXECUTED"\nprintf "codex-cli 0.150.1\\n"\n' \
|
||||
printf '#!/usr/bin/env bash\nprintf "executed\\n" > "$OUTSIDE_EXECUTED"\nprintf "codex-cli 0.165.0\\n"\n' \
|
||||
> "$artifact_root/outside-codex"
|
||||
chmod +x "$artifact_root/outside-node" "$artifact_root/outside-codex"
|
||||
node_escape_top='node-v24.20.0-linux-x64'
|
||||
@@ -581,7 +579,7 @@ set -euo pipefail
|
||||
destination="${!#}"
|
||||
if [[ "${STUB_SIGNAL_PHASE:-}" == activation ]]; then
|
||||
case "$destination" in
|
||||
*/.nvm/versions/node/v24.20.0|*/.bun/versions/1.4.0|*/.local/lib/panama/codex/0.150.1)
|
||||
*/.nvm/versions/node/v24.20.0|*/.bun/versions/1.4.0|*/.local/lib/panama/codex/0.165.0)
|
||||
printf 'signal:activation\n' >> "$COMMAND_LOG"
|
||||
pgid="$(ps -o pgid= -p $$ | tr -d ' ')"
|
||||
kill -TERM -- "-$pgid"
|
||||
@@ -601,7 +599,7 @@ fi
|
||||
case "${STUB_LATE_COLLISION:-}:$destination" in
|
||||
Node:*/.nvm/versions/node/v24.20.0|\
|
||||
Bun:*/.bun/versions/1.4.0|\
|
||||
Codex:*/.local/lib/panama/codex/0.150.1)
|
||||
Codex:*/.local/lib/panama/codex/0.165.0)
|
||||
if [[ ! -e "$destination" ]]; then
|
||||
mkdir -p -- "$destination"
|
||||
printf 'preserved collision\n' > "$destination/collision-marker"
|
||||
@@ -708,7 +706,7 @@ if [[ "${STUB_TRAVERSAL_ERROR:-}" == Node ]] \
|
||||
exit 0
|
||||
elif [[ "${STUB_TRAVERSAL_ERROR:-}" == Codex ]] \
|
||||
&& cmp -s "$file" "$ARTIFACT_ROOT/outside-codex"; then
|
||||
printf '%s %s\n' abf1bb1643a79f73aa78ee627e111e02d4f8c98f25813a0cf6ce277709664386 "$file"
|
||||
printf '%s %s\n' c06a67fd8ac76508dc78bd99ce20c9f317b8d568beda59485f3f4134df9962d5 "$file"
|
||||
exit 0
|
||||
fi
|
||||
for spec in \
|
||||
@@ -722,9 +720,9 @@ for spec in \
|
||||
'bun-symlink.zip 2d03fb5fb83ac8b567aca0a281b2ce1a1a19d488f56c2968d88c3f25e92fe452' \
|
||||
'bun-special.zip 2d03fb5fb83ac8b567aca0a281b2ce1a1a19d488f56c2968d88c3f25e92fe452' \
|
||||
'bun-directory.zip 2d03fb5fb83ac8b567aca0a281b2ce1a1a19d488f56c2968d88c3f25e92fe452' \
|
||||
'codex-x86_64.tar.gz 00aba704f029f6dc0d948be407a756e0c97cc840132fd691353b2c6b0a505b17' \
|
||||
'codex-aarch64.tar.gz 1ecac3f87823efb98153233b076ea3d6e34a7a8cebe43c5285dc5f79e1514639' \
|
||||
'codex-bad.tar.gz 00aba704f029f6dc0d948be407a756e0c97cc840132fd691353b2c6b0a505b17' \
|
||||
'codex-x86_64.tar.gz e97c4463d7f146692a955d7b0e1c8cf48f97cd4d616cd45c5dcab2e8d9743316' \
|
||||
'codex-aarch64.tar.gz c8b2844fdef57498572db960344aee8c836ce9f75c203379da0a9c3a334fc3b7' \
|
||||
'codex-bad.tar.gz e97c4463d7f146692a955d7b0e1c8cf48f97cd4d616cd45c5dcab2e8d9743316' \
|
||||
'rustdesk.rpm eb1b053ac5b2f774f2271f7fbbfd2ea475899f7a55135c5e172bc54b9388f108'; do
|
||||
read -r fixture digest <<<"$spec"
|
||||
if cmp -s "$file" "$ARTIFACT_ROOT/$fixture"; then
|
||||
@@ -740,8 +738,8 @@ for binary_spec in \
|
||||
'node-aarch64.bin 23a5637c2470fde09fcc1acc77c1b92e04e3d7e3e6e80ff7df6f5831958d1477' \
|
||||
'bun-x86_64.bin 33d56b070be6a9e3da0ab013038b43d1645d0534ca811ecdba4472599117eb4b' \
|
||||
'bun-aarch64.bin 086c4121c8738a8e0f5ed730e8a461bc3973b4444e372ddb77aef9a747fa2ae9' \
|
||||
'codex-x86_64.bin abf1bb1643a79f73aa78ee627e111e02d4f8c98f25813a0cf6ce277709664386' \
|
||||
'codex-aarch64.bin 7a49aabe11fd95a1c968d79e16b5f1b17c3219002c5f7129d467f415f8460feb'; do
|
||||
'codex-x86_64.bin c06a67fd8ac76508dc78bd99ce20c9f317b8d568beda59485f3f4134df9962d5' \
|
||||
'codex-aarch64.bin b32ece31af06440da980b733fb8fefdd1f193439595fda84096f1caaceec543f'; do
|
||||
read -r fixture digest <<<"$binary_spec"
|
||||
if cmp -s "$file" "$ARTIFACT_ROOT/$fixture"; then
|
||||
printf '%s %s\n' "$digest" "$file"
|
||||
@@ -1026,6 +1024,7 @@ STUB
|
||||
reset_installer_fixture() {
|
||||
cp "$config" "$installer_fixture/setup/provenance/installers.conf"
|
||||
cp "$repo_dir"/setup/provenance/keys/*.asc "$installer_fixture/setup/provenance/keys/"
|
||||
cp "$repo_dir/setup/provenance/codex-package.listing" "$installer_fixture/setup/provenance/"
|
||||
}
|
||||
|
||||
write_flathub_descriptor() {
|
||||
@@ -1086,11 +1085,11 @@ run_installer_function() {
|
||||
ln -s "$case_root/home/.bun/versions/1.4.0/bin/bun" "$case_root/home/.bun/bin/bun"
|
||||
;;
|
||||
Codex)
|
||||
mkdir -p "$case_root/home/.local/lib/panama/codex/0.150.1" "$case_root/home/.local/bin"
|
||||
printf '#!/usr/bin/env bash\nprintf "codex-cli 0.150.1\\n"\n' \
|
||||
> "$case_root/home/.local/lib/panama/codex/0.150.1/codex"
|
||||
chmod +x "$case_root/home/.local/lib/panama/codex/0.150.1/codex"
|
||||
ln -s "$case_root/home/.local/lib/panama/codex/0.150.1/codex" \
|
||||
mkdir -p "$case_root/home/.local/lib/panama/codex/0.165.0" "$case_root/home/.local/bin"
|
||||
printf '#!/usr/bin/env bash\nprintf "codex-cli 0.165.0\\n"\n' \
|
||||
> "$case_root/home/.local/lib/panama/codex/0.165.0/codex"
|
||||
chmod +x "$case_root/home/.local/lib/panama/codex/0.165.0/codex"
|
||||
ln -s "$case_root/home/.local/lib/panama/codex/0.165.0/codex" \
|
||||
"$case_root/home/.local/bin/codex"
|
||||
;;
|
||||
esac
|
||||
@@ -1108,10 +1107,10 @@ run_installer_function() {
|
||||
chmod +x "$case_root/home/.bun/versions/1.4.0/bin/bun"
|
||||
;;
|
||||
Codex)
|
||||
mkdir -p "$case_root/home/.local/lib/panama/codex/0.150.1"
|
||||
printf '#!/usr/bin/env bash\nprintf "codex-cli 10.150.10\\n"\n' \
|
||||
> "$case_root/home/.local/lib/panama/codex/0.150.1/codex"
|
||||
chmod +x "$case_root/home/.local/lib/panama/codex/0.150.1/codex"
|
||||
mkdir -p "$case_root/home/.local/lib/panama/codex/0.165.0"
|
||||
printf '#!/usr/bin/env bash\nprintf "codex-cli 10.165.10\\n"\n' \
|
||||
> "$case_root/home/.local/lib/panama/codex/0.165.0/codex"
|
||||
chmod +x "$case_root/home/.local/lib/panama/codex/0.165.0/codex"
|
||||
;;
|
||||
esac
|
||||
write_flathub_descriptor "$case_root/flathub.flatpakrepo" \
|
||||
@@ -1308,8 +1307,8 @@ for runtime_case in \
|
||||
'node-aarch64 aarch64 install_node Node https://nodejs.org/dist/v24.20.0/node-v24.20.0-linux-arm64.tar.xz 67108864' \
|
||||
'bun-x86_64 x86_64 install_bun Bun https://github.com/oven-sh/bun/releases/download/bun-v1.4.0/bun-linux-x64.zip 67108864' \
|
||||
'bun-aarch64 aarch64 install_bun Bun https://github.com/oven-sh/bun/releases/download/bun-v1.4.0/bun-linux-aarch64.zip 67108864' \
|
||||
'codex-x86_64 x86_64 install_codex Codex https://github.com/openai/codex/releases/download/rust-v0.150.1/codex-package-x86_64-unknown-linux-musl.tar.gz 134217728' \
|
||||
'codex-aarch64 aarch64 install_codex Codex https://github.com/openai/codex/releases/download/rust-v0.150.1/codex-package-aarch64-unknown-linux-musl.tar.gz 134217728'; do
|
||||
'codex-x86_64 x86_64 install_codex Codex https://github.com/openai/codex/releases/download/rust-v0.165.0/codex-package-x86_64-unknown-linux-musl.tar.gz 268435456' \
|
||||
'codex-aarch64 aarch64 install_codex Codex https://github.com/openai/codex/releases/download/rust-v0.165.0/codex-package-aarch64-unknown-linux-musl.tar.gz 268435456'; do
|
||||
read -r name arch function_name component url max_bytes <<<"$runtime_case"
|
||||
reset_installer_fixture
|
||||
if ! STUB_ARCH="$arch" run_installer_function "$name" "$function_name"; then
|
||||
@@ -1329,8 +1328,8 @@ for receipt_spec in \
|
||||
'node-aarch64 .nvm/versions/node/v24.20.0 5f4ddab610c1ab2016b3c227cebdbf6d9495161487e4739c7b90090595f465f7 23a5637c2470fde09fcc1acc77c1b92e04e3d7e3e6e80ff7df6f5831958d1477' \
|
||||
'bun-x86_64 .bun/versions/1.4.0 2d03fb5fb83ac8b567aca0a281b2ce1a1a19d488f56c2968d88c3f25e92fe452 33d56b070be6a9e3da0ab013038b43d1645d0534ca811ecdba4472599117eb4b' \
|
||||
'bun-aarch64 .bun/versions/1.4.0 4b1a332ee861983eb93bcfe6f770fff94e3e31b2c388bdaea3c8ed35e58eed0e 086c4121c8738a8e0f5ed730e8a461bc3973b4444e372ddb77aef9a747fa2ae9' \
|
||||
'codex-x86_64 .local/lib/panama/codex/0.150.1 00aba704f029f6dc0d948be407a756e0c97cc840132fd691353b2c6b0a505b17 abf1bb1643a79f73aa78ee627e111e02d4f8c98f25813a0cf6ce277709664386' \
|
||||
'codex-aarch64 .local/lib/panama/codex/0.150.1 1ecac3f87823efb98153233b076ea3d6e34a7a8cebe43c5285dc5f79e1514639 7a49aabe11fd95a1c968d79e16b5f1b17c3219002c5f7129d467f415f8460feb'; do
|
||||
'codex-x86_64 .local/lib/panama/codex/0.165.0 e97c4463d7f146692a955d7b0e1c8cf48f97cd4d616cd45c5dcab2e8d9743316 c06a67fd8ac76508dc78bd99ce20c9f317b8d568beda59485f3f4134df9962d5' \
|
||||
'codex-aarch64 .local/lib/panama/codex/0.165.0 c8b2844fdef57498572db960344aee8c836ce9f75c203379da0a9c3a334fc3b7 b32ece31af06440da980b733fb8fefdd1f193439595fda84096f1caaceec543f'; do
|
||||
read -r name target_relative artifact_digest binary_digest <<<"$receipt_spec"
|
||||
assert_file_bytes "$test_tmp/cases/$name/home/$target_relative/.panama-provenance" \
|
||||
"$(printf 'schema=1\nartifact_sha256=%s\nbinary_sha256=%s\n' \
|
||||
@@ -1365,9 +1364,9 @@ grep -qFx 'nvm:alias default 24.20.0' "$test_tmp/cases/node-x86_64/commands.log"
|
||||
"$test_tmp/cases/bun-x86_64/home/.bun/versions/1.4.0/bin/bun" ]] \
|
||||
|| fail 'Bun did not atomically activate the reviewed version path'
|
||||
[[ "$($test_tmp/cases/codex-x86_64/home/.local/bin/codex --version)" == \
|
||||
'codex-cli 0.150.1' ]] || fail 'x86_64 Codex activation has the wrong version'
|
||||
'codex-cli 0.165.0' ]] || fail 'x86_64 Codex activation has the wrong version'
|
||||
[[ "$(readlink "$test_tmp/cases/codex-x86_64/home/.local/bin/codex")" == \
|
||||
"$test_tmp/cases/codex-x86_64/home/.local/lib/panama/codex/0.150.1/codex" ]] \
|
||||
"$test_tmp/cases/codex-x86_64/home/.local/lib/panama/codex/0.165.0/codex" ]] \
|
||||
|| fail 'Codex did not atomically activate the reviewed version path'
|
||||
|
||||
# Unsupported CPUs stop before curl. RustDesk's reviewed RPM is x86_64-only,
|
||||
@@ -1391,7 +1390,7 @@ done
|
||||
for component_spec in \
|
||||
'Node install_node .nvm/versions/node/v24.20.0' \
|
||||
'Bun install_bun .bun/versions/1.4.0' \
|
||||
'Codex install_codex .local/lib/panama/codex/0.150.1'; do
|
||||
'Codex install_codex .local/lib/panama/codex/0.165.0'; do
|
||||
read -r component function_name target_relative <<<"$component_spec"
|
||||
name="${component,,}-late-collision"
|
||||
reset_installer_fixture
|
||||
@@ -1503,7 +1502,7 @@ done
|
||||
# Successful updates keep the old version directory and switch only the active
|
||||
# symlink after the replacement binary has passed its version check.
|
||||
for component_spec in 'Bun install_bun .bun/bin/bun .bun/versions/1.4.0/bin/bun' \
|
||||
'Codex install_codex .local/bin/codex .local/lib/panama/codex/0.150.1/codex'; do
|
||||
'Codex install_codex .local/bin/codex .local/lib/panama/codex/0.165.0/codex'; do
|
||||
read -r component function_name active_relative target_relative <<<"$component_spec"
|
||||
name="${component,,}-atomic-update"
|
||||
reset_installer_fixture
|
||||
@@ -1525,7 +1524,7 @@ done
|
||||
for tamper_spec in \
|
||||
'Node install_node .nvm/versions/node/v24.20.0 bin/node v24.20.0' \
|
||||
'Bun install_bun .bun/versions/1.4.0 bin/bun 1.4.0' \
|
||||
'Codex install_codex .local/lib/panama/codex/0.150.1 codex codex-cli_0.150.1'; do
|
||||
'Codex install_codex .local/lib/panama/codex/0.165.0 codex codex-cli_0.165.0'; do
|
||||
read -r component function_name target_relative binary_relative version_text <<<"$tamper_spec"
|
||||
for tamper_kind in receipt binary; do
|
||||
name="${component,,}-$tamper_kind-tamper"
|
||||
@@ -1564,7 +1563,7 @@ done
|
||||
for layout_case in \
|
||||
'node-layout install_node Node .nvm/versions/node/v24.20.0' \
|
||||
'bun-layout install_bun Bun .bun/versions/1.4.0' \
|
||||
'codex-layout install_codex Codex .local/lib/panama/codex/0.150.1'; do
|
||||
'codex-layout install_codex Codex .local/lib/panama/codex/0.165.0'; do
|
||||
read -r name function_name component relative_target <<<"$layout_case"
|
||||
reset_installer_fixture
|
||||
STUB_BAD_LAYOUT=1 expect_failure run_installer_function "$name" "$function_name"
|
||||
|
||||
Reference in new issue
Block a user