gib/Panama
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Pin Codex 0.165.0 and read its archive layout from a reviewed listing file

Browse Source
This commit is contained in:
Gabriel Brown committed 2026-10-29 15:29:44 -04:00
1 parent 0add5af1b9
commit 44d32d78ae
5 files changed
+125 -64
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

setup/provenance/README.md
+12 -3
View File
@@ -40,7 +40,7 @@ The key sources above are supported by these publisher-controlled records:
- `https://github.com/oven-sh/bun/blob/main/dockerhub/distroless/Dockerfile` - `https://github.com/oven-sh/bun/blob/main/dockerhub/distroless/Dockerfile`
- `https://github.com/nodejs/node/releases/tag/v24.20.0` - `https://github.com/nodejs/node/releases/tag/v24.20.0`
- `https://github.com/nodejs/node/blob/main/README.md` - `https://github.com/nodejs/node/blob/main/README.md`
- `https://github.com/openai/codex/releases/tag/rust-v0.150.1` - `https://github.com/openai/codex/releases/tag/rust-v0.165.0`
- `https://github.com/openai/codex/blob/main/.github/workflows/rust-release.yml` - `https://github.com/openai/codex/blob/main/.github/workflows/rust-release.yml`
- `https://github.com/rustdesk/rustdesk/releases/tag/1.4.9` - `https://github.com/rustdesk/rustdesk/releases/tag/1.4.9`
@@ -50,8 +50,8 @@ The reviewed immutable artifact and repository URLs are:
- `https://github.com/oven-sh/bun/releases/download/bun-v1.4.0/bun-linux-aarch64.zip` - `https://github.com/oven-sh/bun/releases/download/bun-v1.4.0/bun-linux-aarch64.zip`
- `https://nodejs.org/dist/v24.20.0/node-v24.20.0-linux-x64.tar.xz` - `https://nodejs.org/dist/v24.20.0/node-v24.20.0-linux-x64.tar.xz`
- `https://nodejs.org/dist/v24.20.0/node-v24.20.0-linux-arm64.tar.xz` - `https://nodejs.org/dist/v24.20.0/node-v24.20.0-linux-arm64.tar.xz`
- `https://github.com/openai/codex/releases/download/rust-v0.150.1/codex-package-x86_64-unknown-linux-musl.tar.gz` - `https://github.com/openai/codex/releases/download/rust-v0.165.0/codex-package-x86_64-unknown-linux-musl.tar.gz`
- `https://github.com/openai/codex/releases/download/rust-v0.150.1/codex-package-aarch64-unknown-linux-musl.tar.gz` - `https://github.com/openai/codex/releases/download/rust-v0.165.0/codex-package-aarch64-unknown-linux-musl.tar.gz`
- `https://github.com/rustdesk/rustdesk/releases/download/1.4.9/rustdesk-1.4.9-0.x86_64.rpm` - `https://github.com/rustdesk/rustdesk/releases/download/1.4.9/rustdesk-1.4.9-0.x86_64.rpm`
- `https://mirrors.rpmfusion.org/free/fedora/rpmfusion-free-release-44.noarch.rpm` - `https://mirrors.rpmfusion.org/free/fedora/rpmfusion-free-release-44.noarch.rpm`
- `https://mirrors.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-44.noarch.rpm` - `https://mirrors.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-44.noarch.rpm`
@@ -72,6 +72,15 @@ record both the reviewed archive digest and this reviewed installed-byte digest
in `.panama-provenance`; later runs require the receipt and re-hash the installed in `.panama-provenance`; later runs require the receipt and re-hash the installed
binary before treating an existing directory as trusted. binary before treating an existing directory as trusted.
Codex was re-reviewed on 2026-10-29 for 0.165.0. Each archive's `sha256sum`
matched the `digest` GitHub publishes for that release asset. The installer
accepts a Codex archive only when `tar -tzf` prints exactly the entries in
`codex-package.listing`. Both architectures share that listing. 0.165.0 dropped
the bundled `codex-resources/zsh/` and added `codex-resources/voice/`, and the
archives grew past 128 MiB, so `CODEX_*_MAX_BYTES` is 256 MiB. To bump Codex,
update `installers.conf`, regenerate the listing with `tar -tzf ARTIFACT`, and
run `tests/setup/package-provenance-contract`.
## Panama bootstrap ## Panama bootstrap
The public desktop and server commands use the same committed `boot` blob: The public desktop and server commands use the same committed `boot` blob:
setup/provenance/codex-package.listing
+51
View File
@@ -0,0 +1,51 @@
bin/
bin/codex
bin/codex-code-mode-host
codex-package.json
codex-path/
codex-path/rg
codex-resources/
codex-resources/bwrap
codex-resources/voice/
codex-resources/voice/NOTICE.md
codex-resources/voice/bin/
codex-resources/voice/bin/codex-voice-host
codex-resources/voice/lib/
codex-resources/voice/lib/gstreamer-1.0/
codex-resources/voice/lib/gstreamer-1.0/libgstapp.so
codex-resources/voice/lib/gstreamer-1.0/libgstaudioconvert.so
codex-resources/voice/lib/gstreamer-1.0/libgstaudioresample.so
codex-resources/voice/lib/gstreamer-1.0/libgstcoreelements.so
codex-resources/voice/lib/gstreamer-1.0/libgstopus.so
codex-resources/voice/lib/gstreamer-1.0/libgstrtp.so
codex-resources/voice/lib/gstreamer-1.0/libgstrtpmanager.so
codex-resources/voice/lib/libffi.so.8
codex-resources/voice/lib/libgio-2.0.so.0
codex-resources/voice/lib/libglib-2.0.so.0
codex-resources/voice/lib/libgmodule-2.0.so.0
codex-resources/voice/lib/libgobject-2.0.so.0
codex-resources/voice/lib/libgstallocators-1.0.so.0
codex-resources/voice/lib/libgstapp-1.0.so.0
codex-resources/voice/lib/libgstaudio-1.0.so.0
codex-resources/voice/lib/libgstbase-1.0.so.0
codex-resources/voice/lib/libgstnet-1.0.so.0
codex-resources/voice/lib/libgstpbutils-1.0.so.0
codex-resources/voice/lib/libgstreamer-1.0.so.0
codex-resources/voice/lib/libgstrtp-1.0.so.0
codex-resources/voice/lib/libgsttag-1.0.so.0
codex-resources/voice/lib/libgstvideo-1.0.so.0
codex-resources/voice/lib/libintl.so.8
codex-resources/voice/lib/libopus.so.0
codex-resources/voice/lib/libpcre2-8.so.0
codex-resources/voice/lib/libz.so.1
codex-resources/voice/licenses/
codex-resources/voice/licenses/LGPL-2.1.txt
codex-resources/voice/licenses/Opus.txt
codex-resources/voice/licenses/PCRE2.md
codex-resources/voice/licenses/libffi.txt
codex-resources/voice/licenses/proxy-libintl.txt
codex-resources/voice/licenses/sljit.txt
codex-resources/voice/licenses/zlib.txt
codex-resources/voice/manifest.json
codex-resources/voice/runtime.json
codex-resources/voice/sources.json
setup/provenance/installers.conf
+9 -9
View File
@@ -16,15 +16,15 @@ NODE_AARCH64_URL=https://nodejs.org/dist/v24.20.0/node-v24.20.0-linux-arm64.tar.
NODE_AARCH64_SHA256=5f4ddab610c1ab2016b3c227cebdbf6d9495161487e4739c7b90090595f465f7 NODE_AARCH64_SHA256=5f4ddab610c1ab2016b3c227cebdbf6d9495161487e4739c7b90090595f465f7
NODE_AARCH64_BINARY_SHA256=23a5637c2470fde09fcc1acc77c1b92e04e3d7e3e6e80ff7df6f5831958d1477 NODE_AARCH64_BINARY_SHA256=23a5637c2470fde09fcc1acc77c1b92e04e3d7e3e6e80ff7df6f5831958d1477
NODE_AARCH64_MAX_BYTES=67108864 NODE_AARCH64_MAX_BYTES=67108864
CODEX_VERSION=0.150.1 CODEX_VERSION=0.165.0
CODEX_X86_64_URL=https://github.com/openai/codex/releases/download/rust-v0.150.1/codex-package-x86_64-unknown-linux-musl.tar.gz CODEX_X86_64_URL=https://github.com/openai/codex/releases/download/rust-v0.165.0/codex-package-x86_64-unknown-linux-musl.tar.gz
CODEX_X86_64_SHA256=00aba704f029f6dc0d948be407a756e0c97cc840132fd691353b2c6b0a505b17 CODEX_X86_64_SHA256=e97c4463d7f146692a955d7b0e1c8cf48f97cd4d616cd45c5dcab2e8d9743316
CODEX_X86_64_BINARY_SHA256=abf1bb1643a79f73aa78ee627e111e02d4f8c98f25813a0cf6ce277709664386 CODEX_X86_64_BINARY_SHA256=c06a67fd8ac76508dc78bd99ce20c9f317b8d568beda59485f3f4134df9962d5
CODEX_X86_64_MAX_BYTES=134217728 CODEX_X86_64_MAX_BYTES=268435456
CODEX_AARCH64_URL=https://github.com/openai/codex/releases/download/rust-v0.150.1/codex-package-aarch64-unknown-linux-musl.tar.gz CODEX_AARCH64_URL=https://github.com/openai/codex/releases/download/rust-v0.165.0/codex-package-aarch64-unknown-linux-musl.tar.gz
CODEX_AARCH64_SHA256=1ecac3f87823efb98153233b076ea3d6e34a7a8cebe43c5285dc5f79e1514639 CODEX_AARCH64_SHA256=c8b2844fdef57498572db960344aee8c836ce9f75c203379da0a9c3a334fc3b7
CODEX_AARCH64_BINARY_SHA256=7a49aabe11fd95a1c968d79e16b5f1b17c3219002c5f7129d467f415f8460feb CODEX_AARCH64_BINARY_SHA256=b32ece31af06440da980b733fb8fefdd1f193439595fda84096f1caaceec543f
CODEX_AARCH64_MAX_BYTES=134217728 CODEX_AARCH64_MAX_BYTES=268435456
RUSTDESK_VERSION=1.4.9 RUSTDESK_VERSION=1.4.9
RUSTDESK_X86_64_URL=https://github.com/rustdesk/rustdesk/releases/download/1.4.9/rustdesk-1.4.9-0.x86_64.rpm RUSTDESK_X86_64_URL=https://github.com/rustdesk/rustdesk/releases/download/1.4.9/rustdesk-1.4.9-0.x86_64.rpm
RUSTDESK_X86_64_SHA256=eb1b053ac5b2f774f2271f7fbbfd2ea475899f7a55135c5e172bc54b9388f108 RUSTDESK_X86_64_SHA256=eb1b053ac5b2f774f2271f7fbbfd2ea475899f7a55135c5e172bc54b9388f108
setup/scripts/install-packages
+3 -1
View File
@@ -452,7 +452,9 @@ _install_codex() (
return 1 return 1
fi fi
listing="$(tar -tzf "$archive")" || { rm -rf -- "$stage"; return 1; } listing="$(tar -tzf "$archive")" || { rm -rf -- "$stage"; return 1; }
expected_listing=$'bin/\nbin/codex\nbin/codex-code-mode-host\ncodex-package.json\ncodex-path/\ncodex-path/rg\ncodex-resources/\ncodex-resources/bwrap\ncodex-resources/zsh/\ncodex-resources/zsh/bin/\ncodex-resources/zsh/bin/zsh' # The reviewed archive layout lives beside installers.conf and changes with it.
expected_listing="$(<"$PANAMA_PATH/setup/provenance/codex-package.listing")" \
|| { rm -rf -- "$stage"; return 1; }
[[ "$listing" == "$expected_listing" ]] || { rm -rf -- "$stage"; return 1; } [[ "$listing" == "$expected_listing" ]] || { rm -rf -- "$stage"; return 1; }
while IFS= read -r member; do while IFS= read -r member; do
_archive_path_is_safe "$member" || { rm -rf -- "$stage"; return 1; } _archive_path_is_safe "$member" || { rm -rf -- "$stage"; return 1; }
tests/setup/package-provenance-contract
+50 -51
View File
@@ -306,11 +306,11 @@ for reviewed_value in \
'BUN_X86_64_BINARY_SHA256 33d56b070be6a9e3da0ab013038b43d1645d0534ca811ecdba4472599117eb4b' \ 'BUN_X86_64_BINARY_SHA256 33d56b070be6a9e3da0ab013038b43d1645d0534ca811ecdba4472599117eb4b' \
'BUN_AARCH64_SHA256 4b1a332ee861983eb93bcfe6f770fff94e3e31b2c388bdaea3c8ed35e58eed0e' \ 'BUN_AARCH64_SHA256 4b1a332ee861983eb93bcfe6f770fff94e3e31b2c388bdaea3c8ed35e58eed0e' \
'BUN_AARCH64_BINARY_SHA256 086c4121c8738a8e0f5ed730e8a461bc3973b4444e372ddb77aef9a747fa2ae9' \ 'BUN_AARCH64_BINARY_SHA256 086c4121c8738a8e0f5ed730e8a461bc3973b4444e372ddb77aef9a747fa2ae9' \
'CODEX_VERSION 0.150.1' \ 'CODEX_VERSION 0.165.0' \
'CODEX_X86_64_SHA256 00aba704f029f6dc0d948be407a756e0c97cc840132fd691353b2c6b0a505b17' \ 'CODEX_X86_64_SHA256 e97c4463d7f146692a955d7b0e1c8cf48f97cd4d616cd45c5dcab2e8d9743316' \
'CODEX_X86_64_BINARY_SHA256 abf1bb1643a79f73aa78ee627e111e02d4f8c98f25813a0cf6ce277709664386' \ 'CODEX_X86_64_BINARY_SHA256 c06a67fd8ac76508dc78bd99ce20c9f317b8d568beda59485f3f4134df9962d5' \
'CODEX_AARCH64_SHA256 1ecac3f87823efb98153233b076ea3d6e34a7a8cebe43c5285dc5f79e1514639' \ 'CODEX_AARCH64_SHA256 c8b2844fdef57498572db960344aee8c836ce9f75c203379da0a9c3a334fc3b7' \
'CODEX_AARCH64_BINARY_SHA256 7a49aabe11fd95a1c968d79e16b5f1b17c3219002c5f7129d467f415f8460feb' \ 'CODEX_AARCH64_BINARY_SHA256 b32ece31af06440da980b733fb8fefdd1f193439595fda84096f1caaceec543f' \
'RUSTDESK_VERSION 1.4.9' \ 'RUSTDESK_VERSION 1.4.9' \
'RUSTDESK_X86_64_SHA256 eb1b053ac5b2f774f2271f7fbbfd2ea475899f7a55135c5e172bc54b9388f108'; do 'RUSTDESK_X86_64_SHA256 eb1b053ac5b2f774f2271f7fbbfd2ea475899f7a55135c5e172bc54b9388f108'; do
read -r name expected <<<"$reviewed_value" read -r name expected <<<"$reviewed_value"
@@ -373,6 +373,7 @@ cp "$repo_dir/setup/lib/artifact-provenance" "$repo_dir/setup/lib/chatgpt-packag
"$installer_fixture/setup/lib/" "$installer_fixture/setup/lib/"
cp "$config" "$installer_fixture/setup/provenance/installers.conf" cp "$config" "$installer_fixture/setup/provenance/installers.conf"
cp "$repo_dir"/setup/provenance/keys/*.asc "$installer_fixture/setup/provenance/keys/" cp "$repo_dir"/setup/provenance/keys/*.asc "$installer_fixture/setup/provenance/keys/"
cp "$repo_dir/setup/provenance/codex-package.listing" "$installer_fixture/setup/provenance/"
sed '/^# --- The server path/,$d' "$repo_dir/setup/scripts/install-packages" \ sed '/^# --- The server path/,$d' "$repo_dir/setup/scripts/install-packages" \
> "$installer_fixture/setup/scripts/install-packages" > "$installer_fixture/setup/scripts/install-packages"
@@ -401,26 +402,23 @@ for arch_spec in \
"$bun_top/" "$bun_top/bun") "$bun_top/" "$bun_top/bun")
rm -rf -- "$artifact_root/build/$bun_top" rm -rf -- "$artifact_root/build/$bun_top"
mkdir -p "$artifact_root/build/bin" "$artifact_root/build/codex-path" \ # Build the fixture from the reviewed listing so it always has the exact
"$artifact_root/build/codex-resources/zsh/bin" # layout the installer accepts.
printf '#!/usr/bin/env bash\n# fixture %s\nprintf "codex-cli 0.150.1\\n"\n' "$machine" \ mapfile -t codex_entries < "$repo_dir/setup/provenance/codex-package.listing"
for entry in "${codex_entries[@]}"; do
if [[ "$entry" == */ ]]; then
mkdir -p "$artifact_root/build/$entry"
else
printf '#!/usr/bin/env bash\nprintf "package resource\\n"\n' \
> "$artifact_root/build/$entry"
chmod +x "$artifact_root/build/$entry"
fi
done
printf '#!/usr/bin/env bash\n# fixture %s\nprintf "codex-cli 0.165.0\\n"\n' "$machine" \
> "$artifact_root/build/bin/codex" > "$artifact_root/build/bin/codex"
cp "$artifact_root/build/bin/codex" "$artifact_root/codex-$machine.bin" cp "$artifact_root/build/bin/codex" "$artifact_root/codex-$machine.bin"
printf '#!/usr/bin/env bash\nprintf "code mode host\\n"\n' \
> "$artifact_root/build/bin/codex-code-mode-host"
printf '{"target":"%s"}\n' "$machine" > "$artifact_root/build/codex-package.json"
for package_binary in codex-path/rg codex-resources/bwrap codex-resources/zsh/bin/zsh; do
printf '#!/usr/bin/env bash\nprintf "package resource\\n"\n' \
> "$artifact_root/build/$package_binary"
done
chmod +x "$artifact_root/build/bin/codex" \
"$artifact_root/build/bin/codex-code-mode-host" \
"$artifact_root/build/codex-path/rg" "$artifact_root/build/codex-resources/bwrap" \
"$artifact_root/build/codex-resources/zsh/bin/zsh"
tar -C "$artifact_root/build" --no-recursion -czf "$artifact_root/codex-$machine.tar.gz" \ tar -C "$artifact_root/build" --no-recursion -czf "$artifact_root/codex-$machine.tar.gz" \
bin/ bin/codex bin/codex-code-mode-host codex-package.json \ "${codex_entries[@]}"
codex-path/ codex-path/rg codex-resources/ codex-resources/bwrap \
codex-resources/zsh/ codex-resources/zsh/bin/ codex-resources/zsh/bin/zsh
rm -rf -- "$artifact_root/build/bin" "$artifact_root/build/codex-path" \ rm -rf -- "$artifact_root/build/bin" "$artifact_root/build/codex-path" \
"$artifact_root/build/codex-resources" "$artifact_root/build/codex-resources"
rm -f -- "$artifact_root/build/codex-package.json" rm -f -- "$artifact_root/build/codex-package.json"
@@ -448,7 +446,7 @@ for destination, directory_type, entry_type, content in (
PY PY
mkdir -p "$artifact_root/build/wrong-node/bin" "$artifact_root/build/wrong-codex" mkdir -p "$artifact_root/build/wrong-node/bin" "$artifact_root/build/wrong-codex"
printf '#!/usr/bin/env bash\nprintf "v24.20.0\\n"\n' > "$artifact_root/build/wrong-node/bin/node" printf '#!/usr/bin/env bash\nprintf "v24.20.0\\n"\n' > "$artifact_root/build/wrong-node/bin/node"
printf '#!/usr/bin/env bash\nprintf "codex-cli 0.150.1\\n"\n' > "$artifact_root/build/wrong-codex/codex" printf '#!/usr/bin/env bash\nprintf "codex-cli 0.165.0\\n"\n' > "$artifact_root/build/wrong-codex/codex"
chmod +x "$artifact_root/build/wrong-node/bin/node" "$artifact_root/build/wrong-codex/codex" chmod +x "$artifact_root/build/wrong-node/bin/node" "$artifact_root/build/wrong-codex/codex"
tar -C "$artifact_root/build" -cJf "$artifact_root/node-bad.tar.xz" wrong-node tar -C "$artifact_root/build" -cJf "$artifact_root/node-bad.tar.xz" wrong-node
tar -C "$artifact_root/build" -czf "$artifact_root/codex-bad.tar.gz" wrong-codex/codex tar -C "$artifact_root/build" -czf "$artifact_root/codex-bad.tar.gz" wrong-codex/codex
@@ -461,7 +459,7 @@ chmod +x "$artifact_root/build/bun-linux-x64/bun"
cp "$test_tmp/unsigned-fixture.rpm" "$artifact_root/rustdesk.rpm" cp "$test_tmp/unsigned-fixture.rpm" "$artifact_root/rustdesk.rpm"
printf '#!/usr/bin/env bash\nprintf "executed\\n" > "$OUTSIDE_EXECUTED"\nprintf "v24.20.0\\n"\n' \ printf '#!/usr/bin/env bash\nprintf "executed\\n" > "$OUTSIDE_EXECUTED"\nprintf "v24.20.0\\n"\n' \
> "$artifact_root/outside-node" > "$artifact_root/outside-node"
printf '#!/usr/bin/env bash\nprintf "executed\\n" > "$OUTSIDE_EXECUTED"\nprintf "codex-cli 0.150.1\\n"\n' \ printf '#!/usr/bin/env bash\nprintf "executed\\n" > "$OUTSIDE_EXECUTED"\nprintf "codex-cli 0.165.0\\n"\n' \
> "$artifact_root/outside-codex" > "$artifact_root/outside-codex"
chmod +x "$artifact_root/outside-node" "$artifact_root/outside-codex" chmod +x "$artifact_root/outside-node" "$artifact_root/outside-codex"
node_escape_top='node-v24.20.0-linux-x64' node_escape_top='node-v24.20.0-linux-x64'
@@ -581,7 +579,7 @@ set -euo pipefail
destination="${!#}" destination="${!#}"
if [[ "${STUB_SIGNAL_PHASE:-}" == activation ]]; then if [[ "${STUB_SIGNAL_PHASE:-}" == activation ]]; then
case "$destination" in case "$destination" in
*/.nvm/versions/node/v24.20.0|*/.bun/versions/1.4.0|*/.local/lib/panama/codex/0.150.1) */.nvm/versions/node/v24.20.0|*/.bun/versions/1.4.0|*/.local/lib/panama/codex/0.165.0)
printf 'signal:activation\n' >> "$COMMAND_LOG" printf 'signal:activation\n' >> "$COMMAND_LOG"
pgid="$(ps -o pgid= -p $$ | tr -d ' ')" pgid="$(ps -o pgid= -p $$ | tr -d ' ')"
kill -TERM -- "-$pgid" kill -TERM -- "-$pgid"
@@ -601,7 +599,7 @@ fi
case "${STUB_LATE_COLLISION:-}:$destination" in case "${STUB_LATE_COLLISION:-}:$destination" in
Node:*/.nvm/versions/node/v24.20.0|\ Node:*/.nvm/versions/node/v24.20.0|\
Bun:*/.bun/versions/1.4.0|\ Bun:*/.bun/versions/1.4.0|\
Codex:*/.local/lib/panama/codex/0.150.1) Codex:*/.local/lib/panama/codex/0.165.0)
if [[ ! -e "$destination" ]]; then if [[ ! -e "$destination" ]]; then
mkdir -p -- "$destination" mkdir -p -- "$destination"
printf 'preserved collision\n' > "$destination/collision-marker" printf 'preserved collision\n' > "$destination/collision-marker"
@@ -708,7 +706,7 @@ if [[ "${STUB_TRAVERSAL_ERROR:-}" == Node ]] \
exit 0 exit 0
elif [[ "${STUB_TRAVERSAL_ERROR:-}" == Codex ]] \ elif [[ "${STUB_TRAVERSAL_ERROR:-}" == Codex ]] \
&& cmp -s "$file" "$ARTIFACT_ROOT/outside-codex"; then && cmp -s "$file" "$ARTIFACT_ROOT/outside-codex"; then
printf '%s %s\n' abf1bb1643a79f73aa78ee627e111e02d4f8c98f25813a0cf6ce277709664386 "$file" printf '%s %s\n' c06a67fd8ac76508dc78bd99ce20c9f317b8d568beda59485f3f4134df9962d5 "$file"
exit 0 exit 0
fi fi
for spec in \ for spec in \
@@ -722,9 +720,9 @@ for spec in \
'bun-symlink.zip 2d03fb5fb83ac8b567aca0a281b2ce1a1a19d488f56c2968d88c3f25e92fe452' \ 'bun-symlink.zip 2d03fb5fb83ac8b567aca0a281b2ce1a1a19d488f56c2968d88c3f25e92fe452' \
'bun-special.zip 2d03fb5fb83ac8b567aca0a281b2ce1a1a19d488f56c2968d88c3f25e92fe452' \ 'bun-special.zip 2d03fb5fb83ac8b567aca0a281b2ce1a1a19d488f56c2968d88c3f25e92fe452' \
'bun-directory.zip 2d03fb5fb83ac8b567aca0a281b2ce1a1a19d488f56c2968d88c3f25e92fe452' \ 'bun-directory.zip 2d03fb5fb83ac8b567aca0a281b2ce1a1a19d488f56c2968d88c3f25e92fe452' \
'codex-x86_64.tar.gz 00aba704f029f6dc0d948be407a756e0c97cc840132fd691353b2c6b0a505b17' \ 'codex-x86_64.tar.gz e97c4463d7f146692a955d7b0e1c8cf48f97cd4d616cd45c5dcab2e8d9743316' \
'codex-aarch64.tar.gz 1ecac3f87823efb98153233b076ea3d6e34a7a8cebe43c5285dc5f79e1514639' \ 'codex-aarch64.tar.gz c8b2844fdef57498572db960344aee8c836ce9f75c203379da0a9c3a334fc3b7' \
'codex-bad.tar.gz 00aba704f029f6dc0d948be407a756e0c97cc840132fd691353b2c6b0a505b17' \ 'codex-bad.tar.gz e97c4463d7f146692a955d7b0e1c8cf48f97cd4d616cd45c5dcab2e8d9743316' \
'rustdesk.rpm eb1b053ac5b2f774f2271f7fbbfd2ea475899f7a55135c5e172bc54b9388f108'; do 'rustdesk.rpm eb1b053ac5b2f774f2271f7fbbfd2ea475899f7a55135c5e172bc54b9388f108'; do
read -r fixture digest <<<"$spec" read -r fixture digest <<<"$spec"
if cmp -s "$file" "$ARTIFACT_ROOT/$fixture"; then if cmp -s "$file" "$ARTIFACT_ROOT/$fixture"; then
@@ -740,8 +738,8 @@ for binary_spec in \
'node-aarch64.bin 23a5637c2470fde09fcc1acc77c1b92e04e3d7e3e6e80ff7df6f5831958d1477' \ 'node-aarch64.bin 23a5637c2470fde09fcc1acc77c1b92e04e3d7e3e6e80ff7df6f5831958d1477' \
'bun-x86_64.bin 33d56b070be6a9e3da0ab013038b43d1645d0534ca811ecdba4472599117eb4b' \ 'bun-x86_64.bin 33d56b070be6a9e3da0ab013038b43d1645d0534ca811ecdba4472599117eb4b' \
'bun-aarch64.bin 086c4121c8738a8e0f5ed730e8a461bc3973b4444e372ddb77aef9a747fa2ae9' \ 'bun-aarch64.bin 086c4121c8738a8e0f5ed730e8a461bc3973b4444e372ddb77aef9a747fa2ae9' \
'codex-x86_64.bin abf1bb1643a79f73aa78ee627e111e02d4f8c98f25813a0cf6ce277709664386' \ 'codex-x86_64.bin c06a67fd8ac76508dc78bd99ce20c9f317b8d568beda59485f3f4134df9962d5' \
'codex-aarch64.bin 7a49aabe11fd95a1c968d79e16b5f1b17c3219002c5f7129d467f415f8460feb'; do 'codex-aarch64.bin b32ece31af06440da980b733fb8fefdd1f193439595fda84096f1caaceec543f'; do
read -r fixture digest <<<"$binary_spec" read -r fixture digest <<<"$binary_spec"
if cmp -s "$file" "$ARTIFACT_ROOT/$fixture"; then if cmp -s "$file" "$ARTIFACT_ROOT/$fixture"; then
printf '%s %s\n' "$digest" "$file" printf '%s %s\n' "$digest" "$file"
@@ -1026,6 +1024,7 @@ STUB
reset_installer_fixture() { reset_installer_fixture() {
cp "$config" "$installer_fixture/setup/provenance/installers.conf" cp "$config" "$installer_fixture/setup/provenance/installers.conf"
cp "$repo_dir"/setup/provenance/keys/*.asc "$installer_fixture/setup/provenance/keys/" cp "$repo_dir"/setup/provenance/keys/*.asc "$installer_fixture/setup/provenance/keys/"
cp "$repo_dir/setup/provenance/codex-package.listing" "$installer_fixture/setup/provenance/"
} }
write_flathub_descriptor() { write_flathub_descriptor() {
@@ -1086,11 +1085,11 @@ run_installer_function() {
ln -s "$case_root/home/.bun/versions/1.4.0/bin/bun" "$case_root/home/.bun/bin/bun" ln -s "$case_root/home/.bun/versions/1.4.0/bin/bun" "$case_root/home/.bun/bin/bun"
;; ;;
Codex) Codex)
mkdir -p "$case_root/home/.local/lib/panama/codex/0.150.1" "$case_root/home/.local/bin" mkdir -p "$case_root/home/.local/lib/panama/codex/0.165.0" "$case_root/home/.local/bin"
printf '#!/usr/bin/env bash\nprintf "codex-cli 0.150.1\\n"\n' \ printf '#!/usr/bin/env bash\nprintf "codex-cli 0.165.0\\n"\n' \
> "$case_root/home/.local/lib/panama/codex/0.150.1/codex" > "$case_root/home/.local/lib/panama/codex/0.165.0/codex"
chmod +x "$case_root/home/.local/lib/panama/codex/0.150.1/codex" chmod +x "$case_root/home/.local/lib/panama/codex/0.165.0/codex"
ln -s "$case_root/home/.local/lib/panama/codex/0.150.1/codex" \ ln -s "$case_root/home/.local/lib/panama/codex/0.165.0/codex" \
"$case_root/home/.local/bin/codex" "$case_root/home/.local/bin/codex"
;; ;;
esac esac
@@ -1108,10 +1107,10 @@ run_installer_function() {
chmod +x "$case_root/home/.bun/versions/1.4.0/bin/bun" chmod +x "$case_root/home/.bun/versions/1.4.0/bin/bun"
;; ;;
Codex) Codex)
mkdir -p "$case_root/home/.local/lib/panama/codex/0.150.1" mkdir -p "$case_root/home/.local/lib/panama/codex/0.165.0"
printf '#!/usr/bin/env bash\nprintf "codex-cli 10.150.10\\n"\n' \ printf '#!/usr/bin/env bash\nprintf "codex-cli 10.165.10\\n"\n' \
> "$case_root/home/.local/lib/panama/codex/0.150.1/codex" > "$case_root/home/.local/lib/panama/codex/0.165.0/codex"
chmod +x "$case_root/home/.local/lib/panama/codex/0.150.1/codex" chmod +x "$case_root/home/.local/lib/panama/codex/0.165.0/codex"
;; ;;
esac esac
write_flathub_descriptor "$case_root/flathub.flatpakrepo" \ write_flathub_descriptor "$case_root/flathub.flatpakrepo" \
@@ -1308,8 +1307,8 @@ for runtime_case in \
'node-aarch64 aarch64 install_node Node https://nodejs.org/dist/v24.20.0/node-v24.20.0-linux-arm64.tar.xz 67108864' \ 'node-aarch64 aarch64 install_node Node https://nodejs.org/dist/v24.20.0/node-v24.20.0-linux-arm64.tar.xz 67108864' \
'bun-x86_64 x86_64 install_bun Bun https://github.com/oven-sh/bun/releases/download/bun-v1.4.0/bun-linux-x64.zip 67108864' \ 'bun-x86_64 x86_64 install_bun Bun https://github.com/oven-sh/bun/releases/download/bun-v1.4.0/bun-linux-x64.zip 67108864' \
'bun-aarch64 aarch64 install_bun Bun https://github.com/oven-sh/bun/releases/download/bun-v1.4.0/bun-linux-aarch64.zip 67108864' \ 'bun-aarch64 aarch64 install_bun Bun https://github.com/oven-sh/bun/releases/download/bun-v1.4.0/bun-linux-aarch64.zip 67108864' \
'codex-x86_64 x86_64 install_codex Codex https://github.com/openai/codex/releases/download/rust-v0.150.1/codex-package-x86_64-unknown-linux-musl.tar.gz 134217728' \ 'codex-x86_64 x86_64 install_codex Codex https://github.com/openai/codex/releases/download/rust-v0.165.0/codex-package-x86_64-unknown-linux-musl.tar.gz 268435456' \
'codex-aarch64 aarch64 install_codex Codex https://github.com/openai/codex/releases/download/rust-v0.150.1/codex-package-aarch64-unknown-linux-musl.tar.gz 134217728'; do 'codex-aarch64 aarch64 install_codex Codex https://github.com/openai/codex/releases/download/rust-v0.165.0/codex-package-aarch64-unknown-linux-musl.tar.gz 268435456'; do
read -r name arch function_name component url max_bytes <<<"$runtime_case" read -r name arch function_name component url max_bytes <<<"$runtime_case"
reset_installer_fixture reset_installer_fixture
if ! STUB_ARCH="$arch" run_installer_function "$name" "$function_name"; then if ! STUB_ARCH="$arch" run_installer_function "$name" "$function_name"; then
@@ -1329,8 +1328,8 @@ for receipt_spec in \
'node-aarch64 .nvm/versions/node/v24.20.0 5f4ddab610c1ab2016b3c227cebdbf6d9495161487e4739c7b90090595f465f7 23a5637c2470fde09fcc1acc77c1b92e04e3d7e3e6e80ff7df6f5831958d1477' \ 'node-aarch64 .nvm/versions/node/v24.20.0 5f4ddab610c1ab2016b3c227cebdbf6d9495161487e4739c7b90090595f465f7 23a5637c2470fde09fcc1acc77c1b92e04e3d7e3e6e80ff7df6f5831958d1477' \
'bun-x86_64 .bun/versions/1.4.0 2d03fb5fb83ac8b567aca0a281b2ce1a1a19d488f56c2968d88c3f25e92fe452 33d56b070be6a9e3da0ab013038b43d1645d0534ca811ecdba4472599117eb4b' \ 'bun-x86_64 .bun/versions/1.4.0 2d03fb5fb83ac8b567aca0a281b2ce1a1a19d488f56c2968d88c3f25e92fe452 33d56b070be6a9e3da0ab013038b43d1645d0534ca811ecdba4472599117eb4b' \
'bun-aarch64 .bun/versions/1.4.0 4b1a332ee861983eb93bcfe6f770fff94e3e31b2c388bdaea3c8ed35e58eed0e 086c4121c8738a8e0f5ed730e8a461bc3973b4444e372ddb77aef9a747fa2ae9' \ 'bun-aarch64 .bun/versions/1.4.0 4b1a332ee861983eb93bcfe6f770fff94e3e31b2c388bdaea3c8ed35e58eed0e 086c4121c8738a8e0f5ed730e8a461bc3973b4444e372ddb77aef9a747fa2ae9' \
'codex-x86_64 .local/lib/panama/codex/0.150.1 00aba704f029f6dc0d948be407a756e0c97cc840132fd691353b2c6b0a505b17 abf1bb1643a79f73aa78ee627e111e02d4f8c98f25813a0cf6ce277709664386' \ 'codex-x86_64 .local/lib/panama/codex/0.165.0 e97c4463d7f146692a955d7b0e1c8cf48f97cd4d616cd45c5dcab2e8d9743316 c06a67fd8ac76508dc78bd99ce20c9f317b8d568beda59485f3f4134df9962d5' \
'codex-aarch64 .local/lib/panama/codex/0.150.1 1ecac3f87823efb98153233b076ea3d6e34a7a8cebe43c5285dc5f79e1514639 7a49aabe11fd95a1c968d79e16b5f1b17c3219002c5f7129d467f415f8460feb'; do 'codex-aarch64 .local/lib/panama/codex/0.165.0 c8b2844fdef57498572db960344aee8c836ce9f75c203379da0a9c3a334fc3b7 b32ece31af06440da980b733fb8fefdd1f193439595fda84096f1caaceec543f'; do
read -r name target_relative artifact_digest binary_digest <<<"$receipt_spec" read -r name target_relative artifact_digest binary_digest <<<"$receipt_spec"
assert_file_bytes "$test_tmp/cases/$name/home/$target_relative/.panama-provenance" \ assert_file_bytes "$test_tmp/cases/$name/home/$target_relative/.panama-provenance" \
"$(printf 'schema=1\nartifact_sha256=%s\nbinary_sha256=%s\n' \ "$(printf 'schema=1\nartifact_sha256=%s\nbinary_sha256=%s\n' \
@@ -1365,9 +1364,9 @@ grep -qFx 'nvm:alias default 24.20.0' "$test_tmp/cases/node-x86_64/commands.log"
"$test_tmp/cases/bun-x86_64/home/.bun/versions/1.4.0/bin/bun" ]] \ "$test_tmp/cases/bun-x86_64/home/.bun/versions/1.4.0/bin/bun" ]] \
|| fail 'Bun did not atomically activate the reviewed version path' || fail 'Bun did not atomically activate the reviewed version path'
[[ "$($test_tmp/cases/codex-x86_64/home/.local/bin/codex --version)" == \ [[ "$($test_tmp/cases/codex-x86_64/home/.local/bin/codex --version)" == \
'codex-cli 0.150.1' ]] || fail 'x86_64 Codex activation has the wrong version' 'codex-cli 0.165.0' ]] || fail 'x86_64 Codex activation has the wrong version'
[[ "$(readlink "$test_tmp/cases/codex-x86_64/home/.local/bin/codex")" == \ [[ "$(readlink "$test_tmp/cases/codex-x86_64/home/.local/bin/codex")" == \
"$test_tmp/cases/codex-x86_64/home/.local/lib/panama/codex/0.150.1/codex" ]] \ "$test_tmp/cases/codex-x86_64/home/.local/lib/panama/codex/0.165.0/codex" ]] \
|| fail 'Codex did not atomically activate the reviewed version path' || fail 'Codex did not atomically activate the reviewed version path'
# Unsupported CPUs stop before curl. RustDesk's reviewed RPM is x86_64-only, # Unsupported CPUs stop before curl. RustDesk's reviewed RPM is x86_64-only,
@@ -1391,7 +1390,7 @@ done
for component_spec in \ for component_spec in \
'Node install_node .nvm/versions/node/v24.20.0' \ 'Node install_node .nvm/versions/node/v24.20.0' \
'Bun install_bun .bun/versions/1.4.0' \ 'Bun install_bun .bun/versions/1.4.0' \
'Codex install_codex .local/lib/panama/codex/0.150.1'; do 'Codex install_codex .local/lib/panama/codex/0.165.0'; do
read -r component function_name target_relative <<<"$component_spec" read -r component function_name target_relative <<<"$component_spec"
name="${component,,}-late-collision" name="${component,,}-late-collision"
reset_installer_fixture reset_installer_fixture
@@ -1503,7 +1502,7 @@ done
# Successful updates keep the old version directory and switch only the active # Successful updates keep the old version directory and switch only the active
# symlink after the replacement binary has passed its version check. # symlink after the replacement binary has passed its version check.
for component_spec in 'Bun install_bun .bun/bin/bun .bun/versions/1.4.0/bin/bun' \ for component_spec in 'Bun install_bun .bun/bin/bun .bun/versions/1.4.0/bin/bun' \
'Codex install_codex .local/bin/codex .local/lib/panama/codex/0.150.1/codex'; do 'Codex install_codex .local/bin/codex .local/lib/panama/codex/0.165.0/codex'; do
read -r component function_name active_relative target_relative <<<"$component_spec" read -r component function_name active_relative target_relative <<<"$component_spec"
name="${component,,}-atomic-update" name="${component,,}-atomic-update"
reset_installer_fixture reset_installer_fixture
@@ -1525,7 +1524,7 @@ done
for tamper_spec in \ for tamper_spec in \
'Node install_node .nvm/versions/node/v24.20.0 bin/node v24.20.0' \ 'Node install_node .nvm/versions/node/v24.20.0 bin/node v24.20.0' \
'Bun install_bun .bun/versions/1.4.0 bin/bun 1.4.0' \ 'Bun install_bun .bun/versions/1.4.0 bin/bun 1.4.0' \
'Codex install_codex .local/lib/panama/codex/0.150.1 codex codex-cli_0.150.1'; do 'Codex install_codex .local/lib/panama/codex/0.165.0 codex codex-cli_0.165.0'; do
read -r component function_name target_relative binary_relative version_text <<<"$tamper_spec" read -r component function_name target_relative binary_relative version_text <<<"$tamper_spec"
for tamper_kind in receipt binary; do for tamper_kind in receipt binary; do
name="${component,,}-$tamper_kind-tamper" name="${component,,}-$tamper_kind-tamper"
@@ -1564,7 +1563,7 @@ done
for layout_case in \ for layout_case in \
'node-layout install_node Node .nvm/versions/node/v24.20.0' \ 'node-layout install_node Node .nvm/versions/node/v24.20.0' \
'bun-layout install_bun Bun .bun/versions/1.4.0' \ 'bun-layout install_bun Bun .bun/versions/1.4.0' \
'codex-layout install_codex Codex .local/lib/panama/codex/0.150.1'; do 'codex-layout install_codex Codex .local/lib/panama/codex/0.165.0'; do
read -r name function_name component relative_target <<<"$layout_case" read -r name function_name component relative_target <<<"$layout_case"
reset_installer_fixture reset_installer_fixture
STUB_BAD_LAYOUT=1 expect_failure run_installer_function "$name" "$function_name" STUB_BAD_LAYOUT=1 expect_failure run_installer_function "$name" "$function_name"