Skip to content

fix: harden release packaging verification - #1

Merged
alicankiraz1 merged 1 commit into
mainfrom
codex/release-hardening
Mar 23, 2026
Merged

fix: harden release packaging verification#1
alicankiraz1 merged 1 commit into
mainfrom
codex/release-hardening

Conversation

@alicankiraz1

Copy link
Copy Markdown
Owner

Summary

  • make release archive verification non-executing by shipping and validating a static evals/release-manifest.json
  • unify release exclusion policy across packaging, surface inspection, and archive verification
  • reject recursive nested repo-shaped trees and unsupported symlinks, and add Linux CI coverage plus regression coverage

Test Plan

  • bash scripts/static-validation.sh
  • bash scripts/package-release.sh
  • CODEX_SENTINEL_FORCE_NO_RSYNC=1 bash scripts/package-release.sh Codex-Sentinel-fallback
  • node scripts/verify-release-archive.mjs dist/Codex-Sentinel.zip
  • node scripts/verify-release-archive.mjs dist/Codex-Sentinel-fallback.zip

@alicankiraz1
alicankiraz1 merged commit 756322a into main Mar 23, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant