Add files using upload-large-folder tool

.github/actions/publish-dotslash/action.yml

@@ -0,0 +1,52 @@
+name: Publish DotSlash manifests
+description: Run the pinned upstream publisher directly on an Ubuntu runner.
+
+inputs:
+  tag:
+    description: Release tag to publish manifests for.
+    required: true
+  configs:
+    description: Newline-separated paths to DotSlash configuration files.
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Checkout DotSlash publisher
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        repository: facebook/dotslash-publish-release
+        ref: 9c9ec027515c34db9282a09a25a9cab5880b2c52 # v2
+        path: .dotslash-publish-release
+        persist-credentials: false
+
+    - name: Install uv
+      uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+      with:
+        version: "0.12.13"
+        checksum: "745765a3b6e360ad76743599ae5c42e9278c7edf8bbff9fc76d05bf2623a04dd"
+        github-token: ""
+        enable-cache: false
+
+    - name: Publish DotSlash manifests
+      shell: bash
+      env:
+        ACTION_PATH: ${{ github.action_path }}
+        RELEASE_TAG: ${{ inputs.tag }}
+        DOTSLASH_CONFIGS: ${{ inputs.configs }}
+      run: |
+        set -euo pipefail
+
+        # Ubuntu runners already provide Python and gh. Avoid rebuilding the
+        # upstream Docker image and downloading its apt dependencies per release.
+        uv venv --python "$(command -v python3)" "${RUNNER_TEMP}/dotslash-publish-release-venv"
+        python="${RUNNER_TEMP}/dotslash-publish-release-venv/bin/python"
+        uv pip install --python "$python" \
+          --require-hashes --only-binary=:all: -r "${ACTION_PATH}/requirements.txt"
+
+        while IFS= read -r config; do
+          if [[ -n "$config" ]]; then
+            "$python" .dotslash-publish-release/process_config.py \
+              --config "$config" --tag "$RELEASE_TAG" --upload
+          fi
+        done <<< "$DOTSLASH_CONFIGS"

.github/actions/publish-dotslash/requirements.txt

@@ -0,0 +1,111 @@
+# Regenerate: uv pip compile --generate-hashes --no-header --no-annotate requirements.txt
+blake3==1.0.8 \
+    --hash=sha256:003f61e8c41dd9931edddf1cc6a1bb680fb2ac0ad15493ef4a1df9adc59ce9df \
+    --hash=sha256:0171e85d56dec1219abdae5f49a0ed12cb3f86a454c29160a64fd8a8166bba37 \
+    --hash=sha256:04b95bcd6c1b61480923adc571ffab377618d170f528f6cf4f6a6fff94e3c309 \
+    --hash=sha256:0c492630d384fc4400e9860b16e09e0dbe79e960e95b237b9a1ea3f95ea3125d \
+    --hash=sha256:0eab3318ec02f8e16fe549244791ace2ada2c259332f0c77ab22cf94dfff7130 \
+    --hash=sha256:119829e13eca177f5626c43f753acc4813eb8ae414c2d70ef7571078177163c7 \
+    --hash=sha256:1257be19f2d381c868a34cc822fc7f12f817ddc49681b6d1a2790bfbda1a9865 \
+    --hash=sha256:19fc6f2b7edab8acff6895fc6e38c19bd79f4c089e21153020c75dfc7397d52d \
+    --hash=sha256:1af0e5a29aa56d4fba904452ae784740997440afd477a15e583c38338e641f41 \
+    --hash=sha256:23e181318f5a62e4e6ce7be0875b4f65543abe47fe48cc4f4e9ab8f2bf9e01c5 \
+    --hash=sha256:269f255b110840e52b6ce9db02217e39660ebad3e34ddd5bca8b8d378a77e4e1 \
+    --hash=sha256:2bacf9757e93ac376c612dc0d45931a591ea0caf5583ab93d99dd32a2905ec43 \
+    --hash=sha256:2c33dac2c6112bc23f961a7ca305c7e34702c8177040eb98d0389d13a347b9e1 \
+    --hash=sha256:2d78f06f3fb838b34c330e2987090376145cbe5944d8608a0c4779c779618f7b \
+    --hash=sha256:3168c457255b5d2a2fc356ba696996fcaff5d38284f968210d54376312107662 \
+    --hash=sha256:38209b10482c97e151681ea3e91cc7141f56adbbf4820a7d701a923124b41e6a \
+    --hash=sha256:3b5573b052777142b2cecc453d022c3f21aa4aba75011258410bb98f41c1a727 \
+    --hash=sha256:3bafdec95dfffa3f6571e529644744e280337df15ddd9728f224ba70c5779b23 \
+    --hash=sha256:3cec94ed5676821cf371e9c9d25a41b4f3ebdb5724719b31b2749653b7cc1dfa \
+    --hash=sha256:3fb83532f7456ddeb68dae1b36e1f7c52f9cb72852ac01159bbcb1a12b0f8be0 \
+    --hash=sha256:411f61cb817eb25547b91944301ccfa624ccdc69d70822866d8ad0b0e9e3ca64 \
+    --hash=sha256:421b99cdf1ff2d1bf703bc56c454f4b286fce68454dd8711abbcb5a0df90c19a \
+    --hash=sha256:444215a1e5201f8fa4e5c7352e938a7070cd33d66aeb1dd9b1103a64b6920f9e \
+    --hash=sha256:44c2815d4616fad7e2d757d121c0a11780f70ffc817547b3059b5c7e224031a7 \
+    --hash=sha256:46dc20976bd6c235959ef0246ec73420d1063c3da2839a9c87ca395cf1fd7943 \
+    --hash=sha256:497ef8096ec4ac1ffba9a66152cee3992337cebf8ea434331d8fd9ce5423d227 \
+    --hash=sha256:4b0543c57eb9d6dac9d4bced63e9f7f7b546886ac04cec8da3c3d9c8f30cbbb7 \
+    --hash=sha256:4bacaae75e98dee3b7da6c5ee3b81ee21a3352dd2477d6f1d1dbfd38cdbf158a \
+    --hash=sha256:4e02a3c499e35bf51fc15b2738aca1a76410804c877bcd914752cac4f71f052a \
+    --hash=sha256:4f54cff7f15d91dc78a63a2dd02a3dccdc932946f271e2adb4130e0b4cf608ba \
+    --hash=sha256:504d1399b7fb91dfe5c25722d2807990493185faa1917456455480c36867adb5 \
+    --hash=sha256:506a47897a11ebe8f3cdeb52f1365d6a2f83959e98ccb0c830f8f73277d4d358 \
+    --hash=sha256:511133bab85ff60ed143424ce484d08c60894ff7323f685d7a6095f43f0c85c3 \
+    --hash=sha256:513cc7f0f5a7c035812604c2c852a0c1468311345573de647e310aca4ab165ba \
+    --hash=sha256:53304b6df3f8d826850c1d977d9a69edbf3e48476b95f7cb6175ec650856a3c5 \
+    --hash=sha256:58ce8d45a5bb5326482de72ea1969a378634236186a970fef63058a5b7b8b435 \
+    --hash=sha256:5eb25bca3cee2e0dd746a214784fb36be6a43640c01c55b6b4e26196e72d076c \
+    --hash=sha256:63379be58438878eeb76ebe4f0efbeaabf42b79f2cff23b6126b7991588ced67 \
+    --hash=sha256:66ca28a673025c40db3eba21a9cac52f559f83637efa675b3f6bd8683f0415f3 \
+    --hash=sha256:67d9c42c42eb1c7aedcf901591c743266009fcf48babf6d6f8450f567cb94a84 \
+    --hash=sha256:67f1bc11bf59464ef092488c707b13dd4e872db36e25c453dfb6e0c7498df9f1 \
+    --hash=sha256:6a6eafc29e4f478d365a87d2f25782a521870c8514bb43734ac85ae9be71caf7 \
+    --hash=sha256:6ae7754c7d96e92a70a52e07c732d594cf9924d780f49fffd3a1e9235e0f5ba7 \
+    --hash=sha256:725c52c4d393c7bd1a10682df322d480734002a1389b320366c660568708846b \
+    --hash=sha256:73e0b4fa25f6e3078526a592fb38fca85ef204fd02eced6731e1cdd9396552d4 \
+    --hash=sha256:78731ce7fca46f776ae45fb5271a2a76c4a92c9687dd4337e84b2ae9a174b28f \
+    --hash=sha256:7adbbee5dd0c302218eb8acdfd82b7006930eb5798f56f79f9cca89f6f192662 \
+    --hash=sha256:7fcfe81b3ae3fb5d2e88be0d3259603ff95f0d5ed69f655c28fdaef31e49a470 \
+    --hash=sha256:83347ef28d774e84442c71fc5aa8817498753d47831a533536ead1a7ccd44a41 \
+    --hash=sha256:83605dbf43f581d8b7175b7f3bfe5388bad5a7c6ac175c9c11d669da31133f4b \
+    --hash=sha256:859cd57bac097a2cd63cb36d64c2f6f16c9edece5590f929e70157478e46dc9e \
+    --hash=sha256:88d527c247f9609dc1d45a08fd243e39f0d5300d54c57e048de24d4fa9240ebb \
+    --hash=sha256:8956bb9aec47b6c37ccce935a943588f1f5e6e2e85d43bb7cb76a574238f8a9b \
+    --hash=sha256:8f2ef8527a7a8afd99b16997d015851ccc0fe2a409082cebb980af2554e5c74c \
+    --hash=sha256:9456c829601d72852d8ba0af8dae0610f7def1d59f5942efde1e2ef93e8a8b57 \
+    --hash=sha256:94b2d4922c75174083988b8b0d2c78e72be7376ac59ab19c3e5d17a7c9c1cc0f \
+    --hash=sha256:97c076d58ee37eb5b2d8d91bb9db59c5a008fd59c71845dc57fe438aeeabaf10 \
+    --hash=sha256:98915260c378d4c45088f1e227b053834ed95aeca89336184f192489ad0dd5d4 \
+    --hash=sha256:9a8946cb6b1d2b2096daaaa89856f39887bce2b78503fa31b78173e3a86fa281 \
+    --hash=sha256:9ab5998e2abd9754819753bc2f1cf3edf82d95402bff46aeef45ed392a5468bf \
+    --hash=sha256:9c9fbdacfdeb68f7ca53bb5a7a5a593ec996eaf21155ad5b08d35e6f97e60877 \
+    --hash=sha256:9e1d70bf76c02846d0868a3d413eb6c430b76a315e12f1b2e59b5cf56c1f62a3 \
+    --hash=sha256:a2336d5b2a801a7256da21150348f41610a6c21dae885a3acb1ebbd7333d88d8 \
+    --hash=sha256:a25db3d36b55f5ed6a86470155cc749fc9c5b91c949b8d14f48658f9d960d9ec \
+    --hash=sha256:a33b9a1fb6d1d559a8e0d04b041e99419a6bb771311c774f6ff57ed7119c70ed \
+    --hash=sha256:a47939f04b89c5c6ff1e51e883e5efab1ea1bf01a02f4d208d216dddd63d0dd8 \
+    --hash=sha256:a585357d5d8774aad9ffc12435de457f9e35cde55e0dc8bc43ab590a6929e59f \
+    --hash=sha256:a5b9196a4768e5475475bdf2010dc76b2792f95805731a645196d180a7e12570 \
+    --hash=sha256:ab4e1dea4fa857944944db78e8f20d99ee2e16b2dea5a14f514fb0607753ac83 \
+    --hash=sha256:adccc3a139207e02bb7d7bb0715fe0b87069685aad5f3afff820b2f829467904 \
+    --hash=sha256:add39ffa9e5074264f12ab409cdf059bc967817644b455e3fad46139001cc108 \
+    --hash=sha256:af18817da1eb5bd65d068fb9c18235edc328a45b09025346fa65fe52b1b0c9b6 \
+    --hash=sha256:af394b50c6aa0b1b957a99453d1ee440ef67cd2d1b5669c731647dc723de8a3a \
+    --hash=sha256:b201961c6dcc7123e69fff6019298d9e4394c7e585a300e999664bca8070d83c \
+    --hash=sha256:b37f63c5952b32b5064096141b394ed17569d318637a06a2cae9bfedd852f0ef \
+    --hash=sha256:b4d672c24dc15ec617d212a338a4ca14b449829b6072d09c96c63b6e6b621aed \
+    --hash=sha256:bcb04966537777af56c1f399b35525aa70a1225816e121ff95071c33c0f7abca \
+    --hash=sha256:c2682ba10fb3b36fe8a6823be50910f1145a8a5158bc555145fadcc4afb984c3 \
+    --hash=sha256:c445eff665d21c3b3b44f864f849a2225b1164c08654beb23224a02f087b7ff1 \
+    --hash=sha256:c5bfe1a1ada3ed2c715f692ce1a3b221d7f6b4d5e6001d24774ef07de013192c \
+    --hash=sha256:c63ece266a43014cf29e772a82857cd8e90315ae3ed53e3c5204851596edd5f2 \
+    --hash=sha256:c65e373c8b47174b969ee61a89ee56922f722972eb650192845c8546df8d9db9 \
+    --hash=sha256:c7780666dc6be809b49442d6d5ce06fdbe33024a87560b58471103ec17644682 \
+    --hash=sha256:c84af132aa09abeadf9a0118c8fb26f4528f3f42c10ef8be0fcf31c478774ec4 \
+    --hash=sha256:c9ab5ef61aaa6df2f769548a071fddcacbb0f56102a9c48f40878b10ae1a2657 \
+    --hash=sha256:ca8bc7e816370118262da11783e1fdf8992f250789ae08e8182fb7c26e14ded0 \
+    --hash=sha256:d17eb6382634b3a5bc0c0e0454d5265b0becaeeadb6801ed25150b39a999d0cc \
+    --hash=sha256:d2c3151955efb09ba58cd3e1263521e15e9e3866a40d6bd3556d86fc968e8f95 \
+    --hash=sha256:d3fe26f145fcb82931d1820b55c0279f72f8f8e49450dd9d74efbfd409b28423 \
+    --hash=sha256:d8da4233984d51471bd4e4366feda1d90d781e712e0a504ea54b1f2b3577557b \
+    --hash=sha256:db54946792d2b8c6fa4be73e6e334519f13c1b52e7ff346b3e2ec8ad3eb59401 \
+    --hash=sha256:dd03ff08d1b6e4fdda1cd03826f971ae8966ef6f683a8c68aa27fb21904b5aa9 \
+    --hash=sha256:ddfc59b0176fb31168f08d5dd536e69b1f4f13b5a0f4b0c3be1003efd47f9308 \
+    --hash=sha256:e0fee93d5adcd44378b008c147e84f181f23715307a64f7b3db432394bbfce8b \
+    --hash=sha256:e171b169cb7ea618e362a4dddb7a4d4c173bbc08b9ba41ea3086dd1265530d4f \
+    --hash=sha256:e2df12f295f95a804338bd300e8fad4a6f54fd49bd4d9c5893855a230b5188a8 \
+    --hash=sha256:e4072196547484c95a5a09adbb952e9bb501949f03f9e2a85e7249ef85faaba8 \
+    --hash=sha256:e5122a61b3b004bbbd979bdf83a3aaab432da3e2a842d7ddf1c273f2503b4884 \
+    --hash=sha256:e5b5da177d62cc4b7edf0cea08fe4dec960c9ac27f916131efa890a01f747b93 \
+    --hash=sha256:e6cb2316949c614e64f6b7796b9eca28b1b57406d27debc99398a746e9b426c7 \
+    --hash=sha256:e7e12a777f6b798eb8d06f875d6e108e3008bd658d274d8c676dcf98e0f10537 \
+    --hash=sha256:e8ae3689f0c7bfa6ce6ae45cab110e4c3442125c4c23b28f1f097856de26e4d1 \
+    --hash=sha256:ed972ebd553c0c25363459e9fc71a38c045d8419e365b59acd8cd791eff13981 \
+    --hash=sha256:ef153c5860d5bf1cc71aece69b28097d2a392913eb323d6b52555c875d0439fc \
+    --hash=sha256:efb1ab89fa47b5acb36f1530c4eb83ae20aaec9ac17808ff014b2650fbc3c7ba \
+    --hash=sha256:f13c25c215c284adca0c07cffae1518cafcac3900f1d45fff51c7e6ab98efec1 \
+    --hash=sha256:fc9fc4a0a1a13991b23a589fb6fbb8290bd94a72c130e69e27c9769612516424 \
+    --hash=sha256:fe1b02ab49bfd969ef50b9f17482a2011c77536654af21807ba5c2674e0bb2a0 \
+    --hash=sha256:fe61d52da1d102aabb0e315d3fc613c11c103376aa0a8510aeee159939612f76

.github/actions/run-argument-comment-lint/action.yml

@@ -0,0 +1,53 @@
+name: Run argument comment lint
+description: Run argument-comment-lint on codex-rs via Bazel.
+
+inputs:
+  target:
+    description: Runner target passed to setup-bazel-ci.
+    required: true
+  buildbuddy-api-key:
+    description: BuildBuddy API key used by Bazel CI.
+    required: false
+    default: ""
+
+runs:
+  using: composite
+  steps:
+    - uses: ./.github/actions/setup-bazel-ci
+      with:
+        target: ${{ inputs.target }}
+
+    - name: Install Linux sandbox build dependencies
+      if: ${{ runner.os == 'Linux' }}
+      shell: bash
+      run: |
+        sudo DEBIAN_FRONTEND=noninteractive apt-get update
+        sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends pkg-config libcap-dev
+
+    - name: Run argument comment lint on codex-rs via Bazel
+      if: ${{ runner.os != 'Windows' }}
+      env:
+        BUILDBUDDY_API_KEY: ${{ inputs.buildbuddy-api-key }}
+      shell: bash
+      run: |
+        bazel_targets="$(./tools/argument-comment-lint/list-bazel-targets.sh)"
+        ./.github/scripts/run-bazel-ci.sh \
+          -- \
+          build \
+          --config=argument-comment-lint \
+          --keep_going \
+          --build_metadata=COMMIT_SHA=${GITHUB_SHA} \
+          -- \
+          ${bazel_targets}
+
+    - name: Run argument comment lint on codex-rs via Bazel
+      if: ${{ runner.os == 'Windows' }}
+      env:
+        BUILDBUDDY_API_KEY: ${{ inputs.buildbuddy-api-key }}
+      shell: bash
+      run: |
+        ./.github/scripts/run-argument-comment-lint-bazel.sh \
+          --config=argument-comment-lint \
+          --platforms=//:local_windows \
+          --keep_going \
+          --build_metadata=COMMIT_SHA=${GITHUB_SHA}

.github/actions/setup-akv-pkcs11-codesigning/action.yaml

@@ -0,0 +1,349 @@
+name: Set up AKV PKCS11 code signing
+description: Download prebuilt rcodesign and Azure Key Vault PKCS11 provider artifacts, then export macOS signing environment.
+
+inputs:
+  setup-mode:
+    description: signing configures Azure and exports signing env vars; tools-only only downloads signing tools.
+    required: false
+    default: signing
+  rcodesign-blob-uri:
+    description: Azure Blob URI for the prebuilt Linux/amd64 rcodesign binary.
+    required: true
+  rcodesign-sha256:
+    description: Expected SHA-256 digest for the prebuilt rcodesign binary.
+    required: true
+  akv-pkcs11-library-blob-uri:
+    description: Azure Blob URI for the prebuilt Linux/amd64 AKV PKCS11 provider library.
+    required: true
+  akv-pkcs11-library-sha256:
+    description: Expected SHA-256 digest for the prebuilt AKV PKCS11 provider library.
+    required: true
+  azure-client-id:
+    description: GitHub OIDC client ID for the Azure signer application.
+    required: true
+  azure-tenant-id:
+    description: Azure tenant ID for the signer application.
+    required: true
+  azure-subscription-id:
+    description: Azure subscription ID that owns the signing vault.
+    required: true
+  key-vault-name:
+    description: Azure Key Vault name containing the certificate-backed signing key.
+    required: true
+  key-name:
+    description: Key Vault certificate/key name used as the PKCS11 key label.
+    required: true
+  key-version:
+    description: Optional Key Vault key version to pin while signing.
+    required: false
+    default: ""
+  certificate-sha256:
+    description: Optional expected SHA-256 fingerprint for the downloaded public certificate.
+    required: false
+    default: ""
+
+outputs:
+  pkcs11-library:
+    description: Path to the downloaded AKV PKCS11 provider library.
+    value: ${{ steps.paths.outputs.pkcs11_library }}
+  signing-certificate-pem:
+    description: Path to the downloaded public signing certificate.
+    value: ${{ steps.paths.outputs.signing_certificate_pem }}
+  rcodesign:
+    description: Path to the downloaded rcodesign binary.
+    value: ${{ steps.paths.outputs.rcodesign }}
+
+runs:
+  using: composite
+  steps:
+    - name: Validate pinned signing artifacts
+      shell: bash
+      env:
+        SETUP_MODE: ${{ inputs.setup-mode }}
+        RCODESIGN_BLOB_URI: ${{ inputs.rcodesign-blob-uri }}
+        RCODESIGN_SHA256: ${{ inputs.rcodesign-sha256 }}
+        AKV_PKCS11_LIBRARY_BLOB_URI: ${{ inputs.akv-pkcs11-library-blob-uri }}
+        AKV_PKCS11_LIBRARY_SHA256: ${{ inputs.akv-pkcs11-library-sha256 }}
+        KEY_VAULT_NAME: ${{ inputs.key-vault-name }}
+        KEY_NAME: ${{ inputs.key-name }}
+      run: |
+        set -euo pipefail
+
+        case "$SETUP_MODE" in
+          signing|tools-only)
+            ;;
+          *)
+            echo "setup-mode must be 'signing' or 'tools-only', got '$SETUP_MODE'." >&2
+            exit 1
+            ;;
+        esac
+
+        for variable_name in RCODESIGN_SHA256 AKV_PKCS11_LIBRARY_SHA256; do
+          value="${!variable_name}"
+          if [[ ! "$value" =~ ^[0-9a-f]{64}$ ]]; then
+            echo "$variable_name must be a lowercase SHA-256 digest." >&2
+            exit 1
+          fi
+        done
+
+        for variable_name in RCODESIGN_BLOB_URI AKV_PKCS11_LIBRARY_BLOB_URI; do
+          value="${!variable_name}"
+          if [[ ! "$value" =~ ^az://[^/]+/[^/]+/.+ ]]; then
+            echo "$variable_name must use az://<account>/<container>/<blob>." >&2
+            exit 1
+          fi
+        done
+
+        if [[ "$SETUP_MODE" == "signing" ]]; then
+          for variable_name in \
+            KEY_VAULT_NAME \
+            KEY_NAME; do
+            if [[ -z "${!variable_name}" ]]; then
+              echo "$variable_name is required for AKV PKCS11 signing." >&2
+              exit 1
+            fi
+          done
+        fi
+
+    - name: Resolve signing tool paths
+      id: paths
+      shell: bash
+      run: |
+        set -euo pipefail
+
+        if [[ "${RUNNER_OS}" != "Linux" ]]; then
+          echo "Prebuilt AKV PKCS11 signing tools are only vendored for Linux runners, got ${RUNNER_OS}." >&2
+          exit 1
+        fi
+
+        if [[ "${RUNNER_ARCH}" != "X64" && "${RUNNER_ARCH}" != "AMD64" ]]; then
+          echo "Prebuilt AKV PKCS11 signing tools are only vendored for amd64 runners, got ${RUNNER_ARCH}." >&2
+          exit 1
+        fi
+
+        provider_root="${RUNNER_TEMP}/akv-pkcs11-provider"
+        rcodesign_root="${RUNNER_TEMP}/rcodesign-root"
+        signing_certificate_pem="${RUNNER_TEMP}/akv-signing-cert.pem"
+        library_name="libakv_pkcs_11.so"
+
+        mkdir -p "$provider_root" "$rcodesign_root/bin"
+
+        {
+          echo "pkcs11_library=$provider_root/$library_name"
+          echo "pkcs11_manifest=$provider_root/akv-pkcs11-provider.manifest"
+          echo "rcodesign_root=$rcodesign_root"
+          echo "rcodesign=$rcodesign_root/bin/rcodesign"
+          echo "signing_certificate_pem=$signing_certificate_pem"
+        } >> "$GITHUB_OUTPUT"
+
+    - name: Validate Azure credentials for private signing artifacts
+      shell: bash
+      env:
+        AZURE_CLIENT_ID: ${{ inputs.azure-client-id }}
+        AZURE_TENANT_ID: ${{ inputs.azure-tenant-id }}
+        AZURE_SUBSCRIPTION_ID: ${{ inputs.azure-subscription-id }}
+      run: |
+        set -euo pipefail
+
+        for variable_name in AZURE_CLIENT_ID AZURE_TENANT_ID AZURE_SUBSCRIPTION_ID; do
+          if [[ -z "${!variable_name}" ]]; then
+            echo "$variable_name is required for private AKV PKCS11 signing artifacts." >&2
+            exit 1
+          fi
+        done
+
+    - name: Log in to Azure with GitHub OIDC
+      uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0
+      with:
+        client-id: ${{ inputs.azure-client-id }}
+        tenant-id: ${{ inputs.azure-tenant-id }}
+        subscription-id: ${{ inputs.azure-subscription-id }}
+
+    - name: Install prebuilt signing tools
+      shell: bash
+      env:
+        RCODESIGN_BLOB_URI: ${{ inputs.rcodesign-blob-uri }}
+        RCODESIGN_SHA256: ${{ inputs.rcodesign-sha256 }}
+        RCODESIGN: ${{ steps.paths.outputs.rcodesign }}
+        AKV_PKCS11_LIBRARY_BLOB_URI: ${{ inputs.akv-pkcs11-library-blob-uri }}
+        AKV_PKCS11_LIBRARY_SHA256: ${{ inputs.akv-pkcs11-library-sha256 }}
+        PKCS11_LIBRARY: ${{ steps.paths.outputs.pkcs11_library }}
+        PKCS11_MANIFEST: ${{ steps.paths.outputs.pkcs11_manifest }}
+      run: |
+        set -euo pipefail
+
+        download_az_blob_uri() {
+          local uri="$1"
+          local destination="$2"
+          local rest account container blob
+
+          rest="${uri#az://}"
+          account="${rest%%/*}"
+          rest="${rest#*/}"
+          container="${rest%%/*}"
+          blob="${rest#*/}"
+
+          if [[ -z "$account" || -z "$container" || -z "$blob" || "$blob" == "$rest" ]]; then
+            echo "Invalid Azure Blob URI. Expected az://<account>/<container>/<blob>." >&2
+            exit 1
+          fi
+
+          mkdir -p "$(dirname "$destination")"
+          rm -f "$destination"
+          if ! az storage blob download \
+            --account-name "$account" \
+            --container-name "$container" \
+            --name "$blob" \
+            --file "$destination" \
+            --auth-mode login \
+            --only-show-errors \
+            >/dev/null 2>&1; then
+            echo "Failed to download a private signing artifact from Azure Blob Storage." >&2
+            exit 1
+          fi
+        }
+
+        verify_sha256() {
+          local path="$1"
+          local expected="$2"
+          local actual
+
+          actual="$(shasum -a 256 "$path" | awk '{ print $1 }')"
+          if [[ "$actual" != "$expected" ]]; then
+            echo "SHA-256 verification failed for '$path'." >&2
+            exit 1
+          fi
+        }
+
+        echo "Downloading prebuilt rcodesign."
+        download_az_blob_uri "$RCODESIGN_BLOB_URI" "$RCODESIGN"
+        verify_sha256 "$RCODESIGN" "$RCODESIGN_SHA256"
+        chmod 0755 "$RCODESIGN"
+
+        echo "Downloading prebuilt AKV PKCS11 provider."
+        download_az_blob_uri "$AKV_PKCS11_LIBRARY_BLOB_URI" "$PKCS11_LIBRARY"
+        verify_sha256 "$PKCS11_LIBRARY" "$AKV_PKCS11_LIBRARY_SHA256"
+        chmod 0644 "$PKCS11_LIBRARY"
+
+        {
+          echo "runner_os=$RUNNER_OS"
+          echo "runner_arch=$RUNNER_ARCH"
+          echo "library_name=$(basename "$PKCS11_LIBRARY")"
+        } > "$PKCS11_MANIFEST"
+
+    - name: Verify downloaded signing tools
+      shell: bash
+      env:
+        RCODESIGN: ${{ steps.paths.outputs.rcodesign }}
+        RCODESIGN_SHA256: ${{ inputs.rcodesign-sha256 }}
+        PKCS11_LIBRARY: ${{ steps.paths.outputs.pkcs11_library }}
+        AKV_PKCS11_LIBRARY_SHA256: ${{ inputs.akv-pkcs11-library-sha256 }}
+        PKCS11_MANIFEST: ${{ steps.paths.outputs.pkcs11_manifest }}
+      run: |
+        set -euo pipefail
+
+        verify_sha256() {
+          local path="$1"
+          local expected="$2"
+          local actual
+
+          actual="$(shasum -a 256 "$path" | awk '{ print $1 }')"
+          if [[ "$actual" != "$expected" ]]; then
+            echo "SHA-256 verification failed for '$path'." >&2
+            exit 1
+          fi
+        }
+
+        if [[ ! -x "$RCODESIGN" ]]; then
+          echo "rcodesign is missing or not executable at '$RCODESIGN'." >&2
+          exit 1
+        fi
+
+        if [[ ! -f "$PKCS11_LIBRARY" ]]; then
+          echo "AKV PKCS11 provider library is missing at '$PKCS11_LIBRARY'." >&2
+          exit 1
+        fi
+
+        verify_sha256 "$RCODESIGN" "$RCODESIGN_SHA256"
+        verify_sha256 "$PKCS11_LIBRARY" "$AKV_PKCS11_LIBRARY_SHA256"
+
+        "$RCODESIGN" --version
+        "$RCODESIGN" notarize --help > /dev/null
+
+        if [[ -f "$PKCS11_MANIFEST" ]]; then
+          echo "AKV PKCS11 provider artifact manifest is present."
+        else
+          echo "AKV PKCS11 provider artifact manifest is absent." >&2
+          exit 1
+        fi
+
+    - name: Download signing certificate from Key Vault
+      if: ${{ inputs.setup-mode == 'signing' }}
+      shell: bash
+      env:
+        KEY_VAULT_NAME: ${{ inputs.key-vault-name }}
+        KEY_NAME: ${{ inputs.key-name }}
+        KEY_VERSION: ${{ inputs.key-version }}
+        CERTIFICATE_SHA256: ${{ inputs.certificate-sha256 }}
+        SIGNING_CERTIFICATE_PEM: ${{ steps.paths.outputs.signing_certificate_pem }}
+      run: |
+        set -euo pipefail
+
+        certificate_version_args=()
+        if [[ -n "$KEY_VERSION" ]]; then
+          certificate_version_args+=(--version "$KEY_VERSION")
+        fi
+
+        if ! az keyvault certificate download \
+          --vault-name "$KEY_VAULT_NAME" \
+          --name "$KEY_NAME" \
+          "${certificate_version_args[@]}" \
+          --file "$SIGNING_CERTIFICATE_PEM" \
+          --encoding PEM \
+          --only-show-errors \
+          >/dev/null 2>&1; then
+          echo "Failed to download the public signing certificate from Azure Key Vault." >&2
+          exit 1
+        fi
+
+        if [[ -n "$CERTIFICATE_SHA256" ]]; then
+          actual_sha256="$(
+            openssl x509 -in "$SIGNING_CERTIFICATE_PEM" -noout -fingerprint -sha256 |
+              awk -F= '{ print toupper($2) }' |
+              tr -d ':\r\n'
+          )"
+          expected_sha256="$(printf '%s' "$CERTIFICATE_SHA256" | tr '[:lower:]' '[:upper:]' | tr -d ':\r\n ')"
+          if [[ "$actual_sha256" != "$expected_sha256" ]]; then
+            echo "Downloaded signing certificate SHA-256 did not match the expected fingerprint." >&2
+            exit 1
+          fi
+        fi
+
+    - name: Export AKV PKCS11 signing environment
+      if: ${{ inputs.setup-mode == 'signing' }}
+      shell: bash
+      env:
+        RCODESIGN_ROOT: ${{ steps.paths.outputs.rcodesign_root }}
+        PKCS11_LIBRARY: ${{ steps.paths.outputs.pkcs11_library }}
+        SIGNING_CERTIFICATE_PEM: ${{ steps.paths.outputs.signing_certificate_pem }}
+        KEY_VAULT_NAME: ${{ inputs.key-vault-name }}
+        KEY_NAME: ${{ inputs.key-name }}
+        KEY_VERSION: ${{ inputs.key-version }}
+      run: |
+        set -euo pipefail
+
+        {
+          echo "$RCODESIGN_ROOT/bin"
+        } >> "$GITHUB_PATH"
+
+        {
+          echo "OAI_CODESIGN_BACKEND=akv-pkcs11"
+          echo "OAI_AKV_PKCS11_LIBRARY=$PKCS11_LIBRARY"
+          echo "OAI_AKV_SIGNING_CERTIFICATE_PEM=$SIGNING_CERTIFICATE_PEM"
+          echo "OAI_AKV_KEY_LABEL=$KEY_NAME"
+          echo "AZURE_CREDENTIAL_KIND=azurecli"
+          echo "AZURE_KEYVAULT_NAME=$KEY_VAULT_NAME"
+          if [[ -n "$KEY_VERSION" ]]; then
+            echo "AZURE_KEYVAULT_KEY_VERSION=$KEY_VERSION"
+          fi
+        } >> "$GITHUB_ENV"

.github/actions/setup-ci/action.yml

@@ -0,0 +1,107 @@
+name: setup-ci
+description: Prepare common tools and environment shared by CI jobs.
+outputs:
+  bazel-output-base:
+    description: Filesystem path used for Bazel's output base.
+    value: ${{ steps.configure_ci_build_paths.outputs.bazel-output-base }}
+  cargo-target-dir:
+    description: Filesystem path used for Cargo's target directory.
+    value: ${{ steps.configure_ci_build_paths.outputs.cargo-target-dir }}
+
+runs:
+  using: composite
+  steps:
+    # setup-ci expects either this step or the Unix fallback below to define
+    # CI_BUILD_ROOT. Windows uses a Dev Drive because Cargo and Bazel
+    # spend significant time reading and writing build/cache trees.
+    - name: Configure Dev Drive (Windows)
+      if: runner.os == 'Windows'
+      shell: pwsh
+      run: ./.github/scripts/setup-dev-drive.ps1
+
+    - name: Configure CI build root (Unix)
+      if: runner.os != 'Windows'
+      shell: bash
+      run: echo "CI_BUILD_ROOT=$HOME/.cache/codex-ci" >> "$GITHUB_ENV"
+
+    - name: Enable unprivileged user namespaces (Linux)
+      if: runner.os == 'Linux'
+      shell: bash
+      run: |
+        sudo sysctl -w kernel.unprivileged_userns_clone=1
+        if sudo sysctl -a 2>/dev/null | grep -q '^kernel.apparmor_restrict_unprivileged_userns'; then
+          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
+        fi
+
+    - name: Configure CI build paths
+      id: configure_ci_build_paths
+      shell: bash
+      run: |
+        set -euo pipefail
+        # setup-bazel passes output_base explicitly, so keep both it and the
+        # user root under the shared build root. Keep these directory names tiny
+        # on every platform so Windows Bazel paths do not overflow argv or
+        # confuse test MANIFEST handling.
+        bazel_output_base="$CI_BUILD_ROOT/o"
+        bazel_output_user_root="$CI_BUILD_ROOT/b"
+        bazel_repository_cache="$CI_BUILD_ROOT/bazel-repository-cache"
+        bazel_repo_contents_cache="$CI_BUILD_ROOT/bazel-repo-contents-cache-$GITHUB_RUN_ID-$GITHUB_JOB"
+        cargo_target_dir="$CI_BUILD_ROOT/cargo-target"
+        tmp="$CI_BUILD_ROOT/tmp"
+
+        build_dirs=(
+          "$bazel_output_base"
+          "$bazel_output_user_root"
+          "$bazel_repository_cache"
+          "$bazel_repo_contents_cache"
+          "$cargo_target_dir"
+          "$tmp"
+        )
+        mkdir -p "${build_dirs[@]}"
+        echo "bazel-output-base=$bazel_output_base" >> "$GITHUB_OUTPUT"
+        echo "cargo-target-dir=$cargo_target_dir" >> "$GITHUB_OUTPUT"
+
+        {
+          echo "CODEX_REPO_ROOT=$GITHUB_WORKSPACE"
+          echo "BAZEL_OUTPUT_BASE=$bazel_output_base"
+          echo "BAZEL_OUTPUT_USER_ROOT=$bazel_output_user_root"
+          echo "BAZEL_REPOSITORY_CACHE=$bazel_repository_cache"
+          echo "BAZEL_REPO_CONTENTS_CACHE=$bazel_repo_contents_cache"
+          echo "CARGO_TARGET_DIR=$cargo_target_dir"
+          echo "TEMP=$tmp"
+          echo "TMP=$tmp"
+        } >> "$GITHUB_ENV"
+
+    - name: Prefer the Git CLI for Cargo git dependencies
+      shell: bash
+      run: echo "CARGO_NET_GIT_FETCH_WITH_CLI=true" >> "$GITHUB_ENV"
+
+    - name: Install DotSlash
+      uses: facebook/install-dotslash@1e4e7b3e07eaca387acb98f1d4720e0bee8dbb6a # v2
+
+    - name: Install just
+      uses: taiki-e/install-action@44c6d64aa62cd779e873306675c7a58e86d6d532 # v2.62.49
+      with:
+        tool: just@1.51.0
+
+    # Some integration tests spawn DotSlash from a stable system path rather
+    # than inheriting the action-local PATH entry.
+    - name: Make DotSlash available in PATH (Unix)
+      if: runner.os != 'Windows'
+      shell: bash
+      run: |
+        if [[ -w /usr/local/bin ]]; then
+          cp "$(which dotslash)" /usr/local/bin
+        else
+          sudo cp "$(which dotslash)" /usr/local/bin
+        fi
+
+    - name: Make DotSlash available in PATH (Windows)
+      if: runner.os == 'Windows'
+      shell: pwsh
+      run: Copy-Item (Get-Command dotslash).Source -Destination "$env:LOCALAPPDATA\Microsoft\WindowsApps\dotslash.exe"
+
+    - name: Enable Git long paths (Windows)
+      if: runner.os == 'Windows'
+      shell: pwsh
+      run: git config --global core.longpaths true

.github/actions/setup-msvc-env/action.yml

@@ -0,0 +1,20 @@
+name: setup-msvc-env
+description: Expose an MSVC developer environment for the requested Windows target.
+inputs:
+  target:
+    description: Rust target triple that will be built on this Windows runner.
+    required: true
+  host-arch:
+    description: Optional Visual Studio host architecture override.
+    required: false
+    default: ""
+
+runs:
+  using: composite
+  steps:
+    - name: Expose MSVC SDK environment
+      shell: pwsh
+      env:
+        HOST_ARCH: ${{ inputs.host-arch }}
+        TARGET: ${{ inputs.target }}
+      run: '& "$env:GITHUB_ACTION_PATH/setup-msvc-env.ps1" -Target "$env:TARGET" -HostArch "$env:HOST_ARCH"'

.github/actions/setup-msvc-env/setup-msvc-env.ps1

@@ -0,0 +1,257 @@
+param(
+    [Parameter(Mandatory = $true)]
+    [string]$Target,
+
+    [string]$HostArch = ""
+)
+
+# Cargo can cross-compile the Rust code for Windows ARM64 on a Windows x64
+# runner, but rustup alone does not expose the matching MSVC/UCRT include and
+# library paths. Ask Visual Studio for the target-specific developer
+# environment, then persist the relevant variables through GITHUB_ENV so the
+# later Cargo step sees the same environment as a normal VsDevCmd shell.
+switch ($Target) {
+    "x86_64-pc-windows-msvc" {
+        $TargetArch = "x64"
+        $RequiredComponent = "Microsoft.VisualStudio.Component.VC.Tools.x86.x64"
+    }
+    "aarch64-pc-windows-msvc" {
+        $TargetArch = "arm64"
+        $RequiredComponent = "Microsoft.VisualStudio.Component.VC.Tools.ARM64"
+    }
+    default {
+        throw "Unsupported Windows MSVC target: $Target"
+    }
+}
+
+# VsDevCmd needs both sides of the cross compile: the architecture of the
+# machine running the tools and the architecture of the binaries being linked.
+# Infer the host from the runner unless a caller needs to override it.
+if (-not $HostArch) {
+    $HostArch = if ($env:PROCESSOR_ARCHITEW6432 -eq "ARM64" -or $env:PROCESSOR_ARCHITECTURE -eq "ARM64") {
+        "arm64"
+    } else {
+        "x64"
+    }
+}
+
+$VsWhere = "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe"
+if (-not (Test-Path $VsWhere)) {
+    throw "vswhere.exe not found"
+}
+
+# Require the target VC tools component, not merely any Visual Studio install,
+# so an x64 archive producer cannot silently link ARM64 tests with the wrong
+# SDK/toolchain layout.
+$InstallPath = & $VsWhere -latest -products * -requires $RequiredComponent -property installationPath 2>$null
+if (-not $InstallPath) {
+    throw "Could not locate a Visual Studio installation with component $RequiredComponent"
+}
+
+$VsDevCmd = Join-Path $InstallPath "Common7\Tools\VsDevCmd.bat"
+if (-not (Test-Path $VsDevCmd)) {
+    throw "VsDevCmd.bat not found at $VsDevCmd"
+}
+
+$VarsToExport = @(
+    "INCLUDE",
+    "LIB",
+    "LIBPATH",
+    "PATH",
+    "UCRTVersion",
+    "UniversalCRTSdkDir",
+    "VCINSTALLDIR",
+    "VCToolsInstallDir",
+    "WindowsLibPath",
+    "WindowsSdkBinPath",
+    "WindowsSdkDir",
+    "WindowsSDKLibVersion",
+    "WindowsSDKVersion"
+)
+
+# Run VsDevCmd inside cmd.exe because it is a batch file, then copy just the
+# variables Cargo/rustc need into the GitHub Actions environment file. PowerShell
+# cannot mutate the parent composite-action environment directly.
+$EnvLines = & cmd.exe /c ('"{0}" -no_logo -arch={1} -host_arch={2} >nul && set' -f $VsDevCmd, $TargetArch, $HostArch)
+$VcToolsInstallDir = $null
+foreach ($Line in $EnvLines) {
+    if ($Line -notmatch "^(.*?)=(.*)$") {
+        continue
+    }
+
+    $Name = $Matches[1]
+    $Value = $Matches[2]
+    if ($VarsToExport -contains $Name) {
+        if ($Name -ieq "Path") {
+            $Name = "PATH"
+        }
+        if ($Name -eq "VCToolsInstallDir") {
+            $VcToolsInstallDir = $Value
+        }
+        "$Name=$Value" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+    }
+}
+
+if (-not $VcToolsInstallDir) {
+    throw "VCToolsInstallDir was not exported by VsDevCmd.bat"
+}
+
+# Prefer Rust's bundled linker when rustup provides one, then Visual Studio's
+# LLVM linker, and finally MSVC link.exe. This keeps the cross-compile path close
+# to Rust's normal Windows MSVC behavior while still working on runner images
+# where one of those linkers is absent.
+$Linker = $null
+$Rustc = Get-Command rustc -ErrorAction SilentlyContinue
+if ($Rustc) {
+    $Sysroot = (& rustc --print sysroot 2>$null).Trim()
+    $RustHost = & rustc -vV 2>$null | Select-String "^host: " | ForEach-Object { $_.Line.Substring(6) }
+    if ($RustHost) {
+        $RustHost = $RustHost.Trim()
+    }
+    if ($Sysroot -and $RustHost) {
+        $RustLld = Join-Path $Sysroot "lib\rustlib\$RustHost\bin\rust-lld.exe"
+        if (Test-Path $RustLld) {
+            $Linker = $RustLld
+        }
+    }
+}
+if (-not $Linker) {
+    $Linker = Join-Path $InstallPath "VC\Tools\Llvm\x64\bin\lld-link.exe"
+}
+if (-not (Test-Path $Linker)) {
+    $Linker = Join-Path $VcToolsInstallDir "bin\Host${HostArch}\${TargetArch}\link.exe"
+}
+if (-not (Test-Path $Linker)) {
+    throw "Windows linker not found at $Linker"
+}
+
+# rustc passes `/arm64hazardfree` for ARM64 MSVC links. The lld variants on our
+# Windows x64 archive producers reject that flag, including when rustc places it
+# inside a response file. Compile a tiny forwarding wrapper that strips only
+# that unsupported flag, then delegate every other argument to the real linker.
+if ($TargetArch -eq "arm64" -and (Split-Path -Leaf $Linker) -match "lld") {
+    $WrapperDir = Join-Path $env:RUNNER_TEMP "msvc-lld-wrapper"
+    New-Item -Path $WrapperDir -ItemType Directory -Force | Out-Null
+    $WrapperPath = Join-Path $WrapperDir "lld-link-wrapper.exe"
+    $WrapperSource = @'
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.IO;
+using System.Text;
+using System.Text.RegularExpressions;
+
+internal static class Program
+{
+    private static int Main(string[] args)
+    {
+        var linker = Environment.GetEnvironmentVariable("MSVC_REAL_LINKER");
+        if (string.IsNullOrEmpty(linker))
+        {
+            Console.Error.WriteLine("MSVC_REAL_LINKER is not set");
+            return 1;
+        }
+
+        var startInfo = new ProcessStartInfo(linker)
+        {
+            UseShellExecute = false,
+        };
+        var filteredArgs = new List<string> { "-flavor", "link", "/defaultlib:ucrt", "/nodefaultlib:libucrt" };
+        foreach (var arg in args)
+        {
+            if (!string.Equals(arg, "/arm64hazardfree", StringComparison.OrdinalIgnoreCase))
+            {
+                filteredArgs.Add(QuoteArgument(FilterResponseFile(arg)));
+            }
+        }
+        startInfo.Arguments = string.Join(" ", filteredArgs);
+
+        using var process = Process.Start(startInfo);
+        if (process is null)
+        {
+            Console.Error.WriteLine($"Failed to start linker: {linker}");
+            return 1;
+        }
+
+        process.WaitForExit();
+        return process.ExitCode;
+    }
+
+    private static string FilterResponseFile(string argument)
+    {
+        if (argument.Length < 2 || argument[0] != '@')
+        {
+            return argument;
+        }
+
+        var responsePath = argument.Substring(1);
+        if (!File.Exists(responsePath))
+        {
+            return argument;
+        }
+
+        var filteredResponsePath = Path.Combine(Path.GetTempPath(), Path.GetRandomFileName() + ".rsp");
+        var responseContents = Regex.Replace(
+            File.ReadAllText(responsePath),
+            "/arm64hazardfree",
+            string.Empty,
+            RegexOptions.IgnoreCase);
+        File.WriteAllText(filteredResponsePath, responseContents);
+        return "@" + filteredResponsePath;
+    }
+
+    private static string QuoteArgument(string argument)
+    {
+        if (argument.Length == 0)
+        {
+            return "\"\"";
+        }
+        if (argument.IndexOfAny(new[] { ' ', '\t', '"' }) < 0)
+        {
+            return argument;
+        }
+
+        var quoted = new StringBuilder("\"");
+        var backslashes = 0;
+        foreach (var character in argument)
+        {
+            if (character == '\\')
+            {
+                backslashes++;
+                continue;
+            }
+            if (character == '"')
+            {
+                quoted.Append('\\', (backslashes * 2) + 1);
+                quoted.Append(character);
+                backslashes = 0;
+                continue;
+            }
+
+            quoted.Append('\\', backslashes);
+            backslashes = 0;
+            quoted.Append(character);
+        }
+        quoted.Append('\\', backslashes * 2);
+        quoted.Append('"');
+        return quoted.ToString();
+    }
+}
+'@
+    $WrapperSourcePath = Join-Path $WrapperDir "lld-link-wrapper.cs"
+    $WrapperSource | Out-File -FilePath $WrapperSourcePath -Encoding utf8
+    $Csc = Join-Path $InstallPath "MSBuild\Current\Bin\Roslyn\csc.exe"
+    if (-not (Test-Path $Csc)) {
+        throw "csc.exe not found at $Csc"
+    }
+    & $Csc /nologo /target:exe /out:$WrapperPath $WrapperSourcePath
+    if ($LASTEXITCODE -ne 0) {
+        throw "Failed to compile lld-link wrapper"
+    }
+    "MSVC_REAL_LINKER=$Linker" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+    $Linker = $WrapperPath
+}
+
+Write-Output "Using Windows linker: $Linker"
+$CargoTarget = $Target.ToUpperInvariant().Replace("-", "_")
+"CARGO_TARGET_${CargoTarget}_LINKER=$Linker" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append

.github/actions/setup-rusty-v8/action.yml

@@ -0,0 +1,64 @@
+name: setup-rusty-v8
+description: Download and verify Codex-built rusty_v8 artifacts for Cargo builds.
+inputs:
+  target:
+    description: Rust target triple with Codex-built V8 release artifacts.
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Configure rusty_v8 artifact overrides and verify checksums
+      shell: bash
+      env:
+        TARGET: ${{ inputs.target }}
+      run: |
+        set -euo pipefail
+
+        version="$(python3 "${GITHUB_WORKSPACE}/.github/scripts/rusty_v8_bazel.py" resolved-v8-crate-version)"
+        release_tag="rusty-v8-v${version}"
+        base_url="https://github.com/openai/codex/releases/download/${release_tag}"
+        binding_dir="${RUNNER_TEMP}/rusty_v8"
+        
+        profile="ptrcomp_sandbox_release"
+
+        if [[ "$TARGET" == *-pc-windows-msvc ]]; then
+          archive_name="rusty_v8_${profile}_${TARGET}.lib.gz"
+        else
+          archive_name="librusty_v8_${profile}_${TARGET}.a.gz"
+        fi
+        binding_name="src_binding_${profile}_${TARGET}.rs"
+        checksums_name="rusty_v8_${profile}_${TARGET}.sha256"
+
+        archive_path="${binding_dir}/${archive_name}"
+        binding_path="${binding_dir}/${binding_name}"
+        checksums_path="${binding_dir}/${checksums_name}"
+        trusted_checksums="${GITHUB_WORKSPACE}/third_party/v8/rusty_v8_${version//./_}_release_manifests.sha256"
+
+        if command -v sha256sum >/dev/null 2>&1; then
+          checksum_command=(sha256sum --check -)
+        else
+          checksum_command=(shasum -a 256 --check -)
+        fi
+
+        mkdir -p "${binding_dir}"
+        curl -fsSL "${base_url}/${checksums_name}" -o "${checksums_path}"
+        # Check the original manifest bytes even when either checksum file uses CRLF.
+        expected_manifest_checksum="$(grep -F "  ${checksums_name}" "${trusted_checksums}" | cut -d ' ' -f 1)"
+        actual_manifest_checksum="$(python3 -c 'import hashlib, pathlib, sys; print(hashlib.sha256(pathlib.Path(sys.argv[1]).read_bytes()).hexdigest())' "${checksums_path}")"
+        if [[ "${actual_manifest_checksum}" != "${expected_manifest_checksum}" ]]; then
+          echo "Checksum mismatch for ${checksums_name}: expected ${expected_manifest_checksum}, got ${actual_manifest_checksum}" >&2
+          exit 1
+        fi
+        curl -fsSL "${base_url}/${archive_name}" -o "${archive_path}"
+        curl -fsSL "${base_url}/${binding_name}" -o "${binding_path}"
+
+        if [[ "$(wc -l < "${checksums_path}")" -ne 2 ]]; then
+          echo "Expected exactly two checksums for ${TARGET} in ${checksums_path}" >&2
+          exit 1
+        fi
+
+        # Existing Windows-built release manifests use CRLF line endings.
+        (cd "${binding_dir}" && tr -d '\r' < "${checksums_path}" | "${checksum_command[@]}")
+        echo "RUSTY_V8_ARCHIVE=${archive_path}" >> "${GITHUB_ENV}"
+        echo "RUSTY_V8_SRC_BINDING_PATH=${binding_path}" >> "${GITHUB_ENV}"

.github/actions/windows-code-sign/action.yml

@@ -0,0 +1,73 @@
+name: windows-code-sign
+description: Sign Windows binaries with Azure Trusted Signing.
+inputs:
+  target:
+    description: Target triple for the artifacts to sign.
+    required: true
+  binaries:
+    description: Space-delimited binary basenames to sign.
+    default: "codex codex-responses-api-proxy codex-windows-sandbox-setup codex-command-runner"
+  client-id:
+    description: Azure Trusted Signing client ID.
+    required: true
+  tenant-id:
+    description: Azure tenant ID for Trusted Signing.
+    required: true
+  subscription-id:
+    description: Azure subscription ID for Trusted Signing.
+    required: true
+  endpoint:
+    description: Azure Trusted Signing endpoint.
+    required: true
+  account-name:
+    description: Azure Trusted Signing account name.
+    required: true
+  certificate-profile-name:
+    description: Certificate profile name for signing.
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Azure login for Trusted Signing (OIDC)
+      uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
+      with:
+        client-id: ${{ inputs.client-id }}
+        tenant-id: ${{ inputs.tenant-id }}
+        subscription-id: ${{ inputs.subscription-id }}
+
+    - name: Prepare file list
+      id: prepare
+      shell: bash
+      env:
+        TARGET: ${{ inputs.target }}
+        BINARIES: ${{ inputs.binaries }}
+      run: |
+        set -euo pipefail
+
+        {
+          echo "files<<EOF"
+          for binary in ${BINARIES}; do
+            echo "${CARGO_TARGET_DIR}/${TARGET}/release/${binary}.exe"
+          done
+          echo "EOF"
+        } >> "$GITHUB_OUTPUT"
+
+    - name: Sign Windows binaries with Azure Trusted Signing
+      uses: azure/trusted-signing-action@1d365fec12862c4aa68fcac418143d73f0cea293 # v0.5.11
+      with:
+        endpoint: ${{ inputs.endpoint }}
+        trusted-signing-account-name: ${{ inputs.account-name }}
+        certificate-profile-name: ${{ inputs.certificate-profile-name }}
+        exclude-environment-credential: true
+        exclude-workload-identity-credential: true
+        exclude-managed-identity-credential: true
+        exclude-shared-token-cache-credential: true
+        exclude-visual-studio-credential: true
+        exclude-visual-studio-code-credential: true
+        exclude-azure-cli-credential: false
+        exclude-azure-powershell-credential: true
+        exclude-azure-developer-cli-credential: true
+        exclude-interactive-browser-credential: true
+        cache-dependencies: false
+        files: ${{ steps.prepare.outputs.files }}

.github/codex/labels/codex-triage.md

@@ -0,0 +1,7 @@
+Troubleshoot whether the reported issue is valid.
+
+Provide a concise and respectful comment summarizing the findings.
+
+### {CODEX_ACTION_ISSUE_TITLE}
+
+{CODEX_ACTION_ISSUE_BODY}

.github/scripts/macos-signing/codex-app-server.entitlements.plist

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>com.apple.security.cs.allow-jit</key>
+	<true/>
+	<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+	<true/>
+</dict>
+</plist>

.github/scripts/macos-signing/codex-code-mode-host.entitlements.plist

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>com.apple.security.cs.allow-jit</key>
+	<true/>
+	<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+	<true/>
+</dict>
+</plist>

.github/scripts/macos-signing/codex-responses-api-proxy.entitlements.plist

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>com.apple.security.cs.allow-jit</key>
+	<true/>
+</dict>
+</plist>

.github/scripts/macos-signing/codex-voice-host.entitlements.plist

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>com.apple.security.device.audio-input</key>
+	<true/>
+</dict>
+</plist>

.github/scripts/macos-signing/codex.entitlements.plist

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>com.apple.security.cs.allow-jit</key>
+	<true/>
+	<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+	<true/>
+</dict>
+</plist>

.github/scripts/macos-signing/notarize_macos_binary_with_akv.sh

@@ -0,0 +1,110 @@
+#!/usr/bin/env bash
+
+# Notarize a standalone binary and retain its diagnostic report.
+
+set -euo pipefail
+
+usage() {
+  cat >&2 <<'EOF'
+Usage: notarize_macos_binary_with_akv.sh --binary PATH [--report-dir PATH] [--max-wait-seconds SECONDS]
+
+Options:
+  --binary PATH                 Signed standalone macOS binary to notarize.
+  --report-dir PATH             Directory for notarization logs.
+  --max-wait-seconds SECONDS    Maximum Apple notarization wait time.
+EOF
+}
+
+binary_path=""
+report_dir="${RUNNER_TEMP:-/tmp}/macos-binary-notarization-verification"
+max_wait_seconds="600"
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --binary)
+      binary_path="${2:-}"
+      shift 2
+      ;;
+    --report-dir)
+      report_dir="${2:-}"
+      shift 2
+      ;;
+    --max-wait-seconds)
+      max_wait_seconds="${2:-}"
+      shift 2
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "Unknown notarization argument: $1" >&2
+      usage
+      exit 2
+      ;;
+  esac
+done
+
+if [[ -z "$binary_path" ]]; then
+  echo "--binary is required." >&2
+  usage
+  exit 2
+fi
+
+if [[ ! -f "$binary_path" ]]; then
+  echo "Binary does not exist: $binary_path" >&2
+  exit 1
+fi
+
+if [[ ! "$max_wait_seconds" =~ ^[0-9]+$ ]]; then
+  echo "--max-wait-seconds must be a non-negative integer." >&2
+  exit 2
+fi
+
+for command_name in python3 zip; do
+  if ! command -v "$command_name" >/dev/null 2>&1; then
+    echo "$command_name was not found on PATH." >&2
+    exit 1
+  fi
+done
+
+missing_environment=0
+for variable_name in \
+  APPLE_NOTARIZATION_AKV_KEY_NAME \
+  AZURE_KEYVAULT_NAME
+do
+  if [[ -z "${!variable_name:-}" ]]; then
+    echo "$variable_name must be configured before notarizing a binary." >&2
+    missing_environment=1
+  fi
+done
+
+if [[ "$missing_environment" -ne 0 ]]; then
+  exit 2
+fi
+
+mkdir -p "$report_dir"
+
+notarization_temp_dir="$(mktemp -d)"
+trap 'rm -rf "$notarization_temp_dir" >/dev/null' EXIT
+
+binary_name="$(basename "$binary_path")"
+archive_path="$notarization_temp_dir/${binary_name}.zip"
+(
+  cd "$(dirname "$binary_path")"
+  zip -q "$archive_path" "$binary_name"
+)
+
+notarization_log="$report_dir/${binary_name}-notarization.log"
+python3 "$(dirname "$0")/notarize_with_akv.py" \
+  --file "$archive_path" \
+  --report-log "$report_dir/${binary_name}-notarization-developer-log.json" \
+  --max-wait-seconds "$max_wait_seconds" \
+  2>&1 | tee "$notarization_log"
+
+{
+  echo "binary_name=$binary_name"
+  echo "max_wait_seconds=$max_wait_seconds"
+  echo "binary_sha256=$(shasum -a 256 "$binary_path" | awk '{ print $1 }')"
+  echo "notarization=completed"
+} >"$report_dir/${binary_name}-notarization-summary.txt"

.github/scripts/macos-signing/notarize_macos_dmg_with_akv.sh

@@ -0,0 +1,100 @@
+#!/usr/bin/env bash
+
+# Notarize a signed disk image and staple its ticket.
+
+set -euo pipefail
+
+usage() {
+  cat >&2 <<'EOF'
+Usage: notarize_macos_dmg_with_akv.sh --dmg PATH [--report-dir PATH] [--max-wait-seconds SECONDS]
+
+Options:
+  --dmg PATH                    Signed DMG to submit to Apple notarization.
+  --report-dir PATH             Directory for notarization logs.
+  --max-wait-seconds SECONDS    Maximum Apple notarization wait time.
+EOF
+}
+
+dmg_path=""
+report_dir="${RUNNER_TEMP:-/tmp}/macos-notarization-verification"
+max_wait_seconds="600"
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --dmg)
+      dmg_path="${2:-}"
+      shift 2
+      ;;
+    --report-dir)
+      report_dir="${2:-}"
+      shift 2
+      ;;
+    --max-wait-seconds)
+      max_wait_seconds="${2:-}"
+      shift 2
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "Unknown notarization argument: $1" >&2
+      usage
+      exit 2
+      ;;
+  esac
+done
+
+if [[ -z "$dmg_path" ]]; then
+  echo "--dmg is required." >&2
+  usage
+  exit 2
+fi
+
+if [[ ! -f "$dmg_path" ]]; then
+  echo "DMG does not exist: $dmg_path" >&2
+  exit 1
+fi
+
+if [[ ! "$max_wait_seconds" =~ ^[0-9]+$ ]]; then
+  echo "--max-wait-seconds must be a non-negative integer." >&2
+  exit 2
+fi
+
+if ! command -v rcodesign > /dev/null 2>&1; then
+  echo "rcodesign was not found on PATH." >&2
+  exit 1
+fi
+
+missing_environment=0
+for variable_name in \
+  APPLE_NOTARIZATION_AKV_KEY_NAME \
+  AZURE_KEYVAULT_NAME
+do
+  if [[ -z "${!variable_name:-}" ]]; then
+    echo "$variable_name must be configured before notarizing a DMG." >&2
+    missing_environment=1
+  fi
+done
+
+if [[ "$missing_environment" -ne 0 ]]; then
+  exit 2
+fi
+
+mkdir -p "$report_dir"
+
+notarization_log="$report_dir/dmg-notarization.log"
+python3 "$(dirname "$0")/notarize_with_akv.py" \
+  --file "$dmg_path" \
+  --report-log "$report_dir/dmg-notarization-developer-log.json" \
+  --max-wait-seconds "$max_wait_seconds" \
+  2>&1 | tee "$notarization_log"
+
+rcodesign staple "$dmg_path" 2>&1 | tee -a "$notarization_log"
+
+{
+  echo "dmg_path=$dmg_path"
+  echo "max_wait_seconds=$max_wait_seconds"
+  echo "dmg_sha256=$(shasum -a 256 "$dmg_path" | awk '{ print $1 }')"
+  echo "notarization_staple=completed"
+} > "$report_dir/dmg-notarization-summary.txt"

.github/scripts/macos-signing/notarize_with_akv.py

@@ -0,0 +1,519 @@
+#!/usr/bin/env python3
+"""Submit release artifacts for notarization and wait for the result."""
+
+import argparse
+import base64
+import datetime
+import hashlib
+import hmac
+import json
+import os
+import re
+import subprocess
+import sys
+import time
+import urllib.error
+import urllib.parse
+import urllib.request
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any
+
+APPLE_NOTARY_URL = "https://appstoreconnect.apple.com/notary/v2/submissions"
+AZURE_KEYVAULT_API_VERSION = "7.4"
+AWS_REGION = "us-west-2"
+JWT_LIFETIME_SECONDS = 15 * 60
+POLL_INTERVAL_SECONDS = 10
+MAX_SINGLE_UPLOAD_BYTES = 5 * 1024 * 1024 * 1024
+
+
+class NotarizationError(RuntimeError):
+    """Describe a notarization failure."""
+
+
+@dataclass(frozen=True)
+class NotarizationConfiguration:
+    """Hold the account and signing-key configuration."""
+
+    issuer_id: str
+    apple_key_id: str
+    vault_name: str
+    vault_key_name: str
+    vault_key_version: str
+
+    @classmethod
+    def from_environment(cls) -> "NotarizationConfiguration":
+        """Load and validate the notarization configuration."""
+
+        required = {
+            "vault_name": "AZURE_KEYVAULT_NAME",
+            "vault_key_name": "APPLE_NOTARIZATION_AKV_KEY_NAME",
+        }
+        values = {
+            field: os.environ.get(name, "").strip() for field, name in required.items()
+        }
+        missing = [name for field, name in required.items() if not values[field]]
+        if missing:
+            raise NotarizationError(
+                "Missing notarization configuration: " + ", ".join(missing)
+            )
+        if not re.fullmatch(r"[A-Za-z][A-Za-z0-9-]{2,23}", values["vault_name"]):
+            raise NotarizationError("Invalid signing vault name")
+        if not re.fullmatch(r"[A-Za-z0-9-]+", values["vault_key_name"]):
+            raise NotarizationError("Invalid notarization key name")
+        key_version = os.environ.get("APPLE_NOTARIZATION_AKV_KEY_VERSION", "").strip()
+        if key_version and not re.fullmatch(r"[0-9a-fA-F]{32}", key_version):
+            raise NotarizationError(
+                "Notarization key must resolve to a 32-character pinned version"
+            )
+
+        command = [
+            "az",
+            "keyvault",
+            "key",
+            "show",
+            "--vault-name",
+            values["vault_name"],
+            "--name",
+            values["vault_key_name"],
+        ]
+        if key_version:
+            command.extend(["--version", key_version])
+        command.extend(
+            [
+                "--query",
+                '{id:key.kid,apple_key_id:tags."apple-key-id",'
+                'apple_issuer_id:tags."apple-issuer-id"}',
+                "--output",
+                "json",
+                "--only-show-errors",
+            ]
+        )
+
+        # Resolve the key identifier and version from the same lookup.
+        try:
+            result = subprocess.run(command, check=True, capture_output=True, text=True)
+        except (OSError, subprocess.CalledProcessError) as error:
+            raise NotarizationError(
+                "Notarization signing key could not be read"
+            ) from error
+        try:
+            metadata = json.loads(result.stdout)
+            returned_key_id = metadata["id"]
+            apple_key_id = metadata["apple_key_id"]
+            apple_issuer_id = metadata["apple_issuer_id"]
+        except (json.JSONDecodeError, KeyError, TypeError) as error:
+            raise NotarizationError("Notarization key metadata is invalid") from error
+
+        key_id_prefix = f"https://{values['vault_name']}.vault.azure.net/keys/{values['vault_key_name']}/"
+        if not isinstance(returned_key_id, str) or not returned_key_id.startswith(
+            key_id_prefix
+        ):
+            raise NotarizationError("Unexpected notarization signing key")
+        returned_key_version = returned_key_id[len(key_id_prefix) :]
+        if not re.fullmatch(r"[0-9a-fA-F]{32}", returned_key_version):
+            raise NotarizationError(
+                "Notarization key must resolve to a 32-character pinned version"
+            )
+        if key_version and returned_key_version.lower() != key_version.lower():
+            raise NotarizationError("Unexpected notarization key version")
+        if not isinstance(apple_key_id, str) or not apple_key_id.strip():
+            raise NotarizationError("Notarization key must have an apple-key-id tag")
+        if not isinstance(apple_issuer_id, str) or not apple_issuer_id.strip():
+            raise NotarizationError("Notarization key must have an apple-issuer-id tag")
+        if not re.fullmatch(
+            r"[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-"
+            r"[0-9a-fA-F]{4}-[0-9a-fA-F]{12}",
+            apple_issuer_id.strip(),
+        ):
+            raise NotarizationError(
+                "Notarization apple-issuer-id tag must contain a valid UUID"
+            )
+
+        values["issuer_id"] = apple_issuer_id.strip()
+        values["apple_key_id"] = apple_key_id.strip()
+        values["vault_key_version"] = returned_key_version
+        return cls(**values)
+
+    @property
+    def versioned_key_id(self) -> str:
+        """Return the versioned signing-key identifier."""
+
+        return (
+            f"https://{self.vault_name}.vault.azure.net/keys/"
+            f"{self.vault_key_name}/{self.vault_key_version}"
+        )
+
+
+def base64url_encode(value: bytes) -> str:
+    """Encode bytes using the unpadded base64url format required by JWTs."""
+
+    return base64.urlsafe_b64encode(value).decode("ascii").rstrip("=")
+
+
+def base64url_decode(value: str) -> bytes:
+    """Decode a base64url value and reject malformed input."""
+
+    try:
+        return base64.b64decode(
+            value + "=" * (-len(value) % 4), altchars=b"-_", validate=True
+        )
+    except (ValueError, UnicodeEncodeError) as error:
+        raise NotarizationError(
+            "Signing service returned an invalid signature"
+        ) from error
+
+
+def create_apple_jwt(
+    configuration: NotarizationConfiguration, *, issued_at: int
+) -> str:
+    """Create an authentication token for notarization requests."""
+
+    header = {"alg": "ES256", "kid": configuration.apple_key_id, "typ": "JWT"}
+    # Restrict the token to notarization requests.
+    claims = {
+        "iss": configuration.issuer_id,
+        "iat": issued_at,
+        "exp": issued_at + JWT_LIFETIME_SECONDS,
+        "aud": "appstoreconnect-v1",
+        "scope": ["/notary/v2"],
+    }
+    encoded_header = base64url_encode(
+        json.dumps(header, separators=(",", ":")).encode("utf-8")
+    )
+    encoded_claims = base64url_encode(
+        json.dumps(claims, separators=(",", ":")).encode("utf-8")
+    )
+    signing_input = f"{encoded_header}.{encoded_claims}"
+    digest = hashlib.sha256(signing_input.encode("ascii")).digest()
+    key_url = configuration.versioned_key_id
+    request_body = json.dumps({"alg": "ES256", "value": base64url_encode(digest)})
+
+    try:
+        result = subprocess.run(
+            [
+                "az",
+                "rest",
+                "--method",
+                "post",
+                "--url",
+                f"{key_url}/sign?api-version={AZURE_KEYVAULT_API_VERSION}",
+                "--resource",
+                "https://vault.azure.net",
+                "--headers",
+                "Content-Type=application/json",
+                "--body",
+                request_body,
+                "--output",
+                "json",
+                "--only-show-errors",
+            ],
+            check=True,
+            capture_output=True,
+            text=True,
+        )
+    except (OSError, subprocess.CalledProcessError) as error:
+        detail = getattr(error, "stderr", "").strip()
+        message = "Signing service could not sign the authentication token"
+        if detail:
+            message = f"{message}: {detail}"
+        raise NotarizationError(message) from error
+
+    try:
+        response = json.loads(result.stdout)
+        returned_key_id = response["kid"]
+        encoded_signature = response["value"]
+    except (json.JSONDecodeError, KeyError, TypeError) as error:
+        raise NotarizationError(
+            "Signing service returned an invalid response"
+        ) from error
+
+    # Reject signatures generated with a different key version.
+    if returned_key_id != key_url:
+        raise NotarizationError("Signing service returned an unexpected key version")
+    if not isinstance(encoded_signature, str):
+        raise NotarizationError("Signing service returned an invalid signature")
+    signature = base64url_decode(encoded_signature)
+    # ES256 JWT signatures are 64 raw R || S bytes, not ASN.1/DER-encoded ECDSA signatures.
+    if len(signature) != 64:
+        raise NotarizationError("ES256 signature must contain 64 JOSE R || S bytes")
+    return f"{signing_input}.{base64url_encode(signature)}"
+
+
+def json_request(
+    url: str, token: str, *, body: dict[str, Any] | None = None
+) -> dict[str, Any]:
+    """Send an authenticated JSON request to Apple's notarization service."""
+
+    data = None if body is None else json.dumps(body).encode("utf-8")
+    request = urllib.request.Request(
+        url,
+        data=data,
+        method="GET" if body is None else "POST",
+        headers={
+            "Accept": "application/json",
+            "Authorization": f"Bearer {token}",
+            "Content-Type": "application/json",
+        },
+    )
+    try:
+        with urllib.request.urlopen(request, timeout=60) as response:
+            result = json.load(response)
+    except urllib.error.HTTPError as error:
+        detail = error.read(1024).decode("utf-8", errors="replace")
+        raise NotarizationError(
+            f"Apple Notary API returned HTTP {error.code}: {detail}"
+        ) from error
+    except (OSError, json.JSONDecodeError) as error:
+        raise NotarizationError("Apple Notary API request failed") from error
+
+    if not isinstance(result, dict):
+        raise NotarizationError("Apple Notary API returned an invalid response")
+    return result
+
+
+def sha256_file(path: Path) -> str:
+    """Hash an artifact incrementally so large release files stay off the heap."""
+
+    digest = hashlib.sha256()
+    with path.open("rb") as source:
+        for chunk in iter(lambda: source.read(1024 * 1024), b""):
+            digest.update(chunk)
+    return digest.hexdigest()
+
+
+def hmac_sha256(key: bytes, value: str) -> bytes:
+    """Derive one AWS Signature Version 4 signing-key component."""
+
+    return hmac.new(key, value.encode("utf-8"), hashlib.sha256).digest()
+
+
+def upload_to_apple_s3(
+    path: Path,
+    file_digest: str,
+    credentials: dict[str, Any],
+    *,
+    timestamp: datetime.datetime | None = None,
+) -> None:
+    """Upload an artifact using the provided temporary credentials."""
+
+    required = (
+        "awsAccessKeyId",
+        "awsSecretAccessKey",
+        "awsSessionToken",
+        "bucket",
+        "object",
+    )
+    if any(
+        not isinstance(credentials.get(name), str) or not credentials[name]
+        for name in required
+    ):
+        raise NotarizationError(
+            "Apple returned incomplete temporary upload credentials"
+        )
+
+    size = path.stat().st_size
+    if not 0 < size <= MAX_SINGLE_UPLOAD_BYTES:
+        raise NotarizationError("Notarization payload must be between 1 byte and 5 GiB")
+
+    now = timestamp or datetime.datetime.now(datetime.timezone.utc)
+    amz_date = now.strftime("%Y%m%dT%H%M%SZ")
+    date_stamp = now.strftime("%Y%m%d")
+    host = f"{credentials['bucket']}.s3.{AWS_REGION}.amazonaws.com"
+    object_path = "/" + urllib.parse.quote(
+        credentials["object"].lstrip("/"), safe="/-_.~"
+    )
+    headers = {
+        "content-type": "application/octet-stream",
+        "host": host,
+        "x-amz-content-sha256": file_digest,
+        "x-amz-date": amz_date,
+        "x-amz-security-token": credentials["awsSessionToken"],
+    }
+    # Build the signature required by the upload endpoint.
+    signed_headers = ";".join(sorted(headers))
+    canonical_headers = "".join(f"{name}:{headers[name]}\n" for name in sorted(headers))
+    canonical_request = "\n".join(
+        ["PUT", object_path, "", canonical_headers, signed_headers, file_digest]
+    )
+    credential_scope = f"{date_stamp}/{AWS_REGION}/s3/aws4_request"
+    string_to_sign = "\n".join(
+        [
+            "AWS4-HMAC-SHA256",
+            amz_date,
+            credential_scope,
+            hashlib.sha256(canonical_request.encode("utf-8")).hexdigest(),
+        ]
+    )
+    signing_key = ("AWS4" + credentials["awsSecretAccessKey"]).encode("utf-8")
+    for component in (date_stamp, AWS_REGION, "s3", "aws4_request"):
+        signing_key = hmac_sha256(signing_key, component)
+    signature = hmac.new(
+        signing_key, string_to_sign.encode("utf-8"), hashlib.sha256
+    ).hexdigest()
+    authorization = (
+        "AWS4-HMAC-SHA256 "
+        f"Credential={credentials['awsAccessKeyId']}/{credential_scope}, "
+        f"SignedHeaders={signed_headers}, Signature={signature}"
+    )
+
+    # Stream the artifact to avoid buffering its full contents.
+    with path.open("rb") as source:
+        request = urllib.request.Request(
+            f"https://{host}{object_path}",
+            data=source,
+            method="PUT",
+            headers={
+                **headers,
+                "Authorization": authorization,
+                "Content-Length": str(size),
+            },
+        )
+        try:
+            with urllib.request.urlopen(request, timeout=300):
+                pass
+        except urllib.error.HTTPError as error:
+            raise NotarizationError(
+                f"Apple notarization payload upload failed with HTTP {error.code}"
+            ) from error
+        except OSError as error:
+            raise NotarizationError(
+                "Apple notarization payload upload failed"
+            ) from error
+
+
+def write_developer_log(
+    submission_id: str, token: str, destination: Path | None
+) -> None:
+    """Write the submission's optional diagnostic report."""
+
+    if destination is None:
+        return
+    response = json_request(f"{APPLE_NOTARY_URL}/{submission_id}/logs", token)
+    try:
+        log_url = response["data"]["attributes"]["developerLogUrl"]
+    except (KeyError, TypeError) as error:
+        raise NotarizationError(
+            "Apple did not provide a notarization developer log"
+        ) from error
+    if not isinstance(log_url, str) or not log_url.startswith("https://"):
+        raise NotarizationError(
+            "Apple returned an invalid notarization developer log URL"
+        )
+    try:
+        # Do not forward unrelated authorization headers to the download URL.
+        with urllib.request.urlopen(log_url, timeout=60) as response:
+            destination.write_bytes(response.read())
+    except urllib.error.HTTPError as error:
+        raise NotarizationError(
+            f"Apple notarization developer log download failed with HTTP {error.code}"
+        ) from error
+    except OSError as error:
+        raise NotarizationError(
+            "Apple notarization developer log download failed"
+        ) from error
+
+
+def notarize(
+    path: Path,
+    configuration: NotarizationConfiguration,
+    *,
+    max_wait_seconds: int,
+    report_log: Path | None,
+) -> str:
+    """Submit an artifact, upload it to Apple, and wait for a terminal result."""
+
+    issued_at = int(time.time())
+    token = create_apple_jwt(configuration, issued_at=issued_at)
+    file_digest = sha256_file(path)
+    # Create the submission before uploading the artifact.
+    response = json_request(
+        APPLE_NOTARY_URL,
+        token,
+        body={"sha256": file_digest, "submissionName": path.name},
+    )
+    try:
+        submission_id = response["data"]["id"]
+        upload_credentials = response["data"]["attributes"]
+    except (KeyError, TypeError) as error:
+        raise NotarizationError(
+            "Apple returned an invalid notarization submission"
+        ) from error
+    if not isinstance(submission_id, str) or not submission_id:
+        raise NotarizationError("Apple did not return a notarization submission ID")
+    if not isinstance(upload_credentials, dict):
+        raise NotarizationError(
+            "Apple returned invalid notarization upload credentials"
+        )
+
+    print(f"Uploading notarization submission {submission_id} for {path.name}")
+    upload_to_apple_s3(path, file_digest, upload_credentials)
+    # A monotonic deadline keeps the wait limit stable if the system clock changes.
+    deadline = time.monotonic() + max_wait_seconds
+
+    # Wait for completion, equivalent to `notarytool submit --wait`.
+    while True:
+        # Refresh the token before it expires.
+        if int(time.time()) >= issued_at + JWT_LIFETIME_SECONDS - 60:
+            issued_at = int(time.time())
+            token = create_apple_jwt(configuration, issued_at=issued_at)
+        result = json_request(f"{APPLE_NOTARY_URL}/{submission_id}", token)
+        try:
+            status = result["data"]["attributes"]["status"]
+        except (KeyError, TypeError) as error:
+            raise NotarizationError(
+                "Apple returned an invalid notarization status"
+            ) from error
+
+        if status in {"Accepted", "Invalid", "Rejected"}:
+            # Save diagnostics for both accepted and rejected submissions.
+            write_developer_log(submission_id, token, report_log)
+            message = f"Notarization submission {submission_id} completed with status {status}"
+            if status != "Accepted":
+                raise NotarizationError(message)
+            print(message)
+            return submission_id
+        if status != "In Progress":
+            raise NotarizationError(f"Unexpected notarization status: {status!r}")
+
+        remaining = deadline - time.monotonic()
+        if remaining <= 0:
+            raise NotarizationError(
+                f"Notarization submission {submission_id} exceeded {max_wait_seconds} seconds"
+            )
+        print(f"Notarization submission {submission_id} is still in progress")
+        time.sleep(min(POLL_INTERVAL_SECONDS, remaining))
+
+
+def main() -> int:
+    """Run notarization using command-line arguments."""
+
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--file", type=Path, required=True)
+    parser.add_argument("--report-log", type=Path)
+    parser.add_argument("--max-wait-seconds", type=int, default=600)
+    arguments = parser.parse_args()
+
+    try:
+        if not arguments.file.is_file():
+            raise NotarizationError(
+                f"Notarization payload does not exist: {arguments.file}"
+            )
+        if arguments.max_wait_seconds < 0:
+            raise NotarizationError("--max-wait-seconds must be non-negative")
+        if arguments.report_log is not None:
+            arguments.report_log.parent.mkdir(parents=True, exist_ok=True)
+        notarize(
+            arguments.file,
+            NotarizationConfiguration.from_environment(),
+            max_wait_seconds=arguments.max_wait_seconds,
+            report_log=arguments.report_log,
+        )
+    except NotarizationError as error:
+        print(f"Notarization failed: {error}", file=sys.stderr)
+        return 1
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

.github/scripts/macos-signing/provisioned_macos_cli_package.py

@@ -0,0 +1,229 @@
+"""Prepare and verify provisioned CLI bundles using an explicitly approved profile."""
+
+import argparse
+import hashlib
+import json
+import os
+import plistlib
+import re
+import shutil
+import subprocess
+from dataclasses import dataclass
+from datetime import datetime, timezone
+from pathlib import Path
+
+BUNDLE_ID = "com.openai.codex.cli"
+APP = Path("CodexCLI.app")
+EXECUTABLE = APP / "Contents/MacOS/codex"
+SIGNING = Path(__file__).resolve().parent
+HELPERS = ("bin/codex-code-mode-host", "codex-path/rg", "codex-resources/zsh/bin/zsh")
+LAUNCHER = """#!/bin/sh
+set -eu
+entry="$0"
+while [ -L "$entry" ]; do
+  parent=$(CDPATH= cd -P -- "$(dirname -- "$entry")" && pwd)
+  entry=$(readlink "$entry")
+  case "$entry" in /*) ;; *) entry="$parent/$entry" ;; esac
+done
+bin_dir=$(CDPATH= cd -P -- "$(dirname -- "$entry")" && pwd)
+exec "$bin_dir/../CodexCLI.app/Contents/MacOS/codex" "$@"
+"""
+
+
+@dataclass(frozen=True)
+class ProfileConfiguration:
+    """Independent release expectations; never infer these from the signed package."""
+
+    profile: Path
+    profile_sha256: str
+    certificate_sha256: str
+    team_id: str
+
+    def __post_init__(self):
+        for name in ("profile_sha256", "certificate_sha256"):
+            if not re.fullmatch(r"[0-9a-f]{64}", getattr(self, name)):
+                raise ValueError(f"{name} must be a lowercase SHA-256 digest")
+        if not re.fullmatch(r"[A-Z0-9]{10}", self.team_id):
+            raise ValueError("team_id must be a ten-character Apple Team ID")
+
+    def validate_signing_certificate(self, certificate: Path):
+        certificate_der = subprocess.check_output(
+            ["openssl", "x509", "-in", str(certificate), "-outform", "DER"]
+        )
+        if hashlib.sha256(certificate_der).hexdigest() != self.certificate_sha256:
+            raise ValueError("AKV signing certificate is not authorized by the profile")
+
+
+def load_profile(configuration: ProfileConfiguration):
+    # Pin the portal-approved CMS as well as checking its signature. -noverify
+    # skips OpenSSL's non-Apple trust store, not CMS signature verification.
+    if (
+        hashlib.sha256(configuration.profile.read_bytes()).hexdigest()
+        != configuration.profile_sha256
+    ):
+        raise ValueError("Provisioning profile changed; review and update its pin")
+    profile = plistlib.loads(
+        subprocess.check_output(
+            [
+                "openssl",
+                "cms",
+                "-verify",
+                "-inform",
+                "DER",
+                "-noverify",
+                "-in",
+                str(configuration.profile),
+            ]
+        )
+    )
+    validate_profile(profile, configuration)
+    return profile
+
+
+def validate_profile(profile, configuration: ProfileConfiguration):
+    allowed = profile["Entitlements"]
+    if (
+        profile["TeamIdentifier"] != [configuration.team_id]
+        or profile["ApplicationIdentifierPrefix"] != [configuration.team_id]
+        or allowed["com.apple.application-identifier"]
+        != f"{configuration.team_id}.{BUNDLE_ID}"
+        or allowed["com.apple.developer.team-identifier"] != configuration.team_id
+        or allowed["keychain-access-groups"] != [f"{configuration.team_id}.*"]
+        or allowed.get("get-task-allow", False)
+        or not profile.get("ProvisionsAllDevices")
+        or "ProvisionedDevices" in profile
+    ):
+        raise ValueError("Profile does not authorize the CLI Developer ID identity")
+    now = datetime.now(timezone.utc).replace(tzinfo=None)
+    if not profile["CreationDate"] <= now < profile["ExpirationDate"]:
+        raise ValueError("Provisioning profile is not currently valid")
+    if [
+        hashlib.sha256(cert).hexdigest() for cert in profile["DeveloperCertificates"]
+    ] != [configuration.certificate_sha256]:
+        raise ValueError("Profile does not authorize the approved signing certificate")
+
+
+def entitlements(configuration: ProfileConfiguration):
+    base = plistlib.loads((SIGNING / "codex.entitlements.plist").read_bytes())
+    return {
+        **base,
+        "com.apple.application-identifier": f"{configuration.team_id}.{BUNDLE_ID}",
+        "com.apple.developer.team-identifier": configuration.team_id,
+        "keychain-access-groups": [f"{configuration.team_id}.{BUNDLE_ID}"],
+    }
+
+
+def prepare(package, reports, configuration: ProfileConfiguration):
+    load_profile(configuration)
+    metadata = json.loads((package / "codex-package.json").read_text())
+    if (
+        metadata["variant"] != "codex"
+        or metadata["layoutVersion"] != 1
+        or metadata["target"] not in ("aarch64-apple-darwin", "x86_64-apple-darwin")
+        or metadata["entrypoint"] != "bin/codex"
+    ):
+        raise ValueError("Expected a canonical macOS CLI package")
+    for relative in ("bin/codex", *HELPERS):
+        path = package / relative
+        if path.is_symlink() or not path.is_file() or not os.access(path, os.X_OK):
+            raise ValueError(f"Expected a regular executable: {relative}")
+    # Refuse to overwrite a previously prepared or signed bundle.
+    (package / EXECUTABLE).parent.mkdir(parents=True, exist_ok=False)
+    (package / "bin/codex").rename(package / EXECUTABLE)
+    (package / "bin/codex").write_text(LAUNCHER)
+    (package / "bin/codex").chmod(0o755)
+    contents = package / APP / "Contents"
+    shutil.copyfile(configuration.profile, contents / "embedded.provisionprofile")
+    (contents / "Info.plist").write_bytes(
+        plistlib.dumps(
+            {
+                "CFBundleIdentifier": BUNDLE_ID,
+                "CFBundleExecutable": "codex",
+                "CFBundleName": "Codex CLI",
+                "CFBundlePackageType": "APPL",
+                "CFBundleVersion": "1",
+            }
+        )
+    )
+    reports.mkdir(parents=True, exist_ok=True)
+    # Keep expected entitlements separate from the shared verifier's extracted
+    # codex-entitlements.plist, otherwise it would overwrite its own expectation.
+    (reports / "codex-provisioned-entitlements.plist").write_bytes(
+        plistlib.dumps(entitlements(configuration))
+    )
+
+
+def verify(package, reports, expected_target, configuration: ProfileConfiguration):
+    """Check profile and certificate pins; the signing driver verifies code."""
+    load_profile(configuration)
+    if (
+        package / APP / "Contents/embedded.provisionprofile"
+    ).read_bytes() != configuration.profile.read_bytes():
+        raise ValueError("Embedded profile differs from the reviewed profile")
+    if (package / "bin/codex").read_text() != LAUNCHER:
+        raise ValueError("Unexpected CLI launcher")
+    metadata = json.loads((package / "codex-package.json").read_text())
+    if metadata["target"] != expected_target:
+        raise ValueError(
+            "Package target differs from the requested verification target"
+        )
+    reports.mkdir(parents=True, exist_ok=True)
+    (reports / "codex-provisioned-entitlements.plist").write_bytes(
+        plistlib.dumps(entitlements(configuration))
+    )
+    # sign_macos_cli_package.py owns shared architecture, signature and entitlement
+    # checks. Here, require the exact certificate authorized by the profile.
+    for relative in (EXECUTABLE, *(Path(helper) for helper in HELPERS)):
+        binary = package / relative
+        target = package / APP if relative == EXECUTABLE else binary
+        prefix = reports / f"{binary.name}-cert-"
+        subprocess.run(
+            ["codesign", "-d", f"--extract-certificates={prefix}", str(target)],
+            check=True,
+        )
+        if (
+            hashlib.sha256(Path(f"{prefix}0").read_bytes()).hexdigest()
+            != configuration.certificate_sha256
+        ):
+            raise ValueError(f"Unexpected signing certificate: {relative}")
+
+
+def parse_profile_args(parser, configuration: ProfileConfiguration | None):
+    """Require independent profile expectations unless the caller supplies them."""
+    if configuration is None:
+        parser.add_argument("--profile", type=Path, required=True)
+        parser.add_argument("--profile-sha256", required=True)
+        parser.add_argument("--certificate-sha256", required=True)
+        parser.add_argument("--team-id", required=True)
+    args = parser.parse_args()
+    if configuration is None:
+        configuration = ProfileConfiguration(
+            args.profile, args.profile_sha256, args.certificate_sha256, args.team_id
+        )
+    return args, configuration
+
+
+def main(configuration: ProfileConfiguration | None = None):
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("operation", choices=("prepare", "verify", "validate-profile"))
+    parser.add_argument("--package", type=Path, default=Path("package"))
+    parser.add_argument("--reports", type=Path, default=Path("provisioned-reports"))
+    parser.add_argument("--certificate", type=Path)
+    parser.add_argument(
+        "--target", choices=("aarch64-apple-darwin", "x86_64-apple-darwin")
+    )
+    args, configuration = parse_profile_args(parser, configuration)
+    if args.certificate:
+        configuration.validate_signing_certificate(args.certificate)
+    if args.operation == "validate-profile":
+        load_profile(configuration)
+    elif args.operation == "prepare":
+        prepare(args.package, args.reports, configuration)
+    else:
+        if not args.target:
+            parser.error("--target is required for verification")
+        verify(args.package, args.reports, args.target, configuration)
+
+
+if __name__ == "__main__":
+    main()

.github/scripts/macos-signing/sign_macos_cli_package.py

@@ -0,0 +1,177 @@
+"""Sign and verify macOS CLI packages using the shared AKV and native tools."""
+
+import argparse
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+import provisioned_macos_cli_package as bundle
+
+
+def main(configuration: bundle.ProfileConfiguration | None = None):
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("operation", choices=("sign", "verify"))
+    parser.add_argument("package", type=Path)
+    args, configuration = bundle.parse_profile_args(parser, configuration)
+    package = args.package.resolve(strict=True)
+    if not package.is_dir():
+        parser.error("package must be an extracted CLI package directory")
+    repo_root = os.environ.get("CODEX_REPO_ROOT")
+    if not repo_root:
+        parser.error("CODEX_REPO_ROOT must be set")
+    reports = Path(repo_root) / "signing-verification"
+    reports.mkdir(parents=True, exist_ok=True)
+    provisioned = os.environ.get("PROVISIONED_MACOS", "false") == "true"
+    if provisioned:
+        if args.operation == "sign":
+            configuration.validate_signing_certificate(
+                Path(os.environ["OAI_AKV_SIGNING_CERTIFICATE_PEM"])
+            )
+            bundle.prepare(package, reports, configuration)
+        else:
+            bundle.verify(package, reports, os.environ["TARGET"], configuration)
+
+    for relative in ("bin/codex", *bundle.HELPERS):
+        binary = package / relative
+        name = binary.name
+        target = binary
+        identifier = name
+        entitlements = bundle.SIGNING / f"{name}.entitlements.plist"
+        if provisioned and relative == "bin/codex":
+            binary = package / bundle.EXECUTABLE
+            target = package / bundle.APP
+            identifier = bundle.BUNDLE_ID
+            entitlements = reports / "codex-provisioned-entitlements.plist"
+        if args.operation == "sign":
+            command = [
+                "bash",
+                str(bundle.SIGNING / "sign_macos_code.sh"),
+                "--target",
+                str(target),
+                "--identity",
+                "unused",
+                "--deep",
+                "false",
+                "--options",
+                "runtime",
+                "--timestamp",
+                "true",
+            ]
+            if relative.startswith("bin/"):
+                command.extend(
+                    ["--identifier", identifier, "--entitlements", str(entitlements)]
+                )
+            else:
+                command.extend(["--identifier", f"com.openai.codex.{name}"])
+            subprocess.run(command, check=True)
+            with (reports / f"{name}-signature.yaml").open("wb") as output:
+                subprocess.run(
+                    ["rcodesign", "print-signature-info", str(binary)],
+                    stdout=output,
+                    check=True,
+                )
+            if not provisioned:
+                subprocess.run(
+                    [
+                        "bash",
+                        str(bundle.SIGNING / "notarize_macos_binary_with_akv.sh"),
+                        "--binary",
+                        str(binary),
+                        "--report-dir",
+                        str(reports / name),
+                    ],
+                    check=True,
+                )
+        else:
+            target_triple = os.environ["TARGET"]
+            architectures = {
+                "aarch64-apple-darwin": "arm64",
+                "x86_64-apple-darwin": "x86_64",
+            }
+            if target_triple not in architectures:
+                raise ValueError(f"Unexpected macOS target: {target_triple}")
+            subprocess.run(
+                ["lipo", str(binary), "-verify_arch", architectures[target_triple]],
+                check=True,
+            )
+            subprocess.run(
+                [
+                    "codesign",
+                    "--verify",
+                    "--strict",
+                    "--verbose=2",
+                    "--test-requirement",
+                    # Require Apple's Developer ID Application certificate chain.
+                    (
+                        "=anchor apple generic"
+                        " and certificate 1[field.1.2.840.113635.100.6.2.6] exists"
+                        " and certificate leaf[field.1.2.840.113635.100.6.1.13] exists"
+                    ),
+                    str(target),
+                ],
+                check=True,
+            )
+            signature = reports / f"{name}-signature.txt"
+            with signature.open("wb") as output:
+                subprocess.run(
+                    ["codesign", "-d", "--verbose=4", str(target)],
+                    stderr=output,
+                    check=True,
+                )
+            actual = reports / f"{name}-entitlements.plist"
+            with actual.open("wb") as output:
+                subprocess.run(
+                    ["codesign", "-d", "--entitlements", ":-", str(target)],
+                    stdout=output,
+                    check=True,
+                )
+            if relative.startswith("bin/"):
+                expected = reports / f"{name}-expected.plist"
+                subprocess.run(
+                    [
+                        "plutil",
+                        "-convert",
+                        "xml1",
+                        "-o",
+                        str(expected),
+                        str(entitlements),
+                    ],
+                    check=True,
+                )
+                subprocess.run(["plutil", "-convert", "xml1", str(actual)], check=True)
+                subprocess.run(["diff", "-u", str(expected), str(actual)], check=True)
+            elif actual.stat().st_size:
+                raise ValueError(
+                    f"Bundled helper {name} must not have signing entitlements"
+                )
+
+    if provisioned and args.operation == "sign":
+        archive = Path(os.environ["RUNNER_TEMP"]) / "provisioned-cli.zip"
+        subprocess.run(["zip", "-q", "-r", str(archive), "."], cwd=package, check=True)
+        command = [
+            sys.executable,
+            str(bundle.SIGNING / "notarize_with_akv.py"),
+            "--file",
+            str(archive),
+            "--report-log",
+            str(reports / "notarization-developer-log.json"),
+            "--max-wait-seconds",
+            "1200",
+        ]
+        with (
+            (reports / "notarization.log").open("w") as output,
+            subprocess.Popen(
+                command, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True
+            ) as process,
+        ):
+            assert process.stdout is not None
+            for line in process.stdout:
+                print(line, end="", flush=True)
+                output.write(line)
+            if returncode := process.wait():
+                raise subprocess.CalledProcessError(returncode, command)
+
+
+if __name__ == "__main__":
+    main()

.github/scripts/macos-signing/sign_macos_code.sh

@@ -0,0 +1,245 @@
+#!/usr/bin/env bash
+
+# Small compatibility wrapper around native codesign and rcodesign.
+#
+# Existing packaging scripts call this instead of choosing a signing backend
+# directly. OAI_CODESIGN_BACKEND=akv-pkcs11 routes signing through rcodesign
+# while preserving the option, entitlement, identifier, timestamp, and deep
+# signing surface used by the native codesign path.
+
+set -euo pipefail
+
+usage() {
+  cat >&2 <<'EOF'
+Usage: sign_macos_code.sh --target PATH --identity IDENTITY [options]
+
+Options:
+  --deep true|false
+  --entitlements PATH
+  --identifier IDENTIFIER
+  --identity IDENTITY
+  --options FLAGS
+  --target PATH
+  --timestamp true|false|none
+EOF
+}
+
+target=""
+identity=""
+options=""
+entitlements_file=""
+identifier=""
+deep="false"
+timestamp="true"
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --deep)
+      deep="${2:-}"
+      shift 2
+      ;;
+    --entitlements)
+      entitlements_file="${2:-}"
+      shift 2
+      ;;
+    --identifier)
+      identifier="${2:-}"
+      shift 2
+      ;;
+    --identity)
+      identity="${2:-}"
+      shift 2
+      ;;
+    --options)
+      options="${2:-}"
+      shift 2
+      ;;
+    --target)
+      target="${2:-}"
+      shift 2
+      ;;
+    --timestamp)
+      timestamp="${2:-}"
+      shift 2
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "Unknown signing argument: $1" >&2
+      usage
+      exit 2
+      ;;
+  esac
+done
+
+if [[ -z "$target" ]]; then
+  echo "--target is required." >&2
+  usage
+  exit 2
+fi
+
+if [[ ! -e "$target" ]]; then
+  echo "Signing target does not exist: $target" >&2
+  exit 1
+fi
+
+case "$deep" in
+  true|false) ;;
+  *)
+    echo "--deep must be true or false, got '$deep'." >&2
+    exit 2
+    ;;
+esac
+
+case "$timestamp" in
+  true|false|none) ;;
+  *)
+    echo "--timestamp must be true, false, or none, got '$timestamp'." >&2
+    exit 2
+    ;;
+esac
+
+sign_with_codesign() {
+  if [[ -z "$identity" ]]; then
+    echo "Native codesign requires --identity." >&2
+    exit 2
+  fi
+
+  local -a args
+  args=(--force)
+
+  if [[ "$deep" == "true" ]]; then
+    args+=(--deep)
+  fi
+
+  if [[ -n "$options" ]]; then
+    args+=(--options "$options")
+  fi
+
+  case "$timestamp" in
+    true)
+      args+=(--timestamp)
+      ;;
+    false|none)
+      args+=(--timestamp=none)
+      ;;
+  esac
+
+  if [[ -n "$entitlements_file" ]]; then
+    args+=(--entitlements "$entitlements_file")
+  fi
+
+  if [[ -n "$identifier" ]]; then
+    args+=(--identifier "$identifier")
+  fi
+
+  args+=(--sign "$identity" "$target")
+  codesign "${args[@]}"
+}
+
+append_rcodesign_flags() {
+  local raw_options="$1"
+  local option=""
+
+  if [[ -z "$raw_options" ]]; then
+    return 0
+  fi
+
+  IFS=',' read -ra split_options <<< "$raw_options"
+  for option in "${split_options[@]}"; do
+    option="${option//[[:space:]]/}"
+    [[ -z "$option" ]] && continue
+
+    case "$option" in
+      host|hard|kill|expires|restrict|library|runtime|linker-signed)
+        rcodesign_args+=(--code-signature-flags "$option")
+        ;;
+      *)
+        echo "Unsupported rcodesign code signature option: $option" >&2
+        exit 2
+        ;;
+    esac
+  done
+}
+
+rcodesign_options_require_notarization() {
+  local raw_options="$1"
+  local option=""
+
+  if [[ -z "$raw_options" || "$timestamp" != "true" ]]; then
+    return 1
+  fi
+
+  IFS=',' read -ra split_options <<< "$raw_options"
+  for option in "${split_options[@]}"; do
+    option="${option//[[:space:]]/}"
+    if [[ "$option" == "runtime" ]]; then
+      return 0
+    fi
+  done
+
+  return 1
+}
+
+sign_with_rcodesign() {
+  : "${OAI_AKV_PKCS11_LIBRARY:?OAI_AKV_PKCS11_LIBRARY is required for AKV PKCS11 signing.}"
+  : "${OAI_AKV_SIGNING_CERTIFICATE_PEM:?OAI_AKV_SIGNING_CERTIFICATE_PEM is required for AKV PKCS11 signing.}"
+  : "${OAI_AKV_KEY_LABEL:?OAI_AKV_KEY_LABEL is required for AKV PKCS11 signing.}"
+
+  if ! command -v rcodesign >/dev/null 2>&1; then
+    echo "rcodesign was not found on PATH." >&2
+    exit 1
+  fi
+
+  local -a rcodesign_args
+  rcodesign_args=(
+    sign
+    --config-file /dev/null
+    --pkcs11-library "$OAI_AKV_PKCS11_LIBRARY"
+    --pkcs11-certificate-file "$OAI_AKV_SIGNING_CERTIFICATE_PEM"
+    --pkcs11-key-label "$OAI_AKV_KEY_LABEL"
+  )
+
+  if [[ "$deep" == "false" ]]; then
+    rcodesign_args+=(--shallow)
+  fi
+
+  case "$timestamp" in
+    true)
+      ;;
+    false|none)
+      rcodesign_args+=(--timestamp-url none)
+      ;;
+  esac
+
+  append_rcodesign_flags "$options"
+  if rcodesign_options_require_notarization "$options"; then
+    rcodesign_args+=(--for-notarization)
+  fi
+
+  if [[ -n "$entitlements_file" ]]; then
+    rcodesign_args+=(--entitlements-xml-file "$entitlements_file")
+  fi
+
+  if [[ -n "$identifier" ]]; then
+    rcodesign_args+=(--binary-identifier "$identifier")
+  fi
+
+  rcodesign_args+=("$target")
+  rcodesign "${rcodesign_args[@]}"
+}
+
+case "${OAI_CODESIGN_BACKEND:-codesign}" in
+  codesign|"")
+    sign_with_codesign
+    ;;
+  akv-pkcs11)
+    sign_with_rcodesign
+    ;;
+  *)
+    echo "Unsupported OAI_CODESIGN_BACKEND: ${OAI_CODESIGN_BACKEND}" >&2
+    exit 2
+    ;;
+esac

.github/scripts/macos-signing/test_notarize_with_akv.py

@@ -0,0 +1,257 @@
+import contextlib
+import hashlib
+import io
+import json
+import os
+import subprocess
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+from unittest.mock import patch
+
+SIGNING_DIRECTORY = Path(__file__).resolve().parent
+sys.path.insert(0, str(SIGNING_DIRECTORY))
+import notarize_with_akv as notary  # noqa: E402
+
+CONFIGURATION = notary.NotarizationConfiguration(
+    "01234567-89ab-cdef-0123-456789abcdef",
+    "APPLEKEY01",
+    "notary-vault",
+    "example-signing-key",
+    "0123456789abcdef" * 2,
+)
+ENVIRONMENT = {
+    "AZURE_KEYVAULT_NAME": CONFIGURATION.vault_name,
+    "APPLE_NOTARIZATION_AKV_KEY_NAME": CONFIGURATION.vault_key_name,
+}
+CREDENTIALS = {
+    "awsAccessKeyId": "temporary-access-key",
+    "awsSecretAccessKey": "temporary-secret-key",
+    "awsSessionToken": "temporary-session-token",
+    "bucket": "apple-notary-bucket",
+    "object": "uploads/release artifact.dmg",
+}
+
+
+def response(payload):
+    return io.BytesIO(
+        json.dumps(payload).encode() if isinstance(payload, dict) else payload
+    )
+
+
+def azure_response(payload):
+    return subprocess.CompletedProcess([], 0, stdout=json.dumps(payload), stderr="")
+
+
+class NotarizationTest(unittest.TestCase):
+    def test_validates_the_apple_key_tags_and_pins_its_version(self) -> None:
+        metadata = {
+            "id": CONFIGURATION.versioned_key_id,
+            "apple_key_id": "APPLEKEY01",
+            "apple_issuer_id": CONFIGURATION.issuer_id,
+        }
+        with (
+            patch.dict(os.environ, ENVIRONMENT, clear=True),
+            patch.object(
+                notary.subprocess,
+                "run",
+                return_value=azure_response(metadata),
+            ) as show,
+        ):
+            self.assertEqual(
+                notary.NotarizationConfiguration.from_environment(),
+                CONFIGURATION,
+            )
+            show.return_value = azure_response({**metadata, "apple_key_id": None})
+            with self.assertRaisesRegex(notary.NotarizationError, "apple-key-id tag"):
+                notary.NotarizationConfiguration.from_environment()
+            for issuer_id in (None, "", "   "):
+                with self.subTest(issuer_id=issuer_id):
+                    show.return_value = azure_response(
+                        {**metadata, "apple_issuer_id": issuer_id}
+                    )
+                    with self.assertRaisesRegex(
+                        notary.NotarizationError, "apple-issuer-id tag"
+                    ):
+                        notary.NotarizationConfiguration.from_environment()
+            show.return_value = azure_response(
+                {**metadata, "apple_issuer_id": "invalid-issuer"}
+            )
+            with self.assertRaisesRegex(notary.NotarizationError, "valid UUID"):
+                notary.NotarizationConfiguration.from_environment()
+        self.assertIn(
+            '{id:key.kid,apple_key_id:tags."apple-key-id",'
+            'apple_issuer_id:tags."apple-issuer-id"}',
+            show.call_args.args[0],
+        )
+
+        invalid_environment = {
+            **ENVIRONMENT,
+            "APPLE_NOTARIZATION_AKV_KEY_NAME": "../bad",
+        }
+        with (
+            patch.dict(os.environ, invalid_environment, clear=True),
+            self.assertRaisesRegex(notary.NotarizationError, "key name"),
+        ):
+            notary.NotarizationConfiguration.from_environment()
+
+    def test_signs_the_notary_scoped_digest_with_the_pinned_key(self) -> None:
+        signature = bytes(range(64))
+        payload = {
+            "kid": CONFIGURATION.versioned_key_id,
+            "value": notary.base64url_encode(signature),
+        }
+        with patch.object(
+            notary.subprocess, "run", return_value=azure_response(payload)
+        ) as sign:
+            token = notary.create_apple_jwt(CONFIGURATION, issued_at=1_780_000_000)
+        header, claims, encoded_signature = token.split(".")
+        self.assertEqual(
+            json.loads(notary.base64url_decode(header))["kid"], "APPLEKEY01"
+        )
+        self.assertEqual(
+            json.loads(notary.base64url_decode(claims))["iss"], CONFIGURATION.issuer_id
+        )
+        self.assertEqual(
+            json.loads(notary.base64url_decode(claims))["scope"],
+            ["/notary/v2"],
+        )
+        self.assertEqual(notary.base64url_decode(encoded_signature), signature)
+        command = sign.call_args.args[0]
+        body = json.loads(command[command.index("--body") + 1])
+        self.assertEqual(body["alg"], "ES256")
+        self.assertEqual(
+            notary.base64url_decode(body["value"]),
+            hashlib.sha256(f"{header}.{claims}".encode()).digest(),
+        )
+
+    def test_rejects_wrong_key_versions_and_invalid_signatures(self) -> None:
+        cases = (
+            (
+                CONFIGURATION.versioned_key_id + "wrong",
+                bytes(64),
+                "unexpected key version",
+            ),
+            (CONFIGURATION.versioned_key_id, b"short", "64 JOSE"),
+        )
+        for key_id, signature, message in cases:
+            payload = {"kid": key_id, "value": notary.base64url_encode(signature)}
+            with (
+                self.subTest(message=message),
+                patch.object(
+                    notary.subprocess,
+                    "run",
+                    return_value=azure_response(payload),
+                ),
+                self.assertRaisesRegex(notary.NotarizationError, message),
+            ):
+                notary.create_apple_jwt(CONFIGURATION, issued_at=1)
+
+    def test_uploads_polls_and_retains_sanitized_apple_diagnostics(self) -> None:
+        signature = azure_response(
+            {
+                "kid": CONFIGURATION.versioned_key_id,
+                "value": notary.base64url_encode(bytes(64)),
+            }
+        )
+        responses = [
+            response({"data": {"id": "submission-1", "attributes": CREDENTIALS}}),
+            response(b""),
+            response({"data": {"attributes": {"status": "In Progress"}}}),
+            response({"data": {"attributes": {"status": "Accepted"}}}),
+            response(
+                {
+                    "data": {
+                        "attributes": {
+                            "developerLogUrl": "https://logs.example.com/log"
+                        }
+                    }
+                }
+            ),
+            response(b'{"status":"Accepted"}'),
+        ]
+        with tempfile.TemporaryDirectory() as directory:
+            artifact, log = (
+                Path(directory) / "codex.zip",
+                Path(directory) / "notary-log.json",
+            )
+            artifact.write_bytes(b"signed release binary")
+            output = io.StringIO()
+            with (
+                patch.object(notary.subprocess, "run", return_value=signature),
+                patch.object(
+                    notary.urllib.request, "urlopen", side_effect=responses
+                ) as requests,
+                patch.object(notary.time, "sleep") as sleep,
+                contextlib.redirect_stdout(output),
+            ):
+                submission = notary.notarize(
+                    artifact, CONFIGURATION, max_wait_seconds=600, report_log=log
+                )
+            self.assertEqual(submission, "submission-1")
+            self.assertEqual(json.loads(log.read_text()), {"status": "Accepted"})
+            sleep.assert_called_once_with(10)
+            upload = requests.call_args_list[1].args[0]
+            self.assertEqual(upload.get_method(), "PUT")
+            self.assertNotIn("temporary-secret-key", upload.get_header("Authorization"))
+            self.assertNotIn("temporary-secret-key", output.getvalue())
+
+
+class NotarizationWrapperTest(unittest.TestCase):
+    def test_binary_and_dmg_wrappers_preserve_notarization_contracts(
+        self,
+    ) -> None:
+        with tempfile.TemporaryDirectory() as directory:
+            root, tools = Path(directory), Path(directory) / "tools"
+            tools.mkdir()
+            call_log = root / "calls.txt"
+            environment = {
+                **os.environ,
+                **ENVIRONMENT,
+                "PATH": f"{tools}:{os.environ['PATH']}",
+                "RUNNER_TEMP": str(root),
+                "CALL_LOG": str(call_log),
+            }
+            for name in ("az", "python3", "rcodesign"):
+                body = (
+                    "exit 0"
+                    if name == "az"
+                    else f'printf "{name} %s\\n" "$*" >> "$CALL_LOG"'
+                )
+                executable = tools / name
+                executable.write_text(
+                    f"#!/usr/bin/env bash\nset -euo pipefail\n{body}\n"
+                )
+                executable.chmod(0o755)
+            for kind in ("binary", "dmg"):
+                with self.subTest(kind=kind):
+                    artifact = root / ("codex.dmg" if kind == "dmg" else "codex")
+                    artifact.write_bytes(b"signed release artifact")
+                    subprocess.run(
+                        [
+                            str(
+                                SIGNING_DIRECTORY / f"notarize_macos_{kind}_with_akv.sh"
+                            ),
+                            f"--{kind}",
+                            str(artifact),
+                            "--report-dir",
+                            str(root / "report"),
+                        ],
+                        env=environment,
+                        check=True,
+                        capture_output=True,
+                        text=True,
+                    )
+                    calls = call_log.read_text().splitlines()
+                    self.assertIn("notarize_with_akv.py --file", calls[0])
+                    if kind == "dmg":
+                        self.assertEqual(calls[1], f"rcodesign staple {artifact}")
+                    else:
+                        self.assertEqual(len(calls), 1)
+                    self.assertEqual(list(root.rglob("*.p8")), [])
+                    call_log.unlink()
+
+
+if __name__ == "__main__":
+    unittest.main()

.github/scripts/macos-signing/test_provisioned_macos_cli_package.py

@@ -0,0 +1,217 @@
+"""Exercise profile validation, relocation and signing without release credentials."""
+
+import copy
+import hashlib
+import json
+import plistlib
+import shutil
+import ssl
+import subprocess
+import tarfile
+import tempfile
+import unittest
+from dataclasses import replace
+from datetime import datetime, timedelta, timezone
+from pathlib import Path
+
+import provisioned_macos_cli_package as bundle
+
+
+class ProvisioningTestCase(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        directory = tempfile.TemporaryDirectory()
+        cls.addClassCleanup(directory.cleanup)
+        root = Path(directory.name)
+        key = root / "test-key.pem"
+        certificate = root / "test-certificate.pem"
+        subprocess.run(
+            [
+                "openssl",
+                "req",
+                "-x509",
+                "-newkey",
+                "rsa:2048",
+                "-nodes",
+                "-keyout",
+                str(key),
+                "-out",
+                str(certificate),
+                "-days",
+                "1",
+                "-subj",
+                "/CN=CLI provisioning test/OU=TESTTEAM01",
+            ],
+            check=True,
+            capture_output=True,
+        )
+        cert_der = ssl.PEM_cert_to_DER_cert(certificate.read_text())
+        now = datetime.now(timezone.utc).replace(tzinfo=None, microsecond=0)
+        cls.profile = {
+            "TeamIdentifier": ["TESTTEAM01"],
+            "ApplicationIdentifierPrefix": ["TESTTEAM01"],
+            "Entitlements": {
+                "com.apple.application-identifier": "TESTTEAM01.com.openai.codex.cli",
+                "com.apple.developer.team-identifier": "TESTTEAM01",
+                "keychain-access-groups": ["TESTTEAM01.*"],
+            },
+            "CreationDate": now - timedelta(days=1),
+            "ExpirationDate": now + timedelta(days=1),
+            "ProvisionsAllDevices": True,
+            "DeveloperCertificates": [cert_der],
+        }
+        payload = root / "profile.plist"
+        payload.write_bytes(plistlib.dumps(cls.profile))
+        profile_path = root / "test.provisionprofile"
+        subprocess.run(
+            [
+                "openssl",
+                "cms",
+                "-sign",
+                "-binary",
+                "-nodetach",
+                "-outform",
+                "DER",
+                "-in",
+                str(payload),
+                "-signer",
+                str(certificate),
+                "-inkey",
+                str(key),
+                "-out",
+                str(profile_path),
+            ],
+            check=True,
+            capture_output=True,
+        )
+        cls.configuration = bundle.ProfileConfiguration(
+            profile=profile_path,
+            profile_sha256=hashlib.sha256(profile_path.read_bytes()).hexdigest(),
+            certificate_sha256=hashlib.sha256(cert_der).hexdigest(),
+            team_id="TESTTEAM01",
+        )
+
+
+class ProvisionedCliTests(ProvisioningTestCase):
+    def test_profile_configuration_fails_closed(self):
+        self.assertEqual(bundle.load_profile(self.configuration), self.profile)
+        for changes in (
+            {"profile_sha256": "0" * 64},
+            {"certificate_sha256": "0" * 64},
+            {"team_id": "OTHERTEAM1"},
+            {"profile_sha256": ""},
+            {"certificate_sha256": ""},
+            {"team_id": ""},
+        ):
+            with self.subTest(changes=changes), self.assertRaises(ValueError):
+                bundle.load_profile(replace(self.configuration, **changes))
+
+    def test_rejects_profile_with_wrong_identity_certificate_or_validity(self):
+        for field, value in (
+            ("TeamIdentifier", ["OTHERTEAM"]),
+            ("DeveloperCertificates", [b"another certificate"]),
+            (
+                "ExpirationDate",
+                datetime(2000, 1, 1, tzinfo=timezone.utc).replace(tzinfo=None),
+            ),
+            (
+                "CreationDate",
+                datetime(2099, 1, 1, tzinfo=timezone.utc).replace(tzinfo=None),
+            ),
+            ("ProvisionsAllDevices", False),
+            ("ProvisionedDevices", ["device"]),
+        ):
+            with self.subTest(field=field):
+                profile = copy.deepcopy(self.profile)
+                profile[field] = value
+                with self.assertRaises(ValueError):
+                    bundle.validate_profile(profile, self.configuration)
+        for field, value in (
+            (
+                "com.apple.application-identifier",
+                f"{self.configuration.team_id}.another.app",
+            ),
+            ("keychain-access-groups", [f"{self.configuration.team_id}.another.app"]),
+            ("get-task-allow", True),
+        ):
+            with self.subTest(field=field):
+                profile = copy.deepcopy(self.profile)
+                profile["Entitlements"][field] = value
+                with self.assertRaises(ValueError):
+                    bundle.validate_profile(profile, self.configuration)
+
+    def test_archive_relocation_copy_and_symlink_preserve_launcher(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            package = root / "original package"
+            metadata = {
+                "variant": "codex",
+                "layoutVersion": 1,
+                "target": "aarch64-apple-darwin",
+                "entrypoint": "bin/codex",
+            }
+            for relative in ("bin/codex", *bundle.HELPERS):
+                path = package / relative
+                path.parent.mkdir(parents=True, exist_ok=True)
+                path.write_text('#!/bin/sh\nprintf "%s\\n" "$@"\nexit 23\n')
+                path.chmod(0o755)
+            (package / "codex-package.json").write_text(json.dumps(metadata))
+            original_binary = (package / "bin/codex").read_bytes()
+            bundle.prepare(package, root / "reports", self.configuration)
+            with self.assertRaises(FileExistsError):
+                bundle.prepare(package, root / "reports", self.configuration)
+            with self.assertRaisesRegex(ValueError, "Package target differs"):
+                bundle.verify(
+                    package, root / "reports", "x86_64-apple-darwin", self.configuration
+                )
+            self.assertEqual(
+                (package / bundle.EXECUTABLE).read_bytes(), original_binary
+            )
+            self.assertEqual(
+                json.loads((package / "codex-package.json").read_text()), metadata
+            )
+
+            archive_path = root / "package.tar.gz"
+            with tarfile.open(archive_path, "w:gz") as archive:
+                archive.add(package, arcname=".")
+            relocated = root / "relocated package"
+            with tarfile.open(archive_path) as archive:
+                archive.extractall(relocated, filter="data")
+            shutil.rmtree(package)
+            # npm currently dereferences symlinks when copying packages. The
+            # launcher remains a script and the provisioned executable stays put.
+            copied = root / "copied package"
+            shutil.copytree(relocated, copied)
+            link = root / "installed codex"
+            link.symlink_to(Path("copied package/bin/codex"))
+            absolute_link = root / "absolute codex"
+            absolute_link.symlink_to(link)
+            for entry in (
+                relocated / "bin/codex",
+                copied / "bin/codex",
+                link,
+                absolute_link,
+            ):
+                with self.subTest(entry=entry):
+                    result = subprocess.run(
+                        [str(entry), "space argument", "*", "--flag"],
+                        cwd="/",
+                        capture_output=True,
+                        text=True,
+                        check=False,
+                    )
+                    self.assertEqual(
+                        (result.returncode, result.stdout, result.stderr),
+                        (23, "space argument\n*\n--flag\n", ""),
+                    )
+            (copied / bundle.APP / "Contents/embedded.provisionprofile").write_bytes(
+                b"tampered"
+            )
+            with self.assertRaisesRegex(ValueError, "Embedded profile differs"):
+                bundle.verify(
+                    copied, root / "reports", "aarch64-apple-darwin", self.configuration
+                )
+
+
+if __name__ == "__main__":
+    unittest.main()

.github/scripts/macos-signing/test_sign_macos_cli_package.py

@@ -0,0 +1,293 @@
+"""Exercise package signing and native verification with generated credentials."""
+
+import itertools
+import json
+import os
+import shutil
+import ssl
+import subprocess
+import sys
+import tempfile
+import unittest
+import zipfile
+from pathlib import Path
+
+import provisioned_macos_cli_package as bundle
+from test_provisioned_macos_cli_package import ProvisioningTestCase
+
+NATIVE_TOOL = """#!/usr/bin/env python3
+import json, os, plistlib, sys
+from pathlib import Path
+name = Path(sys.argv[0]).name
+args = sys.argv[1:]
+with open(os.environ["CALL_LOG"], "a") as log:
+    log.write(json.dumps([name, *args]) + "\\n")
+if name == "codesign":
+    for arg in args:
+        if arg.startswith("--extract-certificates="):
+            Path(arg.split("=", 1)[1] + "0").write_bytes(Path(os.environ["MOCK_CERTIFICATE"]).read_bytes())
+    if "--test-requirement" in args and os.environ.get("MOCK_WRONG_SIGNING_IDENTITY"):
+        print("code failed to satisfy specified code requirement(s)", file=sys.stderr)
+        sys.exit(1)
+    if "--entitlements" in args:
+        target = Path(args[-1]).name
+        if target == "CodexCLI.app":
+            source = Path(os.environ["CODEX_REPO_ROOT"]) / "signing-verification/codex-provisioned-entitlements.plist"
+        elif target in ("codex", "codex-code-mode-host"):
+            source = Path(os.environ["MOCK_SIGNING_SCRIPTS"]) / (target + ".entitlements.plist")
+        else:
+            sys.exit(0)
+        if os.environ.get("MOCK_WRONG_ENTITLEMENTS"):
+            sys.stdout.buffer.write(plistlib.dumps({"unexpected": True}))
+        else:
+            sys.stdout.buffer.write(source.read_bytes())
+elif name == "plutil":
+    source = Path(args[-1])
+    target = Path(args[args.index("-o") + 1]) if "-o" in args else source
+    target.write_bytes(plistlib.dumps(plistlib.loads(source.read_bytes())))
+"""
+
+
+class MacosSigningTests(ProvisioningTestCase):
+    def fixture(self, root, provisioned, target="aarch64-apple-darwin"):
+        source = Path(bundle.__file__).parent
+        common = Path(os.path.commonpath((source, bundle.SIGNING)))
+        helpers = root / source.relative_to(common)
+        scripts = root / bundle.SIGNING.relative_to(common)
+        helpers.mkdir(parents=True, exist_ok=True)
+        scripts.mkdir(parents=True, exist_ok=True)
+        for name in ("provisioned_macos_cli_package.py", "sign_macos_cli_package.py"):
+            shutil.copyfile(source / name, helpers / name)
+        for path in bundle.SIGNING.glob("*.entitlements.plist"):
+            shutil.copyfile(path, scripts / path.name)
+        (root / "record.py").write_text(
+            "import json, os, sys\n"
+            "with open(os.environ['CALL_LOG'], 'a') as log:\n"
+            "    log.write(json.dumps(sys.argv[1:]) + '\\n')\n"
+            "if os.environ.get('FAIL_TOOL') == sys.argv[1]:\n"
+            "    print('fixture stdout', flush=True)\n"
+            "    print('fixture stderr', file=sys.stderr, flush=True)\n"
+            "    sys.exit(17)\n"
+        )
+        for name in ("sign_macos_code.sh", "notarize_macos_binary_with_akv.sh"):
+            (scripts / name).write_text(
+                'python3 "$CODEX_REPO_ROOT/record.py" "$(basename "$0")" "$@"\n'
+            )
+        (scripts / "notarize_with_akv.py").write_text(
+            "import os, runpy, sys\n"
+            "sys.argv.insert(1, 'notarize_with_akv.py')\n"
+            "runpy.run_path(os.environ['CODEX_REPO_ROOT'] + '/record.py')\n"
+        )
+        for name in ("rcodesign", "codesign", "lipo", "plutil"):
+            path = root / name
+            path.write_text(NATIVE_TOOL)
+            path.chmod(0o755)
+        certificate_der = self.profile["DeveloperCertificates"][0]
+        certificate = root / "certificate.pem"
+        certificate.write_text(ssl.DER_cert_to_PEM_cert(certificate_der))
+        (root / "certificate.der").write_bytes(certificate_der)
+        package = root / "package with spaces"
+        for relative in ("bin/codex", *bundle.HELPERS):
+            path = package / relative
+            path.parent.mkdir(parents=True, exist_ok=True)
+            path.write_text("#!/bin/sh\nexit 0\n")
+            path.chmod(0o755)
+        (package / "codex-package.json").write_text(
+            json.dumps(
+                {
+                    "variant": "codex",
+                    "layoutVersion": 1,
+                    "target": target,
+                    "entrypoint": "bin/codex",
+                }
+            )
+        )
+        env = {
+            key: value
+            for key, value in os.environ.items()
+            if key not in ("GITHUB_WORKSPACE", "CODEX_PROVISIONING_HELPER")
+        }
+        env.update(
+            CODEX_REPO_ROOT=str(root),
+            RUNNER_TEMP=str(root),
+            TARGET=target,
+            PATH=f"{root}{os.pathsep}{os.environ['PATH']}",
+            CALL_LOG=str(root / "calls.jsonl"),
+            PROVISIONED_MACOS=str(provisioned).lower(),
+            OAI_AKV_SIGNING_CERTIFICATE_PEM=str(certificate),
+            MOCK_CERTIFICATE=str(root / "certificate.der"),
+            MOCK_SIGNING_SCRIPTS=str(scripts),
+        )
+        return package, helpers / "sign_macos_cli_package.py", env
+
+    def run_driver(self, driver, operation, package, env):
+        return subprocess.run(
+            [
+                sys.executable,
+                str(driver),
+                operation,
+                str(package),
+                "--profile",
+                str(self.configuration.profile),
+                "--profile-sha256",
+                self.configuration.profile_sha256,
+                "--certificate-sha256",
+                self.configuration.certificate_sha256,
+                "--team-id",
+                self.configuration.team_id,
+            ],
+            env=env,
+            capture_output=True,
+            text=True,
+            timeout=30,
+            check=False,
+        )
+
+    def test_standard_and_provisioned_signing_and_verification(self):
+        for provisioned, target in itertools.product(
+            (False, True), ("aarch64-apple-darwin", "x86_64-apple-darwin")
+        ):
+            with (
+                self.subTest(provisioned=provisioned, target=target),
+                tempfile.TemporaryDirectory() as directory,
+            ):
+                root = Path(directory).resolve()
+                package, driver, env = self.fixture(root, provisioned, target)
+                result = self.run_driver(driver, "sign", package, env)
+                self.assertEqual(result.returncode, 0, result.stderr)
+                result = self.run_driver(driver, "verify", package, env)
+                self.assertEqual(result.returncode, 0, result.stderr)
+                calls = [
+                    json.loads(line)
+                    for line in (root / "calls.jsonl").read_text().splitlines()
+                ]
+                signing = [call for call in calls if call[0] == "sign_macos_code.sh"]
+                self.assertEqual(
+                    [call[call.index("--target") + 1] for call in signing],
+                    [
+                        str(package / relative)
+                        for relative in (
+                            bundle.APP if provisioned else "bin/codex",
+                            *bundle.HELPERS,
+                        )
+                    ],
+                )
+                self.assertEqual(
+                    signing[0][signing[0].index("--entitlements") + 1],
+                    str(
+                        root
+                        / "signing-verification/codex-provisioned-entitlements.plist"
+                    )
+                    if provisioned
+                    else str(
+                        Path(env["MOCK_SIGNING_SCRIPTS"]) / "codex.entitlements.plist"
+                    ),
+                )
+                self.assertEqual(
+                    ["--entitlements" in call for call in signing],
+                    [True, True, False, False],
+                )
+                self.assertEqual(
+                    [call[0] for call in calls if call[0].startswith("notarize")],
+                    ["notarize_with_akv.py"]
+                    if provisioned
+                    else ["notarize_macos_binary_with_akv.sh"] * 4,
+                )
+                self.assertEqual(
+                    [call[1:] for call in calls if call[0] == "lipo"],
+                    [
+                        [
+                            str(package / relative),
+                            "-verify_arch",
+                            "arm64" if target.startswith("aarch64") else "x86_64",
+                        ]
+                        for relative in (
+                            bundle.EXECUTABLE if provisioned else "bin/codex",
+                            *bundle.HELPERS,
+                        )
+                    ],
+                )
+                if provisioned:
+                    with zipfile.ZipFile(root / "provisioned-cli.zip") as archive:
+                        self.assertEqual(
+                            archive.read(
+                                "CodexCLI.app/Contents/embedded.provisionprofile"
+                            ),
+                            self.configuration.profile.read_bytes(),
+                        )
+                        self.assertEqual(
+                            archive.read("bin/codex").decode(), bundle.LAUNCHER
+                        )
+                        self.assertTrue(
+                            all(
+                                helper in archive.namelist()
+                                for helper in bundle.HELPERS
+                            )
+                        )
+
+    def test_signing_and_notarization_failures_stop_the_driver(self):
+        for tool in ("sign_macos_code.sh", "notarize_with_akv.py"):
+            with self.subTest(tool=tool), tempfile.TemporaryDirectory() as directory:
+                root = Path(directory).resolve()
+                package, driver, env = self.fixture(root, True)
+                result = self.run_driver(
+                    driver, "sign", package, {**env, "FAIL_TOOL": tool}
+                )
+                self.assertNotEqual(result.returncode, 0)
+                calls = [
+                    json.loads(line)
+                    for line in (root / "calls.jsonl").read_text().splitlines()
+                ]
+                self.assertEqual(calls[-1][0], tool)
+                if tool == "notarize_with_akv.py":
+                    self.assertEqual(
+                        (root / "signing-verification/notarization.log").read_text(),
+                        "fixture stdout\nfixture stderr\n",
+                    )
+                    self.assertIn("fixture stdout\nfixture stderr\n", result.stdout)
+                else:
+                    self.assertFalse((root / "provisioned-cli.zip").exists())
+
+    def test_verification_rejects_wrong_signing_identity_and_entitlements(self):
+        for provisioned, failure in itertools.product(
+            (False, True), ("MOCK_WRONG_SIGNING_IDENTITY", "MOCK_WRONG_ENTITLEMENTS")
+        ):
+            with (
+                self.subTest(provisioned=provisioned, failure=failure),
+                tempfile.TemporaryDirectory() as directory,
+            ):
+                root = Path(directory).resolve()
+                package, driver, env = self.fixture(root, provisioned)
+                signed = self.run_driver(driver, "sign", package, env)
+                self.assertEqual(signed.returncode, 0, signed.stderr)
+                result = self.run_driver(
+                    driver, "verify", package, {**env, failure: "true"}
+                )
+                self.assertNotEqual(result.returncode, 0)
+                if failure == "MOCK_WRONG_SIGNING_IDENTITY":
+                    self.assertIn(
+                        "code failed to satisfy specified code requirement(s)",
+                        result.stderr,
+                    )
+                else:
+                    self.assertIn("unexpected", result.stdout)
+
+    def test_cli_requires_independent_profile_configuration(self):
+        with tempfile.TemporaryDirectory() as directory:
+            result = subprocess.run(
+                [
+                    sys.executable,
+                    str(Path(bundle.__file__).with_name("sign_macos_cli_package.py")),
+                    "verify",
+                    directory,
+                ],
+                capture_output=True,
+                text=True,
+                check=False,
+            )
+            self.assertEqual(result.returncode, 2)
+            self.assertIn("the following arguments are required", result.stderr)
+
+
+if __name__ == "__main__":
+    unittest.main()

docs/CLA.md

@@ -0,0 +1,49 @@
+# Individual Contributor License Agreement (v1.0, OpenAI)
+
+_Based on the Apache Software Foundation Individual CLA v 2.2._
+
+By commenting **“I have read the CLA Document and I hereby sign the CLA”**
+on a Pull Request, **you (“Contributor”) agree to the following terms** for any
+past and future “Contributions” submitted to the **OpenAI Codex CLI project
+(the “Project”)**.
+
+---
+
+## 1. Definitions
+
+- **“Contribution”** – any original work of authorship submitted to the Project
+  (code, documentation, designs, etc.).
+- **“You” / “Your”** – the individual (or legal entity) posting the acceptance
+  comment.
+
+## 2. Copyright License
+
+You grant **OpenAI, Inc.** and all recipients of software distributed by the
+Project a perpetual, worldwide, non‑exclusive, royalty‑free, irrevocable
+license to reproduce, prepare derivative works of, publicly display, publicly
+perform, sublicense, and distribute Your Contributions and derivative works.
+
+## 3. Patent License
+
+You grant **OpenAI, Inc.** and all recipients of the Project a perpetual,
+worldwide, non‑exclusive, royalty‑free, irrevocable (except as below) patent
+license to make, have made, use, sell, offer to sell, import, and otherwise
+transfer Your Contributions alone or in combination with the Project.
+
+If any entity brings patent litigation alleging that the Project or a
+Contribution infringes a patent, the patent licenses granted by You to that
+entity under this CLA terminate.
+
+## 4. Representations
+
+1. You are legally entitled to grant the licenses above.
+2. Each Contribution is either Your original creation or You have authority to
+   submit it under this CLA.
+3. Your Contributions are provided **“AS IS”** without warranties of any kind.
+4. You will notify the Project if any statement above becomes inaccurate.
+
+## 5. Miscellany
+
+This Agreement is governed by the laws of the **State of California**, USA,
+excluding its conflict‑of‑laws rules. If any provision is held unenforceable,
+the remaining provisions remain in force.

docs/agents_md.md

@@ -0,0 +1,3 @@
+# AGENTS.md
+
+For information about AGENTS.md, see [this documentation](https://developers.openai.com/codex/guides/agents-md).

docs/authentication.md

@@ -0,0 +1,3 @@
+# Authentication
+
+For information about Codex CLI authentication, see [this documentation](https://developers.openai.com/codex/auth).

docs/config.md

@@ -0,0 +1,15 @@
+# Configuration
+
+For basic configuration instructions, see [this documentation](https://developers.openai.com/codex/config-basic).
+
+For advanced configuration instructions, see [this documentation](https://developers.openai.com/codex/config-advanced).
+
+For a full configuration reference, see [this documentation](https://developers.openai.com/codex/config-reference).
+
+## Lifecycle hooks
+
+Admins can set top-level `allow_managed_hooks_only = true` in
+`requirements.toml` to ignore user, project, and session hook configs while
+still allowing managed hooks from requirements and managed config layers. This
+setting is only supported in `requirements.toml`; putting it in `config.toml`
+does not enable managed-hooks-only mode.

docs/contributing.md

@@ -0,0 +1,39 @@
+## Contributing
+
+We welcome community contributions through the [openai/codex issue tracker](https://github.com/openai/codex/issues). Bug reports, root-cause analyses, and feature requests help us understand what matters most and improve Codex.
+
+**We do not accept external code contributions or pull requests.**
+
+### Why we do not accept external code contributions
+
+Effective changes to Codex require architectural context, an understanding of system-level constraints, and visibility into the project's roadmap. External pull requests often focus on issues that are lower priority, affect a small number of users, or need substantial changes to fit the broader system. Reviewing and iterating on those changes can take more time than implementing a fix directly, diverting attention from higher-priority work.
+
+Community expertise is most valuable when shared through detailed bug reports, reproduction steps, logs, root-cause analysis, and design discussions in issues. Understanding the problem, identifying the right solution, and prioritizing the work are typically the hard parts; implementation is comparatively straightforward with the help of Codex itself.
+
+For these reasons, we focus community contributions on issue reports, analysis, and feedback, while the Codex team handles code changes.
+
+### Reporting bugs
+
+Before opening a new issue, search the issue tracker to see whether the problem has already been reported. If it has, add any new information to the existing issue.
+
+When reporting a bug, include as much relevant detail as possible:
+
+- Clear, detailed steps to reproduce the problem.
+- Expected and actual behavior.
+- Your Codex version, operating system, and other relevant environment details.
+- Logs, error messages, or other diagnostic information, with sensitive information removed.
+- Root-cause analysis, technical observations, or potential approaches to a fix, if available.
+
+### Requesting features
+
+Open a feature request in the issue tracker, or upvote an existing request that describes the same need. Explain your use case, the behavior you would like, and why it would improve your workflow.
+
+### Community values
+
+- **Be kind and inclusive.** Treat others with respect; we follow the [Contributor Covenant](https://www.contributor-covenant.org/).
+- **Assume good intent.** Written communication is hard, so err on the side of generosity.
+- **Share what you learn.** Reproduction details, logs, and analysis help the entire community.
+
+### Security
+
+If you discover a security vulnerability, follow the [security policy](../SECURITY.md) instead of reporting it in a public issue.

docs/example-config.md

@@ -0,0 +1,3 @@
+# Sample configuration
+
+For a sample configuration file, see [this documentation](https://developers.openai.com/codex/config-sample).

docs/exec.md

@@ -0,0 +1,3 @@
+# Non-interactive mode
+
+For information about non-interactive mode, see [this documentation](https://developers.openai.com/codex/noninteractive).

docs/execpolicy.md

@@ -0,0 +1,3 @@
+# Execution policy
+
+For an overview of execution policy rules, see [this documentation](https://developers.openai.com/codex/exec-policy).

docs/getting-started.md

@@ -0,0 +1,3 @@
+# Getting started with Codex CLI
+
+For an overview of Codex CLI features, see [this documentation](https://developers.openai.com/codex/cli/features#running-in-interactive-mode).

docs/install.md

@@ -0,0 +1,65 @@
+## Installing & building
+
+### System requirements
+
+| Requirement                 | Details                                                         |
+| --------------------------- | --------------------------------------------------------------- |
+| Operating systems           | macOS 12+, Ubuntu 20.04+/Debian 10+, or Windows 11 **via WSL2** |
+| Git (optional, recommended) | 2.23+ for built-in PR helpers                                   |
+| RAM                         | 4-GB minimum (8-GB recommended)                                 |
+
+### DotSlash
+
+The GitHub Release also contains a [DotSlash](https://dotslash-cli.com/) file for the Codex CLI named `codex`. Using a DotSlash file makes it possible to make a lightweight commit to source control to ensure all contributors use the same version of an executable, regardless of what platform they use for development.
+
+### Build from source
+
+```bash
+# Clone the repository and navigate to the root of the Cargo workspace.
+git clone https://github.com/openai/codex.git
+cd codex/codex-rs
+
+# Install the Rust toolchain, if necessary.
+curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
+source "$HOME/.cargo/env"
+rustup component add rustfmt
+rustup component add clippy
+# Install helper tools used by the workspace justfile:
+cargo install --locked just
+# DotSlash fetches pinned development tools such as buildifier on first use.
+cargo install --locked dotslash
+# Install nextest for the `just test` helper.
+cargo install --locked cargo-nextest
+
+# Build Codex.
+cargo build
+
+# Launch the TUI with a sample prompt.
+cargo run --bin codex -- "explain this codebase to me"
+
+# After making changes, use the root justfile helpers (they default to codex-rs):
+just fmt
+just fix -p <crate-you-touched>
+
+# Run the relevant tests (project-specific is fastest), for example:
+just test -p codex-tui
+# `just test` runs the test suite via nextest:
+just test
+# Avoid `--all-features` for routine local runs because it increases build
+# time and `target/` disk usage by compiling additional feature combinations.
+```
+
+## Tracing / verbose logging
+
+Codex is written in Rust, so it honors the `RUST_LOG` environment variable to configure its logging behavior.
+
+The TUI records diagnostics in bounded local stores by default. Set `log_dir` explicitly to enable a plaintext TUI log for a run:
+
+```bash
+codex -c log_dir=./.codex-log
+tail -F ./.codex-log/codex-tui.log
+```
+
+The non-interactive mode (`codex exec`) defaults to `RUST_LOG=error`, but messages are printed inline, so there is no need to monitor a separate file.
+
+See the Rust documentation on [`RUST_LOG`](https://docs.rs/env_logger/latest/env_logger/#enabling-logging) for more information on the configuration options.

docs/license.md

@@ -0,0 +1,3 @@
+## License
+
+This repository is licensed under the [Apache-2.0 License](../LICENSE).

docs/open-source-fund.md

@@ -0,0 +1,8 @@
+## Codex open source fund
+
+We're excited to launch a **$1 million initiative** supporting open source projects that use Codex CLI and other OpenAI models.
+
+- Grants are awarded up to **$25,000** API credits.
+- Applications are reviewed **on a rolling basis**.
+
+**Interested? [Apply here](https://openai.com/form/codex-open-source-fund/).**

docs/sandbox.md

@@ -0,0 +1,3 @@
+## Sandbox & approvals
+
+For information about Codex sandboxing and approvals, see [this documentation](https://developers.openai.com/codex/security).

docs/skills.md

@@ -0,0 +1,3 @@
+# Skills
+
+For information about skills, refer to [this documentation](https://developers.openai.com/codex/skills).

docs/slash_commands.md

@@ -0,0 +1,3 @@
+# Slash commands
+
+For an overview of Codex CLI slash commands, see [this documentation](https://developers.openai.com/codex/cli/slash-commands).

patches/BUILD.bazel

@@ -0,0 +1,32 @@
+exports_files([
+    "abseil_windows_gnullvm_thread_identity.patch",
+    "bzip2_windows_stack_args.patch",
+    "llvm_rusty_v8_custom_libcxx.patch",
+    "llvm_windows_arm64_powl.patch",
+    "llvm_windows_mingw_compat.patch",
+    "rules_rust_build_script_tools_transition.patch",
+    "rules_rust_group_build_script_arg_files.patch",
+    "rules_rust_windows_execroot_separators.patch",
+    "rules_rust_windows_msvc_direct_link_args.patch",
+    "rules_rust_windows_process_wrapper_skip_temp_outputs.patch",
+    "rules_cc_rusty_v8_custom_libcxx.patch",
+    "rules_foreign_cc_make_cppflags.patch",
+    "rules_foreign_cc_make_xcompile.patch",
+    "rules_foreign_cc_make_msvc_stdint.patch",
+    "rules_rs_build_script_deps_annotation.patch",
+    "rules_rs_windows_msvc_linker.patch",
+    "rules_rs_zlib_snapshot_urls.patch",
+    "rusty_v8_prebuilt_out_dir.patch",
+    "ring_windows_msvc_include_dirs.patch",
+    "tikv-jemalloc-sys_make_env.patch",
+    "tikv-jemalloc-sys_dependency_flags.patch",
+    "v8_bazel_rules.patch",
+    "v8_module_deps.patch",
+    "v8_source_portability.patch",
+    "webrtc-sys_hermetic_darwin_sysroot.patch",
+    "windows-link.patch",
+    "windows-support-remote-case-aliases.patch",
+    "windows-support-native-tools.patch",
+    "xz_windows_stack_args.patch",
+    "zstd-sys_windows_msvc_include_dirs.patch",
+])

patches/abseil_windows_gnullvm_thread_identity.patch

@@ -0,0 +1,16 @@
+# What: avoid MinGW pthread TLS linkage in Abseil thread identity selection.
+# Scope: one MinGW-specific preprocessor branch in Abseil's internal
+# thread-identity mode selection; no other Abseil behavior changes.
+
+diff --git a/absl/base/internal/thread_identity.h b/absl/base/internal/thread_identity.h
+--- a/absl/base/internal/thread_identity.h
++++ b/absl/base/internal/thread_identity.h
+@@ -217,6 +217,8 @@
+ #error ABSL_THREAD_IDENTITY_MODE cannot be directly set
+ #elif defined(ABSL_FORCE_THREAD_IDENTITY_MODE)
+ #define ABSL_THREAD_IDENTITY_MODE ABSL_FORCE_THREAD_IDENTITY_MODE
++#elif defined(__MINGW32__)
++#define ABSL_THREAD_IDENTITY_MODE ABSL_THREAD_IDENTITY_MODE_USE_CPP11
+ #elif defined(_WIN32) && !defined(__MINGW32__)
+ #define ABSL_THREAD_IDENTITY_MODE ABSL_THREAD_IDENTITY_MODE_USE_CPP11
+ #elif defined(__APPLE__) && defined(ABSL_HAVE_THREAD_LOCAL)

patches/bzip2_windows_stack_args.patch

@@ -0,0 +1,23 @@
+diff --git a/BUILD.bazel b/BUILD.bazel
+--- a/BUILD.bazel
++++ b/BUILD.bazel
+@@ -28,4 +28,11 @@ cc_library(
+     defines = [
+         "_FILE_OFFSET_BITS=64",
+     ],
++    copts = select({
++        "@platforms//os:windows": [
++            "-fno-stack-protector",
++            "-mno-stack-arg-probe",
++        ],
++        "//conditions:default": [],
++    }),
+     includes = ["."],
+diff --git a/MODULE.bazel b/MODULE.bazel
+--- a/MODULE.bazel
++++ b/MODULE.bazel
+@@ -4,3 +4,4 @@ module(
+ )
+ 
+ bazel_dep(name = "rules_cc", version = "0.0.10")
++bazel_dep(name = "platforms", version = "1.0.0")

patches/llvm_rusty_v8_custom_libcxx.patch

@@ -0,0 +1,108 @@
+diff --git a/toolchain/BUILD.bazel b/toolchain/BUILD.bazel
+index fa00156236..c9e4348172 100644
+--- a/toolchain/BUILD.bazel
++++ b/toolchain/BUILD.bazel
+@@ -1,5 +1,6 @@
+ load("@bazel_lib//:bzl_library.bzl", "bzl_library")
++load("@bazel_skylib//lib:selects.bzl", "selects")
+ load("@bazel_skylib//rules:common_settings.bzl", "string_flag", "string_setting")
+ load("@rules_cc//cc/toolchains:actions.bzl", "cc_action_type_set")
+ load("@rules_cc//cc/toolchains:artifacts.bzl", "cc_artifact_name_pattern")
+ load("@rules_cc//cc/toolchains/impl:documented_api.bzl", "cc_args_list")
+@@ -64,6 +65,15 @@ config_setting(
+     visibility = ["//visibility:public"],
+ )
+-
++
++selects.config_setting_group(
++    name = "runtimes_all_with_rusty_v8_custom_libcxx",
++    match_all = [
++        ":runtimes_all",
++        "@@//third_party/v8:use_rusty_v8_custom_libcxx",
++    ],
++    visibility = ["//visibility:public"],
++)
++
+ config_setting(
+     name = "runtimes_stage1",
+     flag_values = {
+@@ -270,11 +280,16 @@ cc_args_list(
+ 
+ # TODO(cerisier): extract those into proper semantic args list.
+ # TODO(zbarsky): This must match llvm/toolchains/llvm.bzl
++_DEFAULT_CXXSTDLIB_HEADER_ARGS = select({
++    "@@//third_party/v8:use_rusty_v8_custom_libcxx": [],
++    "//conditions:default": [
++        "//toolchain/args:cxxstdlib_headers_include_search_paths",
++    ],
++})
++
+ cc_args_list(
+     name = "linux_toolchain_args",
+-    args = [
+-        "//toolchain/args:cxxstdlib_headers_include_search_paths",
+-    ] + select({
++    args = _DEFAULT_CXXSTDLIB_HEADER_ARGS + select({
+         "//platforms/config:musl": [
+             "//toolchain/args/linux:kernel_headers_include_search_paths",
+             "//toolchain/args/linux:musl_libc_headers_include_search_paths",
+@@ -302,8 +317,7 @@ cc_args_list(
+ # TODO(zbarsky): This must match llvm/toolchains/llvm.bzl
+ cc_args_list(
+     name = "windows_toolchain_args",
+-    args = [
+-        "//toolchain/args:cxxstdlib_headers_include_search_paths",
++    args = _DEFAULT_CXXSTDLIB_HEADER_ARGS + [
+         "//toolchain/args/windows:mingw_headers_include_search_paths",
+     ],
+ )
+diff --git a/toolchain/llvm/llvm.bzl b/toolchain/llvm/llvm.bzl
+index d36d8b94bd..900aa908d5 100644
+--- a/toolchain/llvm/llvm.bzl
++++ b/toolchain/llvm/llvm.bzl
+@@ -297,18 +297,23 @@ def declare_llvm_targets(*, suffix = ""):
+         ],
+     )
+ 
++    default_cxxstdlib_target_headers = select({
++        "@llvm//toolchain:runtimes_all_with_rusty_v8_custom_libcxx": [],
++        "@llvm//toolchain:runtimes_stage1": [],
++        "@llvm//toolchain:runtimes_stage1_hosted": [],
++        "@llvm//toolchain:runtimes_none": [],
++        "//conditions:default": [
++            "@llvm//runtimes/cxxstdlib:headers_include_search_directory",
++            "@llvm//runtimes/cxxstdlib:abi_headers_include_search_directory",
++        ],
++    })
++
+     # This must match //toolchain:linux_toolchain_args
+     include_path(
+         name = "linux_target_headers",
+         srcs = [
+             ":builtin_resource_dir",
+-        ] + select({
+-            "@llvm//toolchain:runtimes_all": [
+-                "@llvm//runtimes/cxxstdlib:headers_include_search_directory",
+-                "@llvm//runtimes/cxxstdlib:abi_headers_include_search_directory",
+-            ],
+-            "//conditions:default": [],
+-        }) + [
++        ] + default_cxxstdlib_target_headers + [
+             "@kernel_headers//:kernel_headers_directory",
+             "@llvm//sanitizers:sanitizers_headers_include_search_directory",
+         ] + select({
+@@ -324,13 +329,7 @@ def declare_llvm_targets(*, suffix = ""):
+         name = "windows_target_headers",
+         srcs = [
+             ":builtin_resource_dir",
+-        ] + select({
+-            "@llvm//toolchain:runtimes_all": [
+-                "@llvm//runtimes/cxxstdlib:headers_include_search_directory",
+-                "@llvm//runtimes/cxxstdlib:abi_headers_include_search_directory",
+-            ],
+-            "//conditions:default": [],
+-        }) + [
++        ] + default_cxxstdlib_target_headers + [
+             "@mingw//:mingw_generated_headers_crt_directory",
+             "@mingw//:mingw_w64_headers_include_directory",
+             "@mingw//:mingw_w64_headers_crt_directory",

patches/llvm_windows_arm64_powl.patch

@@ -0,0 +1,25 @@
+# What: provide and link MinGW's ARM64 long-double `powl` compatibility shim.
+# Why: Windows ARM64 uses 64-bit long doubles, but LLVM's Bazel source list
+# omits the upstream `powl -> pow` implementation and its default link flags
+# omit the MinGW extension archive that owns the shim.
+
+diff --git a/runtimes/mingw/crt_sources.bzl b/runtimes/mingw/crt_sources.bzl
+--- a/runtimes/mingw/crt_sources.bzl
++++ b/runtimes/mingw/crt_sources.bzl
+@@ -420,4 +420,5 @@
+ MINGWEX_ARM64_SRCS = [
++    "math/arm-common/powl.c",
+     "math/sincos.c",
+     "math/sincosf.c",
+     "math/arm-common/sincosl.c",
+diff --git a/toolchain/args/windows/BUILD.bazel b/toolchain/args/windows/BUILD.bazel
+--- a/toolchain/args/windows/BUILD.bazel
++++ b/toolchain/args/windows/BUILD.bazel
+@@ -45,5 +45,6 @@ cc_args(
+     args = [
+         "-L{mingw_import_library_search_path}",
+         "-L{mingw_crt_library_search_path}",
+-
++        "-lmingwex",
++
+         # Clang will respect the user's chosen CRT variant.

patches/llvm_windows_mingw_compat.patch

@@ -0,0 +1,50 @@
+# What: provide MinGW compatibility archives required by Windows gnullvm links.
+# Why: clang and prebuilt MSVC archives can request these names even though the
+# hermetic MinGW runtime does not publish them by default.
+
+diff --git a/runtimes/mingw/BUILD.bazel b/runtimes/mingw/BUILD.bazel
+--- a/runtimes/mingw/BUILD.bazel
++++ b/runtimes/mingw/BUILD.bazel
+@@ -386,14 +386,42 @@ stub_library(
+     name = "stdc++",
+ )
+ 
++# Clang may inject -lssp and -lssp_nonshared for windows-gnu links.
++# Provide compatibility archives in the MinGW runtime search directory.
++stub_library(
++    name = "ssp",
++)
++
++stub_library(
++    name = "ssp_nonshared",
++)
++
++# Prebuilt MSVC archives can carry /DEFAULTLIB:libcmt.lib and
++# /DEFAULTLIB:oldnames.lib directives. Provide MinGW-compatible stand-ins so
++# lld can satisfy the lookup under windows-gnullvm.
++stub_library(
++    name = "libcmt",
++)
++
++copy_file(
++    name = "oldnames",
++    src = ":moldname",
++    out = "liboldnames.a",
++    visibility = ["//visibility:public"],
++)
++
+ copy_to_directory(
+     name = "mingw_crt_library_search_directory",
+     srcs = [
++        ":libcmt",
+         ":m",
+         ":mingw32",
+         ":mingwex",
+         ":moldname",
++        ":oldnames",
+         ":pthread",
++        ":ssp",
++        ":ssp_nonshared",
+         ":stdc++",
+         ":uuid",
+         ":winpthread",

patches/ring_windows_msvc_include_dirs.patch

@@ -0,0 +1,112 @@
+diff --git a/build.rs b/build.rs
+--- a/build.rs
++++ b/build.rs
+@@ -346,7 +346,27 @@
+     // we want to optimize for minimizing the build tools required: No Perl,
+     // no nasm, etc.
+     let generated_dir = if !is_git {
+-        c_root_dir.join(PREGENERATED)
++        let pregenerated_dir = c_root_dir.join(PREGENERATED);
++        if target.os == WINDOWS && target.env == "msvc"
++        {
++            let mut pending = vec![(pregenerated_dir.clone(), out_dir.clone())];
++            while let Some((src_dir, dst_dir)) = pending.pop() {
++                fs::create_dir_all(&dst_dir).unwrap();
++                for entry in fs::read_dir(&src_dir).unwrap() {
++                    let entry = entry.unwrap();
++                    let src_path = entry.path();
++                    let dst_path = dst_dir.join(entry.file_name());
++                    if entry.file_type().unwrap().is_dir() {
++                        pending.push((src_path, dst_path));
++                    } else {
++                        fs::copy(&src_path, &dst_path).unwrap();
++                    }
++                }
++            }
++            out_dir.clone()
++        } else {
++            pregenerated_dir
++        }
+     } else {
+         generate_sources_and_preassemble(
+             &out_dir,
+@@ -561,7 +581,13 @@
+     let compiler = c.get_compiler();
+     // FIXME: On Windows AArch64 we currently must use Clang to compile C code
+     let compiler = if target.os == WINDOWS && target.arch == AARCH64 && !compiler.is_like_clang() {
+-        let _ = c.compiler("clang");
++        // Keep inherited MSVC flags compatible with the selected Clang driver.
++        let clang = if compiler.is_like_msvc() {
++            "clang-cl"
++        } else {
++            "clang"
++        };
++        let _ = c.compiler(clang);
+         c.get_compiler()
+     } else {
+         compiler
+@@ -569,6 +595,15 @@
+ 
+     let _ = c.include(c_root_dir.join("include"));
+     let _ = c.include(include_dir);
++    let _ = c.include(c_root_dir.join("third_party").join("fiat"));
++    if compiler.is_like_msvc() {
++        let _ = c.include(c_root_dir.join("crypto").join("curve25519"));
++        let _ = c.include(c_root_dir.join("crypto").join("limbs"));
++        let _ = c.include(c_root_dir.join("crypto").join("fipsmodule").join("aes"));
++        let _ = c.include(c_root_dir.join("crypto").join("fipsmodule").join("bn"));
++        let _ = c.include(c_root_dir.join("crypto").join("fipsmodule").join("ec"));
++        let _ = c.include(c_root_dir.join("crypto").join("poly1305"));
++    }
+     for f in cpp_flags(&compiler) {
+         let _ = c.flag(f);
+     }
+diff --git a/crypto/curve25519/curve25519.c b/crypto/curve25519/curve25519.c
+index 99d7d7fbb..2f69ad560 100644
+--- a/crypto/curve25519/curve25519.c
++++ b/crypto/curve25519/curve25519.c
+@@ -47,11 +47,11 @@
+ #if defined(__GNUC__)
+ #pragma GCC diagnostic ignored "-Wpedantic"
+ #endif
+-#include "../../third_party/fiat/curve25519_64.h"
++#include "curve25519_64.h"
+ #elif defined(OPENSSL_64_BIT)
+-#include "../../third_party/fiat/curve25519_64_msvc.h"
++#include "curve25519_64_msvc.h"
+ #else
+-#include "../../third_party/fiat/curve25519_32.h"
++#include "curve25519_32.h"
+ #endif
+ 
+ 
+diff --git a/crypto/curve25519/curve25519_64_adx.c b/crypto/curve25519/curve25519_64_adx.c
+index 88964a9dd..b660f55f4 100644
+--- a/crypto/curve25519/curve25519_64_adx.c
++++ b/crypto/curve25519/curve25519_64_adx.c
+@@ -19,5 +19,5 @@
+ #pragma GCC diagnostic ignored "-Wpedantic"
+ #pragma GCC diagnostic ignored "-Wsign-conversion"
+ 
+-#include "../../third_party/fiat/curve25519_64_adx.h"
++#include "curve25519_64_adx.h"
+ #endif
+diff --git a/crypto/fipsmodule/ec/p256.c b/crypto/fipsmodule/ec/p256.c
+index 0117916da..4224d1192 100644
+--- a/crypto/fipsmodule/ec/p256.c
++++ b/crypto/fipsmodule/ec/p256.c
+@@ -50,11 +50,11 @@
+ #if defined(__GNUC__)
+ #pragma GCC diagnostic ignored "-Wpedantic"
+ #endif
+-#include "../../../third_party/fiat/p256_64.h"
++#include "p256_64.h"
+ #elif defined(OPENSSL_64_BIT)
+-#include "../../../third_party/fiat/p256_64_msvc.h"
++#include "p256_64_msvc.h"
+ #else
+-#include "../../../third_party/fiat/p256_32.h"
++#include "p256_32.h"
+ #endif
+ 
+ 

patches/rules_cc_rusty_v8_custom_libcxx.patch

@@ -0,0 +1,44 @@
+diff --git a/cc/cc_library.bzl b/cc/cc_library.bzl
+index c45c5fd954..2e3a01f12a 100644
+--- a/cc/cc_library.bzl
++++ b/cc/cc_library.bzl
+@@ -15,5 +15,39 @@
+
+ load("@cc_compatibility_proxy//:proxy.bzl", _cc_library = "cc_library")
+ 
++_RUSTY_V8_CUSTOM_LIBCXX_COPTS = select({
++    "@@//third_party/v8:use_rusty_v8_custom_libcxx": [
++        "-nostdinc++",
++        "-D_LIBCPP_DISABLE_VISIBILITY_ANNOTATIONS",
++        "-D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_EXTENSIVE",
++        "-D_LIBCPP_INSTRUMENTED_WITH_ASAN=0",
++        "-D_LIBCXXABI_DISABLE_VISIBILITY_ANNOTATIONS",
++    ],
++    "//conditions:default": [],
++})
++
++_RUSTY_V8_CUSTOM_LIBCXX_DEPS = select({
++    "@@//third_party/v8:use_rusty_v8_custom_libcxx": [
++        "@@//third_party/v8:rusty_v8_custom_libcxx_headers",
++    ],
++    "//conditions:default": [],
++})
++
++_RUSTY_V8_CUSTOM_LIBCXX_REPOS = [
++    # V8 and ICU are patched in-tree. These external C++ dependencies still
++    # build inside the artifact closure once the LLVM toolchain's default
++    # libc++ headers are suppressed.
++    "@abseil-cpp+",
++    "@v8++http_archive+highway",
++    "@v8++http_archive+simdutf",
++]
++
++def _should_use_rusty_v8_custom_libcxx():
++    return native.repository_name() in _RUSTY_V8_CUSTOM_LIBCXX_REPOS
++
+ def cc_library(**kwargs):
++    if _should_use_rusty_v8_custom_libcxx():
++        kwargs["copts"] = (kwargs.get("copts", []) or []) + _RUSTY_V8_CUSTOM_LIBCXX_COPTS
++        kwargs["deps"] = (kwargs.get("deps", []) or []) + _RUSTY_V8_CUSTOM_LIBCXX_DEPS
++        kwargs["features"] = (kwargs.get("features", []) or []) + ["-module_maps"]
+     _cc_library(**kwargs)

patches/rules_foreign_cc_make_cppflags.patch

@@ -0,0 +1,15 @@
+diff --git a/foreign_cc/built_tools/make_build.bzl b/foreign_cc/built_tools/make_build.bzl
+--- a/foreign_cc/built_tools/make_build.bzl
++++ b/foreign_cc/built_tools/make_build.bzl
+@@ -114,6 +114,11 @@
+             "ARFLAGS": _join_flags_list(ctx.workspace_name, arflags),
+             "CC": absolute_cc,
+             "CFLAGS": _join_flags_list(ctx.workspace_name, non_sysroot_cflags),
++            # Configure's preprocessor checks need the declared header paths too.
++            "CPPFLAGS": " ".join([
++                "$${CPPFLAGS:-}$$",
++                _join_flags_list(ctx.workspace_name, non_sysroot_cflags),
++            ]).strip(),
+             "LD": absolute_ld,
+             "LDFLAGS": _join_flags_list(ctx.workspace_name, non_sysroot_ldflags),
+         })

patches/rules_foreign_cc_make_msvc_stdint.patch

@@ -0,0 +1,13 @@
+diff --git a/foreign_cc/built_tools/make_build.bzl b/foreign_cc/built_tools/make_build.bzl
+--- a/foreign_cc/built_tools/make_build.bzl
++++ b/foreign_cc/built_tools/make_build.bzl
+@@ -35,6 +35,9 @@
+             build_str += " gcc"
+             dist_dir = "GccRel"
+         else:
++            # Modern MSVC provides stdint.h, including the intmax_t types that
++            # Make's legacy Windows config otherwise replaces with macros.
++            build_str = 'export CL="$${CL:-}$$ /DHAVE_STDINT_H=1"\n' + build_str
+             dist_dir = "WinRel"
+ 
+         script = [

patches/rules_foreign_cc_make_xcompile.patch

@@ -0,0 +1,10 @@
+diff --git a/toolchains/private/BUILD.bazel b/toolchains/private/BUILD.bazel
+--- a/toolchains/private/BUILD.bazel
++++ b/toolchains/private/BUILD.bazel
+@@ -23,5 +23,6 @@
+ make_tool(
+     name = "make_tool",
+     srcs = "@gnumake_src//:all_srcs",
++    configure_xcompile = True,
+     tags = ["manual"],
+ )