mirror of
https://github.com/openai/codex.git
synced 2026-04-25 15:15:15 +00:00
dee5f5ea38
## Summary This PR hardens package-manager usage across the repo to reduce dependency supply-chain risk. It also removes the stale `codex-cli` Docker path, which was already broken on `main`, instead of keeping a bitrotted container workflow alive. ## What changed - Updated pnpm package manager pins and workspace install settings. - Removed stale `codex-cli` Docker assets instead of trying to keep a broken local container path alive. - Added uv settings and lockfiles for the Python SDK packages. - Updated Python SDK setup docs to use `uv sync`. ## Why This is primarily a security hardening change. It reduces package-install and supply-chain risk by ensuring dependency installs go through pinned package managers, committed lockfiles, release-age settings, and reviewed build-script controls. For `codex-cli`, the right follow-up was to remove the local Docker path rather than keep patching it: - `codex-cli/Dockerfile` installed `codex.tgz` with `npm install -g`, which bypassed the repo lockfile and age-gated pnpm settings. - The local `codex-cli/scripts/build_container.sh` helper was already broken on `main`: it called `pnpm run build`, but `codex-cli/package.json` does not define a `build` script. - The container path itself had bitrotted enough that keeping it would require extra packaging-specific behavior that was not otherwise needed by the repo. ## Gaps addressed - Global npm installs bypassed the repo lockfile in Docker and CLI reinstall paths, including `codex-cli/Dockerfile` and `codex-cli/bin/codex.js`. - CI and Docker pnpm installs used `--frozen-lockfile`, but the repo was missing stricter pnpm workspace settings for dependency build scripts. - Python SDK projects had `pyproject.toml` metadata but no committed `uv.lock` coverage or uv age/index settings in `sdk/python` and `sdk/python-runtime`. - The secure devcontainer install path used npm/global install behavior without a local locked package-manager boundary. - The local `codex-cli` Docker helper was already broken on `main`, so this PR removes that stale Docker path instead of preserving a broken surface. - pnpm was already pinned, but not to the current repo-wide pnpm version target. ## Verification - `pnpm install --frozen-lockfile` - `.devcontainer/codex-install`: `pnpm install --prod --frozen-lockfile` - `.devcontainer/codex-install`: `./node_modules/.bin/codex --version` - `sdk/python`: `uv lock --check`, `uv sync --locked --all-extras --dry-run`, `uv build` - `sdk/python-runtime`: `uv lock --check`, `uv sync --locked --dry-run`, `uv build --wheel` - `pnpm -r --filter ./sdk/typescript run build` - `pnpm -r --filter ./sdk/typescript run lint` - `pnpm -r --filter ./sdk/typescript run test` - `node --check codex-cli/bin/codex.js` - `docker build -f .devcontainer/Dockerfile.secure -t codex-secure-test .` - `cargo build -p codex-cli` - repo-wide package-manager audit
84 lines
3.0 KiB
JSON
84 lines
3.0 KiB
JSON
{
|
|
"$schema": "https://raw.githubusercontent.com/devcontainers/spec/main/schemas/devContainer.schema.json",
|
|
"name": "Codex (Secure)",
|
|
"build": {
|
|
"dockerfile": "Dockerfile.secure",
|
|
"context": "..",
|
|
"args": {
|
|
"TZ": "${localEnv:TZ:UTC}",
|
|
"NODE_MAJOR": "22",
|
|
"RUST_TOOLCHAIN": "1.92.0",
|
|
"CODEX_NPM_VERSION": "0.121.0"
|
|
}
|
|
},
|
|
"runArgs": [
|
|
"--cap-add=SYS_ADMIN",
|
|
"--cap-add=SYS_CHROOT",
|
|
"--cap-add=SETUID",
|
|
"--cap-add=SETGID",
|
|
"--cap-add=SYS_PTRACE",
|
|
"--security-opt=seccomp=unconfined",
|
|
"--security-opt=apparmor=unconfined",
|
|
"--cap-add=NET_ADMIN",
|
|
"--cap-add=NET_RAW"
|
|
],
|
|
"init": true,
|
|
"updateRemoteUserUID": true,
|
|
"remoteUser": "vscode",
|
|
"workspaceMount": "source=${localWorkspaceFolder},target=/workspace,type=bind,consistency=delegated",
|
|
"workspaceFolder": "/workspace",
|
|
"mounts": [
|
|
"source=codex-commandhistory-${devcontainerId},target=/commandhistory,type=volume",
|
|
"source=codex-home-${devcontainerId},target=/home/vscode/.codex,type=volume",
|
|
"source=codex-gh-${devcontainerId},target=/home/vscode/.config/gh,type=volume",
|
|
"source=codex-cargo-registry-${devcontainerId},target=/home/vscode/.cargo/registry,type=volume",
|
|
"source=codex-cargo-git-${devcontainerId},target=/home/vscode/.cargo/git,type=volume",
|
|
"source=codex-rustup-${devcontainerId},target=/home/vscode/.rustup,type=volume",
|
|
"source=${localEnv:HOME}/.gitconfig,target=/home/vscode/.gitconfig,type=bind,readonly"
|
|
],
|
|
"containerEnv": {
|
|
"RUST_BACKTRACE": "1",
|
|
"CODEX_UNSAFE_ALLOW_NO_SANDBOX": "1",
|
|
"CODEX_ENABLE_FIREWALL": "1",
|
|
"CODEX_INCLUDE_GITHUB_META_RANGES": "1",
|
|
"OPENAI_ALLOWED_DOMAINS": "api.openai.com auth.openai.com github.com api.github.com codeload.github.com raw.githubusercontent.com objects.githubusercontent.com crates.io index.crates.io static.crates.io static.rust-lang.org registry.npmjs.org pypi.org files.pythonhosted.org",
|
|
"CARGO_TARGET_DIR": "/workspace/.cache/cargo-target",
|
|
"GIT_CONFIG_GLOBAL": "/home/vscode/.gitconfig.local",
|
|
"COREPACK_ENABLE_DOWNLOAD_PROMPT": "0",
|
|
"PYTHONDONTWRITEBYTECODE": "1",
|
|
"PIP_DISABLE_PIP_VERSION_CHECK": "1"
|
|
},
|
|
"remoteEnv": {
|
|
"OPENAI_API_KEY": "${localEnv:OPENAI_API_KEY}"
|
|
},
|
|
"postCreateCommand": "python3 /opt/post_install.py",
|
|
"postStartCommand": "bash /opt/post_start.sh",
|
|
"waitFor": "postStartCommand",
|
|
"customizations": {
|
|
"vscode": {
|
|
"settings": {
|
|
"terminal.integrated.defaultProfile.linux": "zsh",
|
|
"terminal.integrated.profiles.linux": {
|
|
"bash": {
|
|
"path": "bash",
|
|
"icon": "terminal-bash"
|
|
},
|
|
"zsh": {
|
|
"path": "zsh"
|
|
}
|
|
},
|
|
"files.trimTrailingWhitespace": true,
|
|
"files.insertFinalNewline": true,
|
|
"files.trimFinalNewlines": true
|
|
},
|
|
"extensions": [
|
|
"openai.chatgpt",
|
|
"rust-lang.rust-analyzer",
|
|
"tamasfe.even-better-toml",
|
|
"vadimcn.vscode-lldb",
|
|
"ms-azuretools.vscode-docker"
|
|
]
|
|
}
|
|
}
|
|
}
|