5860481bc4
## Summary
Builds on FreeBSD and OpenBSD were failing due to globally enabled
Linux-specific keyring features and hardening code paths not gated by
OS. This PR scopes keyring native backends to the
appropriate targets, disables default features at the workspace root,
and adds a BSD-specific hardening function. Linux/macOS/Windows behavior
remains unchanged, while FreeBSD/OpenBSD
now build and run with a supported backend.
## Key Changes
- Keyring features:
- Disable keyring default features at the workspace root to avoid
pulling Linux backends on non-Linux.
- Move native backend features into target-specific sections in the
affected crates:
- Linux: linux-native-async-persistent
- macOS: apple-native
- Windows: windows-native
- FreeBSD/OpenBSD: sync-secret-service
- Process hardening:
- Add pre_main_hardening_bsd() for FreeBSD/OpenBSD, applying:
- Set RLIMIT_CORE to 0
- Clear LD_* environment variables
- Simplify process-hardening Cargo deps to unconditional libc (avoid
conflicting OS fragments).
- No changes to CODEX_SANDBOX_* behavior.
## Rationale
- Previously, enabling keyring native backends globally pulled
Linux-only features on BSD, causing build errors.
- Hardening logic was tailored for Linux/macOS; BSD builds lacked a
gated path with equivalent safeguards.
- Target-scoped features and BSD hardening make the crates portable
across these OSes without affecting existing behavior elsewhere.
## Impact by Platform
- Linux: No functional change; backends now selected via target cfg.
- macOS: No functional change; explicit apple-native mapping.
- Windows: No functional change; explicit windows-native mapping.
- FreeBSD/OpenBSD: Builds succeed using sync-secret-service; BSD
hardening applied during startup.
## Testing
- Verified compilation across affected crates with target-specific
features.
- Smoke-checked that Linux/macOS/Windows feature sets remain identical
functionally after scoping.
- On BSD, confirmed keyring resolves to sync-secret-service and
hardening compiles.
## Risks / Compatibility
- Minimal risk: only feature scoping and OS-gated additions.
- No public API changes in the crates; runtime behavior on non-BSD
platforms is preserved.
- On BSD, the new hardening clears LD_*; this is consistent with
security posture on other Unix platforms.
## Reviewer Notes
- Pay attention to target-specific sections for keyring in the affected
Cargo.toml files.
- Confirm pre_main_hardening_bsd() mirrors the safe subset of
Linux/macOS hardening without introducing Linux-only calls.
- Confirm no references to CODEX_SANDBOX_ENV_VAR or
CODEX_SANDBOX_NETWORK_DISABLED_ENV_VAR were added/modified.
## Checklist
- Disable keyring default features at workspace root.
- Target-specific keyring features mapped per OS
(Linux/macOS/Windows/BSD).
- Add BSD hardening (RLIMIT_CORE=0, clear LD_*).
- Simplify process-hardening dependencies to unconditional libc.
- No changes to sandbox env var code.
- Formatting and linting: just fmt + just fix -p for changed crates.
- Project tests pass for changed crates; broader suite unchanged.
---------
Co-authored-by: celia-oai <celia@openai.com>
127 lines
4 KiB
TOML
127 lines
4 KiB
TOML
[package]
|
|
edition = "2024"
|
|
name = "codex-core"
|
|
version = { workspace = true }
|
|
|
|
[lib]
|
|
doctest = false
|
|
name = "codex_core"
|
|
path = "src/lib.rs"
|
|
|
|
[lints]
|
|
workspace = true
|
|
|
|
[dependencies]
|
|
anyhow = { workspace = true }
|
|
askama = { workspace = true }
|
|
async-channel = { workspace = true }
|
|
async-trait = { workspace = true }
|
|
base64 = { workspace = true }
|
|
bytes = { workspace = true }
|
|
chrono = { workspace = true, features = ["serde"] }
|
|
codex-app-server-protocol = { workspace = true }
|
|
codex-apply-patch = { workspace = true }
|
|
codex-async-utils = { workspace = true }
|
|
codex-file-search = { workspace = true }
|
|
codex-git = { workspace = true }
|
|
codex-keyring-store = { workspace = true }
|
|
codex-otel = { workspace = true, features = ["otel"] }
|
|
codex-protocol = { workspace = true }
|
|
codex-rmcp-client = { workspace = true }
|
|
codex-utils-pty = { workspace = true }
|
|
codex-utils-readiness = { workspace = true }
|
|
codex-utils-string = { workspace = true }
|
|
codex-utils-tokenizer = { workspace = true }
|
|
codex-windows-sandbox = { package = "codex-windows-sandbox", path = "../windows-sandbox-rs" }
|
|
dirs = { workspace = true }
|
|
dunce = { workspace = true }
|
|
env-flags = { workspace = true }
|
|
eventsource-stream = { workspace = true }
|
|
futures = { workspace = true }
|
|
http = { workspace = true }
|
|
indexmap = { workspace = true }
|
|
keyring = { workspace = true, features = ["crypto-rust"] }
|
|
libc = { workspace = true }
|
|
mcp-types = { workspace = true }
|
|
os_info = { workspace = true }
|
|
rand = { workspace = true }
|
|
regex-lite = { workspace = true }
|
|
reqwest = { workspace = true, features = ["json", "stream"] }
|
|
serde = { workspace = true, features = ["derive"] }
|
|
serde_json = { workspace = true }
|
|
sha1 = { workspace = true }
|
|
sha2 = { workspace = true }
|
|
shlex = { workspace = true }
|
|
similar = { workspace = true }
|
|
strum_macros = { workspace = true }
|
|
tempfile = { workspace = true }
|
|
test-case = "3.3.1"
|
|
test-log = { workspace = true }
|
|
thiserror = { workspace = true }
|
|
time = { workspace = true, features = [
|
|
"formatting",
|
|
"parsing",
|
|
"local-offset",
|
|
"macros",
|
|
] }
|
|
tokio = { workspace = true, features = [
|
|
"io-std",
|
|
"macros",
|
|
"process",
|
|
"rt-multi-thread",
|
|
"signal",
|
|
] }
|
|
tokio-util = { workspace = true, features = ["rt"] }
|
|
toml = { workspace = true }
|
|
toml_edit = { workspace = true }
|
|
tracing = { workspace = true, features = ["log"] }
|
|
tree-sitter = { workspace = true }
|
|
tree-sitter-bash = { workspace = true }
|
|
uuid = { workspace = true, features = ["serde", "v4", "v5"] }
|
|
which = { workspace = true }
|
|
wildmatch = { workspace = true }
|
|
|
|
|
|
[target.'cfg(target_os = "linux")'.dependencies]
|
|
landlock = { workspace = true }
|
|
seccompiler = { workspace = true }
|
|
keyring = { workspace = true, features = ["linux-native-async-persistent"] }
|
|
|
|
[target.'cfg(target_os = "macos")'.dependencies]
|
|
core-foundation = "0.9"
|
|
keyring = { workspace = true, features = ["apple-native"] }
|
|
|
|
# Build OpenSSL from source for musl builds.
|
|
[target.x86_64-unknown-linux-musl.dependencies]
|
|
openssl-sys = { workspace = true, features = ["vendored"] }
|
|
|
|
# Build OpenSSL from source for musl builds.
|
|
[target.aarch64-unknown-linux-musl.dependencies]
|
|
openssl-sys = { workspace = true, features = ["vendored"] }
|
|
|
|
[target.'cfg(target_os = "windows")'.dependencies]
|
|
keyring = { workspace = true, features = ["windows-native"] }
|
|
|
|
[target.'cfg(any(target_os = "freebsd", target_os = "openbsd"))'.dependencies]
|
|
keyring = { workspace = true, features = ["sync-secret-service"] }
|
|
|
|
[dev-dependencies]
|
|
assert_cmd = { workspace = true }
|
|
assert_matches = { workspace = true }
|
|
codex-arg0 = { workspace = true }
|
|
core_test_support = { workspace = true }
|
|
ctor = { workspace = true }
|
|
escargot = { workspace = true }
|
|
image = { workspace = true, features = ["jpeg", "png"] }
|
|
maplit = { workspace = true }
|
|
predicates = { workspace = true }
|
|
pretty_assertions = { workspace = true }
|
|
serial_test = { workspace = true }
|
|
tempfile = { workspace = true }
|
|
tokio-test = { workspace = true }
|
|
tracing-test = { workspace = true, features = ["no-env-filter"] }
|
|
walkdir = { workspace = true }
|
|
wiremock = { workspace = true }
|
|
|
|
[package.metadata.cargo-shear]
|
|
ignored = ["openssl-sys"]
|