mirror of
https://github.com/openai/codex.git
synced 2026-04-30 03:12:20 +03:00
dee5f5ea38
## Summary This PR hardens package-manager usage across the repo to reduce dependency supply-chain risk. It also removes the stale `codex-cli` Docker path, which was already broken on `main`, instead of keeping a bitrotted container workflow alive. ## What changed - Updated pnpm package manager pins and workspace install settings. - Removed stale `codex-cli` Docker assets instead of trying to keep a broken local container path alive. - Added uv settings and lockfiles for the Python SDK packages. - Updated Python SDK setup docs to use `uv sync`. ## Why This is primarily a security hardening change. It reduces package-install and supply-chain risk by ensuring dependency installs go through pinned package managers, committed lockfiles, release-age settings, and reviewed build-script controls. For `codex-cli`, the right follow-up was to remove the local Docker path rather than keep patching it: - `codex-cli/Dockerfile` installed `codex.tgz` with `npm install -g`, which bypassed the repo lockfile and age-gated pnpm settings. - The local `codex-cli/scripts/build_container.sh` helper was already broken on `main`: it called `pnpm run build`, but `codex-cli/package.json` does not define a `build` script. - The container path itself had bitrotted enough that keeping it would require extra packaging-specific behavior that was not otherwise needed by the repo. ## Gaps addressed - Global npm installs bypassed the repo lockfile in Docker and CLI reinstall paths, including `codex-cli/Dockerfile` and `codex-cli/bin/codex.js`. - CI and Docker pnpm installs used `--frozen-lockfile`, but the repo was missing stricter pnpm workspace settings for dependency build scripts. - Python SDK projects had `pyproject.toml` metadata but no committed `uv.lock` coverage or uv age/index settings in `sdk/python` and `sdk/python-runtime`. - The secure devcontainer install path used npm/global install behavior without a local locked package-manager boundary. - The local `codex-cli` Docker helper was already broken on `main`, so this PR removes that stale Docker path instead of preserving a broken surface. - pnpm was already pinned, but not to the current repo-wide pnpm version target. ## Verification - `pnpm install --frozen-lockfile` - `.devcontainer/codex-install`: `pnpm install --prod --frozen-lockfile` - `.devcontainer/codex-install`: `./node_modules/.bin/codex --version` - `sdk/python`: `uv lock --check`, `uv sync --locked --all-extras --dry-run`, `uv build` - `sdk/python-runtime`: `uv lock --check`, `uv sync --locked --dry-run`, `uv build --wheel` - `pnpm -r --filter ./sdk/typescript run build` - `pnpm -r --filter ./sdk/typescript run lint` - `pnpm -r --filter ./sdk/typescript run test` - `node --check codex-cli/bin/codex.js` - `docker build -f .devcontainer/Dockerfile.secure -t codex-secure-test .` - `cargo build -p codex-cli` - repo-wide package-manager audit
83 lines
2.6 KiB
Docker
83 lines
2.6 KiB
Docker
FROM mcr.microsoft.com/devcontainers/base:ubuntu-24.04
|
|
|
|
ARG TZ
|
|
ARG DEBIAN_FRONTEND=noninteractive
|
|
ARG NODE_MAJOR=22
|
|
ARG RUST_TOOLCHAIN=1.92.0
|
|
# Keep this in sync with .devcontainer/codex-install/package.json and pnpm-lock.yaml.
|
|
ARG CODEX_NPM_VERSION=0.121.0
|
|
|
|
ENV TZ="$TZ"
|
|
ENV COREPACK_ENABLE_DOWNLOAD_PROMPT=0
|
|
|
|
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
|
|
|
|
# Devcontainers run as a non-root user, so enable bubblewrap's setuid mode.
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends \
|
|
build-essential \
|
|
curl \
|
|
git \
|
|
ca-certificates \
|
|
pkg-config \
|
|
clang \
|
|
musl-tools \
|
|
libssl-dev \
|
|
libsqlite3-dev \
|
|
just \
|
|
python3 \
|
|
python3-pip \
|
|
jq \
|
|
less \
|
|
man-db \
|
|
unzip \
|
|
ripgrep \
|
|
fzf \
|
|
fd-find \
|
|
zsh \
|
|
dnsutils \
|
|
iproute2 \
|
|
ipset \
|
|
iptables \
|
|
aggregate \
|
|
bubblewrap \
|
|
&& chmod u+s /usr/bin/bwrap \
|
|
&& apt-get clean \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
COPY .devcontainer/codex-install/package.json \
|
|
.devcontainer/codex-install/pnpm-lock.yaml \
|
|
.devcontainer/codex-install/pnpm-workspace.yaml \
|
|
/opt/codex-install/
|
|
|
|
RUN curl -fsSL "https://deb.nodesource.com/setup_${NODE_MAJOR}.x" | bash - \
|
|
&& apt-get update \
|
|
&& apt-get install -y --no-install-recommends nodejs \
|
|
&& test "$(node -p "require('/opt/codex-install/package.json').dependencies['@openai/codex']")" = "${CODEX_NPM_VERSION}" \
|
|
&& cd /opt/codex-install \
|
|
&& corepack pnpm install --prod --frozen-lockfile \
|
|
&& ln -s /opt/codex-install/node_modules/.bin/codex /usr/local/bin/codex \
|
|
&& apt-get clean \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
COPY .devcontainer/init-firewall.sh /usr/local/bin/init-firewall.sh
|
|
COPY .devcontainer/post_install.py /opt/post_install.py
|
|
COPY .devcontainer/post-start.sh /opt/post_start.sh
|
|
|
|
RUN chmod 500 /usr/local/bin/init-firewall.sh \
|
|
&& chmod 755 /opt/post_start.sh \
|
|
&& chmod 644 /opt/post_install.py \
|
|
&& chown vscode:vscode /opt/post_install.py
|
|
|
|
RUN install -d -m 0775 -o vscode -g vscode /commandhistory /workspace \
|
|
&& touch /commandhistory/.bash_history /commandhistory/.zsh_history \
|
|
&& chown vscode:vscode /commandhistory/.bash_history /commandhistory/.zsh_history
|
|
|
|
USER vscode
|
|
ENV PATH="/home/vscode/.cargo/bin:${PATH}"
|
|
WORKDIR /workspace
|
|
|
|
RUN curl -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain "${RUST_TOOLCHAIN}" \
|
|
&& rustup component add clippy rustfmt rust-src \
|
|
&& rustup target add x86_64-unknown-linux-musl aarch64-unknown-linux-musl
|