Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package openai-codex for openSUSE:Factory checked in at 2026-10-31 23:11:25 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/openai-codex (Old) and /work/SRC/openSUSE:Factory/.openai-codex.new.1255 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "openai-codex" Sat Oct 31 23:11:25 2026 rev:25 rq:1394170 version:0.166.0 Changes: -------- --- /work/SRC/openSUSE:Factory/openai-codex/openai-codex.changes 2026-10-28 21:32:03.213661415 +0100 +++ /work/SRC/openSUSE:Factory/.openai-codex.new.1255/openai-codex.changes 2026-10-31 23:14:41.073675216 +0100 @@ -1,0 +2,18 @@ +Sat Oct 31 14:11:07 UTC 2026 - Martin Pluskal <[email protected]> + +- Update to version 0.166.0: + * Keyboard-driven transcript selection with search and + consistent Markdown in async questions and replies + * GPT-6.1 Terra in the bundled, Vertex AI and Bedrock + catalogs; codex queue --resume; codex doctor + --network-only diagnostics + * Clearer safety-block explanations with safer follow-up + prompts; approval settings kept across resume and + fork; reasoning-token accounting across resume + * Rebased codex-drop-v8-code-mode.patch (workspace gained + plugin-host; also drop the now-unused v8 git patch + entry, which breaks offline resolution); licence set + re-derived unchanged; keeps upstream gix 0.89.0 / + gix-pack 0.76.0 and ctutils 0.4.5 + +------------------------------------------------------------------- Old: ---- codex-rust-v0.165.0.tar.gz New: ---- codex-rust-v0.166.0.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ openai-codex.spec ++++++ --- /var/tmp/diff_new_pack.bAQqgt/_old 2026-10-31 23:14:44.367811717 +0100 +++ /var/tmp/diff_new_pack.bAQqgt/_new 2026-10-31 23:14:44.369811800 +0100 @@ -17,7 +17,7 @@ Name: openai-codex -Version: 0.165.0 +Version: 0.166.0 Release: 0 Summary: OpenAI Codex coding agent for the terminal # Legal-Review-Notice: upstream codex is Apache-2.0. Everything after that @@ -127,6 +127,18 @@ URL: https://github.com/openai/codex Source0: https://github.com/openai/codex/archive/refs/tags/rust-v%{version}.tar.gz#/codex-rust-v%{version}.tar.gz Source1: vendor.tar.zst +# The vendor closure carries test-only fixtures the prebuilt-binary scan +# flags: libloading's Windows DLLs (loaded only by its Windows-only tests) +# and flate2's corrupt-input fixture. Neither is built, linked, loaded or +# shipped on Linux. Everything else the scan flags is unbundled, not +# excepted: cargo_vendor filter=true keeps the Windows/wasm-only crates +# (including wit-parser, whose UI-test inputs are gone with it) out of the +# tarball, the two import libs and the WSL nupkg the filter leaves are +# stripped at repack (with their .cargo-checksum.json entries), and +# code-mode-protocol builds against the system protoc via PROTOC (Patch0) +# instead of its vendored copy. +# Source-Binary-Exception: vendor.tar.zst:vendor/libloading-*/tests/*.dll -- test-data: fixtures loaded only by libloading's Windows-only tests, never on Linux +# Source-Binary-Exception: vendor.tar.zst:vendor/flate2-*/tests/corrupt-gz-file.bin -- test-data: gzip decode-error fixture read by flate2's corrupt-file tests, never executed # PATCH-FIX-OPENSUSE codex-drop-v8-code-mode.patch [email protected] -- drop the workspace members whose v8 dependency downloads a prebuilt library at build time Patch0: codex-drop-v8-code-mode.patch # PATCH-FIX-OPENSUSE codex-no-startup-update-check.patch [email protected] -- distribution policy: do not probe github.com for updates on startup @@ -151,6 +163,9 @@ # bindings need the 6.9.3 API; libsqlite3-sys asks pkg-config for 3.34.1. BuildRequires: pkgconfig(oniguruma) >= 6.9.3 BuildRequires: pkgconfig(openssl) +# code-mode-protocol's build script shells out to protoc (Patch0 drops its +# vendored prebuilt protoc); the compiler comes from this package. +BuildRequires: pkgconfig(protobuf) BuildRequires: pkgconfig(sqlite3) >= 3.34.1 # The Linux sandbox launcher looks up bwrap in PATH and panics when it is # absent, so this is a hard requirement rather than a recommendation. @@ -268,6 +283,9 @@ # which parallelises that step and brings the peak down to what _constraints # asks for. export CARGO_PROFILE_RELEASE_CODEGEN_UNITS=16 +# code-mode-protocol's build script needs the system protoc (Patch0); +# protobuf-devel provides %%{_bindir}/protoc (see the pkgconfig() BR above). +export PROTOC=%{_bindir}/protoc cd codex-rs # Only codex-cli is built: a workspace-wide build would also pull the v8 # crate through the code-mode members, which cannot be built offline. @@ -347,6 +365,10 @@ # these the test profile would rebuild them with the library bundled. export LIBSQLITE3_SYS_USE_PKG_CONFIG=1 export RUSTONIG_SYSTEM_LIBONIG=1 +# code-mode-protocol is outside the %%check allowlist today, but exporting +# PROTOC here too keeps the suite green if the allowlist ever grows to +# cover a crate that reaches it (same system protoc as %%build). +export PROTOC=%{_bindir}/protoc # %%limit_build reaches %%build alone: it sets _threads inside that section's # shell, so %%check expands %%{?_smp_mflags} back to -j$(nproc) and links the # test harnesses with every core - 33 GB measured at -j32, on top of what ++++++ _service ++++++ --- /var/tmp/diff_new_pack.bAQqgt/_old 2026-10-31 23:14:44.413813623 +0100 +++ /var/tmp/diff_new_pack.bAQqgt/_new 2026-10-31 23:14:44.416813747 +0100 @@ -11,11 +11,11 @@ feature and leaves the lockfile, hence the vendored set, untouched. To regenerate: - tar xf codex-rust-v0.165.0.tar.gz - patch -p1 -d codex-rust-v0.165.0 < codex-drop-v8-code-mode.patch - rm -rf codex-rust-v0.165.0/codex-rs/vendor + tar xf codex-rust-v0.166.0.tar.gz + patch -p1 -d codex-rust-v0.166.0 < codex-drop-v8-code-mode.patch + rm -rf codex-rust-v0.166.0/codex-rs/vendor osc service manualrun cargo_vendor - rm -rf codex-rust-v0.165.0 + rm -rf codex-rust-v0.166.0 The codex-rs/vendor removal drops the bundled bubblewrap 0.11.2 C sources, which %prep removes as well - codex uses the system bubblewrap instead. @@ -51,18 +51,37 @@ and no dnssec-ring/dnssec-aws-lc-rs feature, which is 0118's own precondition, and the same missing feature keeps CVE-2026-93657 out (it needs DNSSEC validation on). boo#1281744 (CVE-2026-91986) is the - same story for the other linked crate: the linked gix-transport 0.55.1 - is pulled in with default features only, so the git-daemon connect - builder the CVE injects into is never compiled. All three bugs are - WONTFIX on those grounds and are cited in openai-codex.changes, so the - next sweep does not redo the triage. Re-run the bare-lockfile audit - on each bump - the fix for the linked four is an upstream dependency - bump, not anything this package can vendor around. + same story for the other linked crate: the linked gix-transport (0.61.0 + at 0.166.0, re-verified) is pulled in with default features only, so + the git-daemon connect builder the CVE injects into is never compiled. + All three bugs are WONTFIX on those grounds and are cited in + openai-codex.changes, so the next sweep does not redo the triage. + As of 0.166.0 the bare lock reports ten: the same four (quick-xml + 0.39.4 still via codex-tui -> syntect -> plist, with a fixed 0.41.0 + linked in parallel via codex-protocol; hickory-proto 0.25.2 still via + codex-network-proxy -> rama-tcp -> rama-dns, hickory-resolver still + 0.25.2 with system-config + tokio only, re-verified) plus + RUSTSEC-2026-0387 (crypto-bigint 0.5.5 timing, linked via + codex-secrets -> age -> p256; upstream PR #57206 records it ignored in + their own dependency checks), RUSTSEC-2026-0391 plus RUSTSEC-2026-0398, + -0403, -0404, -0405 (zstd 0.13.3 / zstd-safe 7.2.4, linked via + codex-app-server-protocol; the C library stays the system one via + Patch2, and upstream PR #57255 records reviewed exceptions for the + zstd advisories). RUSTSEC-2026-0410 (zstd-sys) is WebAssembly-only and + RUSTSEC-2026-0418 (libz-sys 1.1.29) is not in the codex-cli closure at + all. None of the ten carries a CVE id - the fix for every linked one + is an upstream dependency bump, not anything this package can vendor + around. Re-run the bare-lockfile audit on each bump. --> <service name="cargo_vendor" mode="manual"> - <param name="srcdir">codex-rust-v0.165.0/codex-rs</param> + <param name="srcdir">codex-rust-v0.166.0/codex-rs</param> <param name="compression">zst</param> <param name="update">false</param> + <!-- filter=true drops the crates no Linux target uses (winapi import + libs, windows_* import libs, mxc-sdk, wasm-only helpers) so they + never enter vendor.tar.zst. Verified 0.166.0: the Linux closure is + unchanged (same linked set as the unfiltered tree). --> + <param name="filter">true</param> </service> </services> ++++++ codex-drop-v8-code-mode.patch ++++++ --- /var/tmp/diff_new_pack.bAQqgt/_old 2026-10-31 23:14:44.431814369 +0100 +++ /var/tmp/diff_new_pack.bAQqgt/_new 2026-10-31 23:14:44.434814493 +0100 @@ -16,21 +16,33 @@ in the removed code-mode-runtime. Either way the code_mode tool is registered only when the UnderDevelopment code_mode flag is on. +Since 0.166.0 the patch also removes the [patch.crates-io] entry pinning +v8 to a git revision: with no workspace member left using the crate, cargo +still resolves the git source at lock time, which fails offline. Removing +the one line restores the offline build; the remaining git patches +(crossterm, tungstenite) are used and stay vendored. + +The surviving code-mode-protocol member's build script executes a vendored +prebuilt protoc (protoc-bin-vendored) at build time, which cannot ship in +the sources. The patch drops that build-dependency and takes the compiler +from the PROTOC environment variable instead, i.e. the distribution +protobuf (BuildRequires: pkgconfig(protobuf), PROTOC export in %build). + Downstream-only distribution policy, not suitable for upstream submission. --- a/codex-rs/Cargo.toml +++ b/codex-rs/Cargo.toml -@@ -26,9 +26,7 @@ +@@ -27,9 +27,7 @@ "install-context", "codex-backend-openapi-models", "code-mode", - "code-mode-host", "code-mode-protocol", - "code-mode-runtime", + "plugin-host", "codex-home", "cloud-config", - "cloud-tasks", -@@ -107,7 +107,6 @@ +@@ -117,7 +115,6 @@ "tui", "user-verification", "tools", @@ -38,15 +50,15 @@ "websocket-auth", "websocket-client", "windows-sandbox-rs/tests/support", -@@ -198,7 +195,6 @@ +@@ -209,7 +206,6 @@ codex-cloud-tasks-mock-client = { path = "cloud-tasks-mock-client" } codex-code-mode = { path = "code-mode" } codex-code-mode-protocol = { path = "code-mode-protocol" } -codex-code-mode-runtime = { path = "code-mode-runtime" } + codex-plugin-host = { path = "plugin-host" } codex-home = { path = "codex-home" } codex-http-client = { path = "http-client" } - codex-websocket-auth = { path = "websocket-auth" } -@@ -311,7 +310,6 @@ +@@ -331,7 +327,6 @@ codex-utils-string = { path = "utils/string" } codex-utils-template = { path = "utils/template" } codex-user-verification = { path = "user-verification" } @@ -54,7 +66,7 @@ codex-workload-identity = { path = "workload-identity" } codex-windows-sandbox = { path = "windows-sandbox-rs" } codex-windows-sandbox-test-support = { path = "windows-sandbox-rs/tests/support" } -@@ -536,7 +531,6 @@ +@@ -557,7 +552,6 @@ url = "2" urlencoding = "2.1" uuid = "1" @@ -62,7 +74,7 @@ vt100 = "0.16.2" walkdir = "2.5.0" webbrowser = "1.2.2" -@@ -597,7 +591,6 @@ +@@ -631,7 +625,6 @@ ignored = [ "icu_provider", "openssl-sys", @@ -70,4 +82,41 @@ ] [profile.dev] +@@ -673,7 +666,6 @@ + crossterm = { git = "https://github.com/openai-oss-forks/crossterm";, rev = "ed1cdab335221515706178d68495bba2aed1924f" } + tokio-tungstenite = { git = "https://github.com/openai-oss-forks/tokio-tungstenite";, rev = "0e5b2d73aa18dd9f0a50ee9ff199d5aef7594186" } + tungstenite = { git = "https://github.com/openai-oss-forks/tungstenite-rs";, rev = "4fffad30fe373adbdcffab9545e9e9bf4f2fc19f" } +-v8 = { git = "https://github.com/seanh-oai/rusty_v8.git";, rev = "350c5a859a9b3c84ab8701b3ad51e3b7699b30c0" } + + # Uncomment to debug local changes. + # rmcp = { path = "../../rust-sdk/crates/rmcp" } +--- a/codex-rs/code-mode-protocol/Cargo.toml ++++ b/codex-rs/code-mode-protocol/Cargo.toml +@@ -24,7 +24,6 @@ + + [build-dependencies] + glob = { workspace = true } +-protoc-bin-vendored = "3.2.0" + tonic-prost-build = { version = "=0.14.3", default-features = false, features = ["transport"] } + + # Cargo-shear cannot inspect the prost and tonic-prost references in generated gRPC bindings. +--- a/codex-rs/code-mode-protocol/build.rs ++++ b/codex-rs/code-mode-protocol/build.rs +@@ -4,8 +4,15 @@ + println!("cargo:rustc-check-cfg=cfg(codex_bazel)"); + println!("cargo:rerun-if-changed=src/grpc"); + ++ // Distribution build: the protoc-bin-vendored prebuilt protoc cannot ++ // ship in the sources, so the compiler comes from PROTOC (the system ++ // protobuf, see the spec). Fail fast when it is not set. ++ let protoc = std::env::var_os("PROTOC").map(PathBuf::from).ok_or( ++ "PROTOC must point at the system protoc (BuildRequires: pkgconfig(protobuf))", ++ )?; ++ + let mut config = tonic_prost_build::Config::new(); +- config.protoc_executable(protoc_bin_vendored::protoc_bin_path()?); ++ config.protoc_executable(protoc); + let proto_files = glob::glob("src/grpc/*.proto")?.collect::<Result<Vec<_>, _>>()?; + + tonic_prost_build::configure() ++++++ codex-rust-v0.165.0.tar.gz -> codex-rust-v0.166.0.tar.gz ++++++ /work/SRC/openSUSE:Factory/openai-codex/codex-rust-v0.165.0.tar.gz /work/SRC/openSUSE:Factory/.openai-codex.new.1255/codex-rust-v0.166.0.tar.gz differ: char 23, line 1 ++++++ vendor.tar.zst ++++++ /work/SRC/openSUSE:Factory/openai-codex/vendor.tar.zst /work/SRC/openSUSE:Factory/.openai-codex.new.1255/vendor.tar.zst differ: char 6, line 1
