Codex.app on macOS fails code signature verification across versions

What version of the Codex App are you using (From “About Codex” dialog)?

26.415.40636 (1799)

What subscription do you have?

ChatGPT Plus

What platform is your computer?

Darwin 25.4.0 arm macOS 26.4.1 Apple Silicon / arm64

What issue are you seeing?

Codex.app on macOS fails code signature verification.

I originally noticed this while troubleshooting the built-in updater, but this does not appear to be
specific to the latest update. The issue seems to have existed in previous versions as well, and
still reproduces on the current installed version.

Environment:

• App: Codex.app
• Current version: 26.415.40636
• CFBundleVersion: 1799
• macOS: 26.4.1
• Kernel: Darwin 25.4.0
• Architecture: Apple Silicon / arm64
• Install path: /Applications/Codex.app

The app launches from the correct path:

/Applications/Codex.app/Contents/MacOS/Codex

It is not running from AppTranslocation, and com.apple.quarantine is not present on /Applications/
Codex.app.

Running:

codesign --verify --verbose=4 /Applications/Codex.app

returns:

/Applications/Codex.app: invalid signature (code or signature have been modified)
In architecture: arm64

Gatekeeper assessment also fails:

spctl --assess --type execute --verbose=4 /Applications/Codex.app

returns:

/Applications/Codex.app: internal error in Code Signing subsystem

Inspecting the signature shows:

Authority=(unavailable)
Info.plist=not bound
TeamIdentifier=2DC432GLL2
Notarization Ticket=stapled

Running:

codesign -d --entitlements :- /Applications/Codex.app

reports:

warning: binary contains an invalid entitlements blob. The OS will ignore these entitlements.

Nested components such as Codex Helper.app, Electron Framework.framework, Sparkle.framework, and
related helper apps/frameworks also fail with the same invalid signature error.

The app appears to run, but the installed bundle does not pass macOS signature verification. This
seems to affect more than just the latest update.

What steps can reproduce the bug?

1. Install Codex.app on macOS and place it in /Applications.
2. Launch Codex.app normally from /Applications.
3. Confirm the app is not running through App Translocation:

ps auxww | grep -i 'Codex.app' | grep -v grep

The running process path is:

/Applications/Codex.app/Contents/MacOS/Codex

1. Confirm quarantine is not present:

xattr -l /Applications/Codex.app

In my case, com.apple.quarantine is not present.

1. Run code signature verification:

codesign --verify --verbose=4 /Applications/Codex.app

1. Run Gatekeeper assessment:

spctl --assess --type execute --verbose=4 /Applications/Codex.app

1. Inspect entitlements:

codesign -d --entitlements :- /Applications/Codex.app

1. Optionally verify nested components:

find /Applications/Codex.app/Contents -type d \( -name '.app' -o -name '.framework' -o -name
'*.xpc' \) -maxdepth 8 -print

Then run codesign --verify --verbose=2 on the nested apps/frameworks/xpc services.

What is the expected behavior?

Codex.app should pass macOS code signature verification and Gatekeeper assessment when installed in /
Applications and launched normally.

Expected results:

codesign --verify --verbose=4 /Applications/Codex.app

should exit successfully without reporting:

invalid signature (code or signature have been modified)

And:

spctl --assess --type execute --verbose=4 /Applications/Codex.app

should report that the app is accepted.

The app bundle and its nested helpers/frameworks should also have valid signatures, and codesign
should not report an invalid entitlements blob.

Additional information

This was first noticed while troubleshooting the built-in updater, but it does not appear to be
specific to the latest Sparkle update. I believe the same signature verification issue existed in
previous installed versions as well.

The earlier updater issue was related to macOS App Translocation/quarantine, but that part has been
resolved. The current app now launches from:

/Applications/Codex.app/Contents/MacOS/Codex

and com.apple.quarantine is not present.

Current installed version:

Codex.app 26.415.40636
CFBundleVersion 1799

Platform:

Darwin 25.4.0 arm
macOS 26.4.1
Apple Silicon / arm64

Observed verification output:

codesign --verify --verbose=4 /Applications/Codex.app

returns:

/Applications/Codex.app: invalid signature (code or signature have been modified)
In architecture: arm64

spctl --assess --type execute --verbose=4 /Applications/Codex.app

returns:

/Applications/Codex.app: internal error in Code Signing subsystem

codesign -dv --verbose=4 /Applications/Codex.app

includes:

Authority=(unavailable)
Info.plist=not bound
TeamIdentifier=2DC432GLL2
Notarization Ticket=stapled

codesign -d --entitlements :- /Applications/Codex.app

reports:

warning: binary contains an invalid entitlements blob. The OS will ignore these entitlements.

Nested components such as Codex Helper.app, Electron Framework.framework, Sparkle.framework, and
related helper apps/frameworks also fail with the same invalid signature error.

The app still appears to run, but the installed bundle does not pass macOS signature verification.