›_ Codex Issues
Codex Issues / #23366

CLI binary releases not notarized — blocks Homebrew Cask distribution

Resolved 💬 6 comments Opened May 18, 2026 by chenrui333 Closed May 20, 2026
💡 Likely answer: A maintainer (github-actions[bot], contributor) responded on this thread — see the highlighted reply below.

The codex CLI macOS binaries in GitHub releases are code-signed with Developer ID (OpenAI OpCo, LLC / 2DC432GLL2) but not notarized with Apple.

$ codesign -vvv codex-aarch64-apple-darwin
codex-aarch64-apple-darwin: valid on disk
codex-aarch64-apple-darwin: satisfies its Designated Requirement

$ spctl --assess --verbose=4 codex-aarch64-apple-darwin
codex-aarch64-apple-darwin: rejected
source=Unnotarized Developer ID

This blocks Homebrew Cask distribution — the tap requires all casks to be signed and notarized:

brew audit --cask codex:
  Signature verification failed:
    test-requirement: code failed to satisfy specified code requirement(s)

    The homebrew/cask tap requires all casks to be signed and notarized by Apple.

Ref: https://github.com/Homebrew/homebrew-cask/pull/264918

Ask: Add xcrun notarytool submit + stapling to the macOS release CI pipeline.

View original on GitHub ↗

6 Comments

github-actions[bot] contributor · 2 months ago

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

  • #22135

Powered by Codex Action

ardasevinc · 2 months ago

oh boy, we need this fixed. switching to npm release for now

kim0 · 2 months ago

A bit more diagnostic context that might help whoever picks this up: the regression appears to be specifically from the macOS release pipeline restructure between rust-v0.130.0 and rust-v0.131.0, not just a missed notarization step.

Evidence — signature diff between the two releases:

$ codesign -dvv codex-aarch64-apple-darwin   # 0.130
Authority=Developer ID Application: OpenAI OpCo, LLC (2DC432GLL2)
Timestamp=9 May 2026 at 1:20:59 AM            ← secure RFC 3161 timestamp from Apple TSA
Signature size=9053

$ codesign -dvv codex-aarch64-apple-darwin   # 0.131
Authority=Developer ID Application: OpenAI OpCo, LLC (2DC432GLL2)
Signed Time=18 May 2026 at 8:43:53 PM         ← local clock only, no Apple TSA
Signature size=4744

0.131 lost both the secure timestamp and the notarization, which is why spctl flipped from the lenient "the code is valid but does not seem to be an app" on 0.130 to "source=Unnotarized Developer ID" on 0.131 — and that's what the cask CI's signature_verification check rejects.

Pipeline change that caused it:

In 0.130, .github/workflows/rust-release.yml ran the macos-code-sign composite action in-CI, which does:

codesign --force --options runtime --timestamp --entitlements ... --sign $CERT $binary
xcrun notarytool submit $binary.zip --key ... --wait

For 0.131, the pipeline was restructured into a two-phase build_unsigned → promote_signed flow (#22559, #22737, #22900) where macOS binaries are signed externally in a secure enclave and re-imported. The promote_signed path only verifies the imported signature — there's no xcrun notarytool submit in it:

https://github.com/openai/codex/blob/main/.github/workflows/rust-release.yml#L767-L771

release_path="${dest}/${binary}-${target}"
ditto "$source_path" "$release_path"
chmod 0755 "$release_path"
codesign --verify --strict --verbose=2 "$release_path"   # verify-only

Two ways to fix:

  1. Have the external signing service also notarize (and use --timestamp against Apple's TSA so the signature gets the secure RFC 3161 timestamp). This is the cleaner fix.
  2. Or, add an xcrun notarytool submit --wait step in the promote_signed job after line 771 (the secrets APPLE_NOTARIZATION_* already exist and are wired up — they just aren't used in this code path).

Either restores parity with the 0.130 release flow and unblocks Homebrew/cask#264918.

kim0 · 2 months ago

cc @shijie-oai @bolinfest, flagging since you worked on the build_unsigned/promote_signed restructure (#22737, #22559, #22788, #22900). The notarization gap I described above appears to be a side-effect of that flow change.

shijie-oai contributor · 2 months ago

@kim0 132 mainline is out - this should reenable homebrew to pick our codex CLI now. Please let us know if there is any more issue at this point.

krehel · 2 months ago

https://github.com/Homebrew/homebrew-cask/pull/265214 has been merged with version as 0.132.0 - looks to be resolved.

Thanks all! Appreciate the help!