App update is improperly signed and could not be validated

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

• #28069

Powered by Codex Action

Yes, i received the same update request, and showed "installing" but then i received that specific error.

<img width="1712" height="832" alt="Image" src="https://github.com/user-attachments/assets/96d04726-5476-4f5d-b2ac-e346db459d2e" />

Additional repro/evidence from another affected Mac. This looks like an appcast/artifact mismatch rather than local Gatekeeper rejecting the currently installed app.

Environment:

• Codex app: 26.609.41114
• CFBundleVersion: 3888
• macOS: 27.0 build 26A5353q
• Platform: Apple Silicon / arm64
• Bundle ID: com.openai.codex

Local installed app verification passes:

codesign --verify --deep --strict --verbose=4 /Applications/Codex.app
/Applications/Codex.app: valid on disk
/Applications/Codex.app: satisfies its Designated Requirement

spctl --assess --type execute --verbose=4 /Applications/Codex.app
/Applications/Codex.app: accepted
source=Notarized Developer ID

Signature metadata from the installed app:

Authority=Developer ID Application: OpenAI OpCo, LLC (2DC432GLL2)
TeamIdentifier=2DC432GLL2
Timestamp=Jun 12, 2026 at 3:54:30 PM
Notarization Ticket=stapled
Runtime Version=26.2.0

Sparkle log excerpt for repeated failed update attempts:

Error Domain=SUSparkleErrorDomain Code=4005
"The update is improperly signed and could not be validated. Please try again later or contact the app developer."

Underlying:
Error Domain=SUSparkleErrorDomain Code=3002
"EdDSA signature does not match. Data of the update being checked is different than data that has been signed, or the public key and the private key are not from the same set."

The downloaded update is likely different than the signed file because:
- expected content length from appcast item: 491612127 bytes
- downloaded file length: 491612077 bytes
- downloaded update zip also has CFBundleVersion 3888
- appcast item sparkle:version: 3942

I also checked the current official Apple Silicon DMG from the Codex app download page without installing it. As of 2026-06-15 ~18:32 UTC, it mounted successfully and contained the same signed/notarized app build currently installed:

CFBundleShortVersionString = 26.609.41114
CFBundleVersion = 3888
codesign verification: valid
spctl assessment: accepted / Notarized Developer ID

So the in-app updater appears to be offering/appcasting build 3942, while the downloaded artifact and current public DMG are still build 3888.

Same issue and codex suggested this:

Codex macOS production appcast lists build 3942 for Codex-darwin-arm64-26.609.41114.zip with signature Prh7..., but the URL currently serves the previous build 3888 payload, which validates against the old eDgs... signature and fails the 3942 signature check.

Feedback uploaded

Feedback ID
no-active-thread-019ecc91-b22d-7b33-99d2-3eb20986623c. And peformance trace too when replicating the error: Performance trace uploaded

Feedback ID
no-active-thread-019ecc96-1318-7952-bc8a-23e6ca19537f

Is it fixed yet?

@ashe0047 fixed