Windows codex.exe lacks VERSIONINFO metadata, causing enterprise compliance allowlist failures
Summary
The Windows executable distributed with @openai/codex does not include standard Windows VERSIONINFO metadata fields. This causes enterprise security/compliance tools to block installation or execution after upgrades, because the executable cannot be allowlisted by stable software attributes.
Affected package
- Package:
@openai/codex - Version:
0.142.0 - Platform package:
@openai/codex-win32-x64 - Binary path:
node_modules/@openai/codex/node_modules/@openai/codex-win32-x64/vendor/x86_64-pc-windows-msvc/bin/codex.exe
Observed behavior
The executable is signed by OpenAI, but these Windows file metadata fields are empty:
- CompanyName
- ProductName
- FileDescription
- FileVersion
- ProductVersion
Enterprise security software blocks the executable with a message equivalent to:
The software does not meet company compliance requirements. Please stop installation.
Since the MD5/SHA hash changes on every release, security teams cannot create a durable allowlist rule unless the executable has stable metadata such as CompanyName, ProductName, and ProductVersion.
Expected behavior
Please add standard Windows VERSIONINFO metadata to the Windows codex.exe binary, for example:
- CompanyName: OpenAI OpCo, LLC
- ProductName: Codex
- FileDescription: Codex CLI
- FileVersion: same as release version, e.g. 0.142.0
- ProductVersion: same as release version, e.g. 0.142.0
- LegalCopyright: OpenAI
Why this matters
In managed enterprise Windows environments, software approval often relies on stable executable metadata in addition to code signing. Without these fields, every Codex upgrade can be treated as an unknown executable and blocked again.
Additional note
The desktop Windows app wrapper has product metadata, but the bundled/runtime codex.exe used by the CLI path does not. The issue is with the Windows CLI executable metadata.