Codex CLI install.sh: verify_archive_digest overwrites global archive_path

What version of Codex CLI is running?

Unrelated

What subscription do you have?

Unrelated

Which model were you using?

Unrelated

What platform is your computer?

Linux 6.8.0-124-generic x86_64 x86_64

What terminal emulator and version are you using (if applicable)?

bash

Codex doctor report

Unrelated

What issue are you seeing?

This is not a CLI bug, but a bug in install.sh.

Root cause

verify_archive_digest reuses the global name archive_path for its first parameter:

``sh verify_archive_digest() { archive_path="$1" ... } ``

In install.sh, the verify_archive_digest function assigns its first argument to the global variable archive_path. When install_layout="package", the script first verifies the checksum manifest file, which overwrites archive_path with the checksum file path. It then downloads the tarball to archive_path—which now points to the checksum file location. Because the tarball overwrites the checksum file in place, the install may still appear to succeed even though $tmp_dir/$asset is never written to.

Execution flow

1. archive_path="$tmp_dir/$asset" — e.g. /tmp/.../codex-package-<target>.tar.gz
2. checksum_path="$tmp_dir/$checksum_asset" — e.g. /tmp/.../codex-package_SHA256SUMS
3. download_file "$checksum_url" "$checksum_path" — checksum manifest downloaded correctly
4. verify_archive_digest "$checksum_path" "$checksum_digest" — overwrites global archive_path to checksum_path
5. download_file "$download_url" "$archive_path" — package is downloaded to the checksum file path, overwriting the manifest
6. verify_archive_digest "$archive_path" "$expected_digest" — verifies the tarball at the checksum path (may still pass)
7. install_package_release "$release_dir" "$archive_path" — extracts from the checksum path (may still succeed)

The intended path $tmp_dir/$asset is never written to.

What steps can reproduce the bug?

Pre-download the checksum file and tarball, and place them alongside install.sh. Echo checksum_url and download_url from the script to obtain the download URLs.

Modify install.sh approximately as follows:

  #archive_path="$tmp_dir/$asset"
  archive_path="$asset"
  #checksum_path="$tmp_dir/$checksum_asset"
  checksum_path="$checksum_asset"
  echo "asset: $asset"
  echo "checksum_asset: $checksum_asset"
  echo "previous archive_path: $archive_path"

  step "Downloading Codex CLI"
  if [ "$install_layout" = "package" ]; then
    checksum_digest="$(release_asset_digest "$checksum_asset")"
    #download_file "$checksum_url" "$checksum_path"
    verify_archive_digest "$checksum_path" "$checksum_digest"
    echo "later archive_path: $archive_path"
    expected_digest="$(package_archive_digest "$asset" "$checksum_path")"
  else
    expected_digest="$(release_asset_digest "$asset")"
  fi
  #download_file "$download_url" "$archive_path"
  verify_archive_digest "$archive_path" "$expected_digest"

You can observe both path variable values in the output and the checksum verification failure from verify_archive_digest.

What is the expected behavior?

Checksum verification should not overwrite the global archive_path variable.

Additional information

How this was discovered

The machine that needed Codex CLI could not download the two URLs referenced by the install script. I echoed checksum_url and download_url, downloaded both files manually on another machine, then placed them in the same directory as install.sh. I changed lines ~1000–1001 from $tmp_dir/$asset / $tmp_dir/$checksum_asset to "$asset" and "$checksum_asset" so the script would use the pre-downloaded local files.