Linux desktop docs only advertise a mutable latest/ .deb; checksum-pinned packagers break on overwrite

What is the type of issue?

• Documentation is missing
• Documentation is confusing

What is the issue?

The Linux desktop install docs point packagers and users at a mutable blob:

• https://persistent.oaistatic.com/codex-app-prod/linux/deb/latest/chatgpt_amd64.deb
• https://persistent.oaistatic.com/codex-app-prod/linux/deb/latest/chatgpt_arm64.deb

That path is overwritten in place. On 2026-08-13 20:11 UTC, latest/chatgpt_amd64.deb changed from 26.803.81509 (sha256 a9bf91a3…) to 26.810.41047 (sha256 78715fa3…, 391786694 bytes). Any PKGBUILD / Nix FOD / Guix origin that pins sha256 against latest/ fails with FAILED on the next makepkg.

The durable contract already exists and works. It is just not documented on the Linux install page:

| What | URL |
| --- | --- |
| APT Packages (includes Version + SHA256) | https://persistent.oaistatic.com/codex-app-prod/linux/deb/dists/stable/main/binary-amd64/Packages |
| Versioned pool .deb | https://persistent.oaistatic.com/codex-app-prod/linux/deb/pool/main/c/chatgpt/chatgpt_26.810.41047_amd64.deb |

Verified today against that Packages file:

Package: chatgpt
Version: 26.810.41047
Filename: pool/main/c/chatgpt/chatgpt_26.810.41047_amd64.deb
Size: 391786694
SHA256: 78715fa3cd136ff67070daa76819adaecc5b42e99851559659645dce1fbf2af3

This is not a request for an official Arch/Nix package. Downstream packagers can pin the official signed .deb if the versioned pool path and per-arch SHA256 stay published.

Suggested docs/packaging contract (small, already almost there):

1. Document the versioned pool URL and the Packages index on Desktop app (Linux), next to the convenience latest/ links.
2. Keep pool/main/c/chatgpt/chatgpt_${version}_${arch}.deb stable across releases (a rename breaks every pin at once).
3. Optional but useful: publish a SHA256SUMS (or a small versions JSON) next to latest/, so packagers do not have to scrape Packages.

Where did you find it?

• Docs: https://learn.chatgpt.com/docs/codex/linux/linux-app
• Same latest/ URLs are what AUR openai-codex-desktop currently vendors: https://aur.archlinux.org/packages/openai-codex-desktop
• Checksum failure already reported there on 2026-08-13 (comment by hbarcelos) after latest/ was overwritten
• Related ask on the closed Linux-app request, not filed as its own issue: https://github.com/openai/codex/issues/11023#issuecomment-5284456387

Downstream workaround (AUR)

Pin the versioned pool URL instead of latest/. Tested on Arch x86_64: openai-codex-desktop 26.810.41047-1 builds and the bundled binary reports 26.810.41047.

-pkgver=26.803.81509
-pkgrel=8
+pkgver=26.810.41047
+pkgrel=1

 source_x86_64=(
-  "${_deb_x86_64}::https://persistent.oaistatic.com/codex-app-prod/linux/deb/latest/chatgpt_amd64.deb"
+  "${_deb_x86_64}::https://persistent.oaistatic.com/codex-app-prod/linux/deb/pool/main/c/chatgpt/chatgpt_${pkgver}_amd64.deb"
 )
 source_aarch64=(
-  "${_deb_aarch64}::https://persistent.oaistatic.com/codex-app-prod/linux/deb/latest/chatgpt_arm64.deb"
+  "${_deb_aarch64}::https://persistent.oaistatic.com/codex-app-prod/linux/deb/pool/main/c/chatgpt/chatgpt_${pkgver}_arm64.deb"
 )
-sha256sums_x86_64=('a9bf91a368f9f7c4eea38082a9fb8fb46b8d005b719a6d7715d2e5a1982c38eb')
-sha256sums_aarch64=('f38fcc194eca9ab0327dc10c92340681eae77c5d75164df700384ce2adaccbc1')
+sha256sums_x86_64=('78715fa3cd136ff67070daa76819adaecc5b42e99851559659645dce1fbf2af3')
+sha256sums_aarch64=('996f793ca0397676fcb9cd002114c97755cc3741907c400f7f5ddcf6c70c0a4e')

SHA256 values taken from the official Packages index (amd64 + arm64), not from hashing latest/.