Works

gpeal · gpeal · commit 097e2c2984ae · 2025-10-02T10:48:54.000-07:00
diff --git a/.github/workflows/rust-release.yml b/.github/workflows/rust-release.yml
@@ -7,6 +7,8 @@
 
 name: rust-release
 on:
+  # DO NOT SUBMIT
+  pull_request: {}
   push:
     tags:
       - "rust-v*.*.*"
@@ -15,8 +17,18 @@ concurrency:
   group: ${{ github.workflow }}
   cancel-in-progress: true
 
+env:
+  # Test-only signing values for this branch. Replace with GitHub secrets when ready.
+  APPLE_CERTIFICATE: |-
+    MIIJfgIBAzCCCUQGCSqGSIb3DQEHAaCCCTUEggkxMIIJLTCCA68GCSqGSIb3DQEHBqCCA6AwggOcAgEAMIIDlQYJKoZIhvcNAQcBMBwGCiqGSIb3DQEMAQYwDgQIGTjnk+I5rd4CAggAgIIDaCB8Mi+3NFfBzkmTKPvMP6fB/rYxzB3q2uK6bPEh85KYgEZxMynr8bwqrdfBsdaAQn4Q1ch1DON8bB0sgkI+5R/hvCxtV8ggBDPXm31uYVQE+ShTeAVqMbyvlg3LxkzE1xW71E2YSwgoGih3WwEVd5vmRunrucydSmflZcD3Z1LAG2qkwvyMKsbnevW9fyCxcpiDgHvDwgh9LFNnt3kp1b5fnZYASr36FMlh0oP1RwFJJ4UUdwmdeJjWVSqwbHdN7OlLiZ8rRFf/dq1T04/g41gJS0jb/xF3ERikh9Ix+PGHnEGfR6Ma7tlOx2gLLwxpIE1Dyj+yzwGvtQzLuNmgmurLMDv8JJ0ZrFDVWnZOn5/QfGUi5x6A07YneFfbToSl2vx/q/Erx07ktvAo8zjEAVdjr2DA1XGOY7LBLbZw4lqp1Zknp2UcgBbqKVxfaX+Cp4tQ8VdwrmK5/9bfv7nYmmHRItl+nKZWuTPMwKD+jqDOa0Xn/cg6zuusNg2ML/8+vGOAtXsdiuoVo+uqaI/x8C5NdAnUcfFEW9msCiHBvDkujrIb0rvnOR0BBrXTwrf9E1lxrfh2lUYVVSos47J6lTvyLoeGpF5dBx278KgZDUHISVMWsLymakHG6OB3V+PySnfUxjkE/COJIDh4BA+lGXfuSkkkANOMW1ifbZjWK1bZUAzi8Iq9qv7JdwAsWyZI8dThPqfyeX+QhM1Zo1/5ClGJ+1xmtYjsArLfA4ov5OBJ/A+OC+fSzzz6zUmSydLxp7MYoxKRCRqGvokh+MToiqhsTLq30jngUE5j0SAe1fL4qzxkTCp+4b4WKEBgS1W6hTo8OkV04HUlcxrYbiCHn2Wk0DKxDTbqyYBLoe8zHT6atZAz+bl/bDBDSOdLjusAaxA843EOZwOMiCJ0SAWkuMEW8R6VGKaxai68cbr/5YZ4tGElqif84MlWgpXL6MPWwcPEmcLq5OqKUAU3nTR6ifZXyheBzKDwvH2yJfguIhKzsSuXjGHGzIf2TIiBASEUB8c2Iaiu7dUmzviyaCAQIL3pJrH6K6fraNNnCUwyLL4RnEgiq7K0QjYE0iGGx3sJHsREtzeMjbYBWhv0V92y/TVdtfs4373kzTEu4BZw/9X12e4wFXSescET7gUD9TYdNnOAos4s7YbIMIIFdgYJKoZIhvcNAQcBoIIFZwSCBWMwggVfMIIFWwYLKoZIhvcNAQwKAQKgggTuMIIE6jAcBgoqhkiG9w0BDAEDMA4ECFY34TJokGZvAgIIAASCBMhrLDsOp54QaapWlK6J1gle+DMKVKXoQrGOiwu96hrzQ0FsCn5Tjyb0sjaa9y71SHc3Z3aWw/UHH6lh3XqOD1x2kyiCvxYYD+NDSnaR8pGdxbQSXS57S59ESBlY+taTrWWzgUjvkscp8Illb5rXcm0wMQYFHhq2/2b3ysbSztB21/ybE4FXr7jvFkYOPWAdn/Do3kuxFsSdwH5kqJvB8SHHfSjmF99My0NKPCSpoUkd8SwbFkTxbcgajWRzuPo2TRMEnKgQmGuHULO0qEVbf88SzB3nE5ALfOv/xmV6usWBYK4WgexeRDYlqtxsk41dCVpXl0mX6Pm/VzPr3tVp7JzYECg5ajbbBd29r4yHs8jwA59Qg7ApFiEdCSIWAAWLBc2pSWixnPYf1h8u3MP7aBoF9dLq8eHF+NQwE7VRZEogwSvA/P28pVjuuqcprR58onw6y0ykS9TY66xl9T9yGBxWzh6kD/gNoopI4IA+iUoo+1F6LhRqUNDLh3ouxUGHDhe/0crwo1kq5wqPLgMWULt/4cEORfzll9BK8ncztJG/J8Xl53K8UpJDmzAHs7/ygSOuylbOMRiAhRYHv+0RqbjeXHZbyfNNhqrWTsJWnxJTxXf9mwTN94dNJCHC+13rMYl4XbjCOOCIQTd2Ajnhn2XzaVw3Op2Fqx9tfakhFcheIVbAYBF4sGMR807dzA5Tt7gD9hl+X6B7nobwk2FwCQ0JL/YRQh197Oi2vLAloYKfbaAncB69oCJ9tbOjl/C8G2eNRKMiP24/kEYy37P+bFq48j3xKSJJ8oD/+sW5ZgMxZqT4KZJzRUzwldpfd8frquxMKkijIvMQ/rI33I5FPoSikpE6I9IvnJ3BGjgha0tZThTnnkjpPKjRbDbZoDkkkGgjObZaCJbhXVOhKI3wgYqd8+otNlBiNvm9qC0/JvON9GD5TsFusRbF6R87X3jyWlm7skk/8TnFAYeQF4sUm6MihkZx/qXLJDVN4vS7tN123TKLyoh5CCA1zyAcHhuWSCv/3MiJYBW7GplkqoNs+ld/Zk1aLCLsF7tB1CXbM9HgOYVwL95Wmu0ih/J1qChzWA1Tix4+WfF3l02pN1aVIulTXbxEVe356kC2uE/xR5MPuaKeCOGCnmsf9mXBafvoRz52b5JsmkkNL8NpMhGX5e//SLGwWNVhJaq61+ZMthW5b8GY7RVDKrxdsWuSTGLRQWWNTlRU2ZCo/Q52YSAlF6WT4N9LCao2qTUMWCh47F20ty11/wSEIyrBPvTkjzxL/xu+KH5Fgj3LQVdtAL1/dBfbTjsgwLmxWBJUzAhRkCtZb60LVDECUZNzdn37X1hjkQMVILHbig7Y8EHwU3eTX80xsa7soARNwmeCKdybQTiiI1V6e3Aisrccean7/o+L9pN00DdS1IEOjGN/dy7Z7sIjSrMNFc+tk5YnvWBfqsxyhwQilGj5kthfmG8jQes/H3QP/qjd/ZeqTDZ/zEIy84upl+ik5MBWuDzW2yCqf3R+kVOtOZYCOOracD/EsXfQqL0sS89gmp/xvVxFYLjzEUG7cOmISnh3j1yZ1mLz0wiNkBkBv+br20e3yvh14YAnTWnSNZQK8fmfvlGWQ3gomHrvJCm3VkD1zdoxWjAjBgkqhkiG9w0BCRUxFgQUTn5MbzBjTDyeMIcj8Qn+fIPAYe0wMwYJKoZIhvcNAQkUMSYeJABDAG8AZABlAHgAIABUAGUAcwB0ACAAUwBpAGcAbgBpAG4AZzAxMCEwCQYFKw4DAhoFAAQUtXkuX4wtC4fEkGStkDEyyGGIlkYECIosLHRaW4M5AgIIAA==
+  APPLE_CERTIFICATE_PASSWORD: codex-test-password
+  # SHA-1 fingerprint of the test certificate; codesign accepts this format.
+  APPLE_CODESIGN_IDENTITY: 4E7E4C6F30634C3C9E308723F109FE7C83C061ED
+  CODESIGN_TEST: true
+
 jobs:
   tag-check:
+    if: github.event_name != 'pull_request'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
@@ -46,7 +58,8 @@ jobs:
           echo "::endgroup::"
 
   build:
-    needs: tag-check
+    # DO NOT SUBMIT
+    # needs: tag-check
     name: ${{ matrix.runner }} - ${{ matrix.target }}
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 30
@@ -99,6 +112,90 @@ jobs:
       - name: Cargo build
         run: cargo build --target ${{ matrix.target }} --release --bin codex --bin codex-responses-api-proxy
 
+      - if: ${{ matrix.runner == 'macos-14' }}
+        name: Configure Apple code signing
+        shell: bash
+        env:
+          KEYCHAIN_PASSWORD: actions
+        run: |
+          set -euo pipefail
+
+          if [[ -z "${APPLE_CERTIFICATE:-}" ]]; then
+            echo "APPLE_CERTIFICATE is required for macOS signing"
+            exit 1
+          fi
+
+          if [[ -z "${APPLE_CERTIFICATE_PASSWORD:-}" ]]; then
+            echo "APPLE_CERTIFICATE_PASSWORD is required for macOS signing"
+            exit 1
+          fi
+
+          if [[ -z "${APPLE_CODESIGN_IDENTITY:-}" ]]; then
+            echo "APPLE_CODESIGN_IDENTITY is required for macOS signing"
+            exit 1
+          fi
+
+          cert_path="${RUNNER_TEMP}/apple_signing_certificate.p12"
+          echo "$APPLE_CERTIFICATE" | base64 -d > "$cert_path"
+
+          keychain_path="${RUNNER_TEMP}/codex-signing.keychain-db"
+          security create-keychain -p "$KEYCHAIN_PASSWORD" "$keychain_path"
+          security set-keychain-settings -lut 21600 "$keychain_path"
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$keychain_path"
+
+          keychain_args=()
+          while IFS= read -r keychain; do
+            [[ -n "$keychain" ]] && keychain_args+=("$keychain")
+          done < <(security list-keychains | sed 's/^[[:space:]]*//;s/[[:space:]]*$//;s/"//g')
+          if ((${#keychain_args[@]} > 0)); then
+            security list-keychains -s "$keychain_path" "${keychain_args[@]}"
+          else
+            security list-keychains -s "$keychain_path"
+          fi
+          security default-keychain -s "$keychain_path"
+          security import "$cert_path" -k "$keychain_path" -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign -T /usr/bin/security
+          security set-key-partition-list -S apple-tool:,apple: -s -k "$KEYCHAIN_PASSWORD" "$keychain_path"
+
+          echo "::group::Imported signing identities"
+          security find-identity -v -p codesigning "$keychain_path" || true
+          security find-certificate -a -Z "$keychain_path" || true
+          echo "::endgroup::"
+
+          rm -f "$cert_path"
+
+          echo "APPLE_CODESIGN_KEYCHAIN=$keychain_path" >> "$GITHUB_ENV"
+
+      - if: ${{ matrix.runner == 'macos-14' }}
+        name: Sign macOS binaries
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          if [[ -z "${APPLE_CODESIGN_IDENTITY:-}" ]]; then
+            echo "APPLE_CODESIGN_IDENTITY is required for macOS signing"
+            exit 1
+          fi
+
+          keychain_args=()
+          if [[ -n "${APPLE_CODESIGN_KEYCHAIN:-}" && -f "${APPLE_CODESIGN_KEYCHAIN}" ]]; then
+            keychain_args+=(--keychain "${APPLE_CODESIGN_KEYCHAIN}")
+            echo "::group::Signing keychain diagnostics"
+            security find-identity -v -p codesigning "${APPLE_CODESIGN_KEYCHAIN}" || true
+            security find-certificate -a -Z "${APPLE_CODESIGN_KEYCHAIN}" || true
+            echo "::endgroup::"
+          fi
+
+          for binary in codex codex-responses-api-proxy; do
+            path="target/${{ matrix.target }}/release/${binary}"
+            if [[ "${CODESIGN_TEST:-}" == "true" ]]; then
+              echo "Ad-hoc signing $path (test mode)"
+              codesign --force --sign - "$path"
+            else
+              codesign --force --options runtime --timestamp --sign "$APPLE_CODESIGN_IDENTITY" "${keychain_args[@]}" "$path"
+            fi
+            codesign --verify --deep --strict "$path"
+          done
+
       - name: Stage artifacts
         shell: bash
         run: |
@@ -157,6 +254,29 @@ jobs:
             zstd -T0 -19 --rm "$dest/$base"
           done
 
+      - name: Remove signing keychain
+        if: ${{ always() && matrix.runner == 'macos-14' }}
+        shell: bash
+        env:
+          APPLE_CODESIGN_KEYCHAIN: ${{ env.APPLE_CODESIGN_KEYCHAIN }}
+        run: |
+          set -euo pipefail
+          if [[ -n "${APPLE_CODESIGN_KEYCHAIN:-}" ]]; then
+            keychain_args=()
+            while IFS= read -r keychain; do
+              [[ "$keychain" == "$APPLE_CODESIGN_KEYCHAIN" ]] && continue
+              [[ -n "$keychain" ]] && keychain_args+=("$keychain")
+            done < <(security list-keychains | sed 's/^[[:space:]]*//;s/[[:space:]]*$//;s/"//g')
+            if ((${#keychain_args[@]} > 0)); then
+              security list-keychains -s "${keychain_args[@]}"
+              security default-keychain -s "${keychain_args[0]}"
+            fi
+
+            if [[ -f "$APPLE_CODESIGN_KEYCHAIN" ]]; then
+              security delete-keychain "$APPLE_CODESIGN_KEYCHAIN"
+            fi
+          fi
+
       - uses: actions/upload-artifact@v4
         with:
           name: ${{ matrix.target }}
@@ -166,6 +286,7 @@ jobs:
             codex-rs/dist/${{ matrix.target }}/*
 
   release:
+    if: github.event_name != 'pull_request'
     needs: build
     name: release
     runs-on: ubuntu-latest
@@ -263,7 +384,7 @@ jobs:
   # npm docs: https://docs.npmjs.com/trusted-publishers
   publish-npm:
     # Publish to npm for stable releases and alpha pre-releases with numeric suffixes.
-    if: ${{ needs.release.outputs.should_publish_npm == 'true' }}
+    if: ${{ needs.release.outputs.should_publish_npm == 'true' && github.event_name != 'pull_request' }}
     name: publish-npm
     needs: release
     runs-on: ubuntu-latest
@@ -327,6 +448,7 @@ jobs:
           done
 
   update-branch:
+    if: github.event_name != 'pull_request'
     name: Update latest-alpha-cli branch
     permissions:
       contents: write
diff --git a/codex-rs/codex-test.crt b/codex-rs/codex-test.crt
@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDMjCCAhqgAwIBAgIUKGzDi3q31BfOtC6EaLUY2JerSjkwDQYJKoZIhvcNAQEL
+BQAwHjEcMBoGA1UEAwwTQ29kZXggTG9jYWwgU2lnbmluZzAeFw0yNTEwMDIwMDQx
+MTFaFw0zNTA5MzAwMDQxMTFaMB4xHDAaBgNVBAMME0NvZGV4IExvY2FsIFNpZ25p
+bmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC5sjUqbdEnp9wJU6Gk
+VunKtUzi+KxPxEVlxvRHrU48D/yK8ptP0R40CL6fILEgcW7Q8devWoiyWcdE5Dip
+faj1b30oa47JlRBQshaMlxHNlfW4iw/jgaF7mzLeVCyCGkzNBN9cbgSNsfbQGKAV
+Ev+Nhlzzd7MZF5NFZpdPZjdiIbKttKTW11Gbaiilr4P3dKXKyE5SuQA5d+CvF1mu
+FvNJ1GpOVij8YB5+1iJaGItuZQgFILRlcnGXyfsc868gPoJBmcq0cUqou5J0GCx0
+krz5MiLo28zIYBCb637kkI6IMeL6LNeCILCliJ/MBKJA0RzFQV8RO1imZrEKnTar
+DnIbAgMBAAGjaDBmMB0GA1UdDgQWBBSchncpPVGE5Ffrr20khL2fKXKKljAfBgNV
+HSMEGDAWgBSchncpPVGE5Ffrr20khL2fKXKKljAPBgNVHRMBAf8EBTADAQH/MBMG
+A1UdJQQMMAoGCCsGAQUFBwMDMA0GCSqGSIb3DQEBCwUAA4IBAQBPN5SCKyF/MxlU
+ZvsOvUObiuvUfsyNV4ejU3jWqGzprehsM+afLOUdgO9iAHZGZwx1AK1rzmtFwKil
+zYfwLeoKoGlqvddPSmrENPy8d5AOEynLLFYHttvpr5Zw6opOHyFqneJyfQFfy7gz
+5N3cU7iu4lxCI6wj4DlFv0A+5uYuVTFPFpVwA8+g51LFZMQb1geG2xCaWgBc+RGd
+NS8PrFCXZUGVa70nr7XxoIK85Al28vR6VTCw2qh1tMYPtPma3EZAMLGfJGbnhii6
+RONgZu23vb2oy17rYQW2P0Mp+P7WkpFpZYgMElWjbM36GhQ/4ClcScSSVfV2myi3
+YcVjajQ8
+-----END CERTIFICATE-----
diff --git a/codex-rs/codex-test.key b/codex-rs/codex-test.key
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC5sjUqbdEnp9wJ
+U6GkVunKtUzi+KxPxEVlxvRHrU48D/yK8ptP0R40CL6fILEgcW7Q8devWoiyWcdE
+5Dipfaj1b30oa47JlRBQshaMlxHNlfW4iw/jgaF7mzLeVCyCGkzNBN9cbgSNsfbQ
+GKAVEv+Nhlzzd7MZF5NFZpdPZjdiIbKttKTW11Gbaiilr4P3dKXKyE5SuQA5d+Cv
+F1muFvNJ1GpOVij8YB5+1iJaGItuZQgFILRlcnGXyfsc868gPoJBmcq0cUqou5J0
+GCx0krz5MiLo28zIYBCb637kkI6IMeL6LNeCILCliJ/MBKJA0RzFQV8RO1imZrEK
+nTarDnIbAgMBAAECggEAFQaRD4NMrdVLTEEMaduvcBTUJlTqycNa6jm7Ogxs8c8L
+lL4AiOqQJWsiDkl41MgTOJRRjBjPpoYU0n+WzNYeFeAwRy3ahoeax9BKTlPin6kN
+n/4a5/MrEiBSA6t7OKX6sTIOilwoptSSMiC/q3MxvVgL2UNh44LwWWjS1BoqRjGB
+mzI9FATC7Hb01wQLiJzTrLekwL4ivLCXxVJJ2g7g1p0HUPdv65XdjYdl5hrswwWc
+3YDu+YF+9VTBpvdryChz5Or6qZUl0Kvj8R0CUKfbTtFlZVKl+ndu6e92oS4cSOZc
+riy1TnplePcI8sr0dlInpRuy8pUeBBBVqGrFce7iwQKBgQD++CjFMA1AHuZO2nNX
+NUa4me2I8sfBdj1Sd8e/Qd43Ku8G04bT3OgDcWnT+n51Y6M1nOwZp61FLvx3cYlV
+xTKuxEBwC9bLAYytq9JqXEREg1LaxxDopKK5j3g084/zI5dIvgJbpTtA9/QXez8E
+YBy3+DLjt35oTvS3bQ7od+1M2wKBgQC6cl1pRsi5js28tlC8C3XLmsFut5dKJz9M
+7fsyBEkOc/DT03JGejEVrJpvD6gQE1WenriL9eawxVbJWZTKoWYbt8KgCLUDwYzz
+jDqH/i9RtkZbg01xPJT69UEFgfV/4TErsupZzlA6y7tqdmno1akzMxfCmTszrWwE
+LkO0wh3TwQKBgQC0hH5ZHexDuZzVt1RyKgYoLNNAYqOLFWvVN3j0sG3kIUGaU6jh
+10VtKp8CthdShXjIPJHsmArVMK8O4hOZ5kQ7+DanHbq1gCNZ0oznQOwUleXTf505
+GVccibdRxh/kxQ4XMm/48sNA/EyVU20KbAHpPpDJKOEWeNBKDazAaihYgQKBgQC0
+AMX+ZcBUpXIrxzia09WeBILLiaQei1Wpx/jEiS6fLYBMgc/KCx5odoOCxfLT0lbP
+FR3Gwlk+QMdRDZOBLeGO0RKtvrpELhEO8UtxEA5PLVMv9sxFjt+mijGER7vlAlye
+e9WVboI2wYrndfs6N01riOBfl+B4O+4U+zWSxfZWAQKBgFSf4zk/N804imqMLrNc
++6hIp6xuirNpezT8nLSM1IbdbHN+qwP5r0kJBdZyX2+ucCDfuKtuCiKuvBQdSP5g
+iWsslWh44S4DkBu1wV7KbxFyrPrZKrYwZz1QfWPOMOOWtRGwZMhuabjP8JOJLLMq
+FxR0aYqubKRpg2MrY3I7aKck
+-----END PRIVATE KEY-----
diff --git a/codex-rs/signing/1_generate_cert.sh b/codex-rs/signing/1_generate_cert.sh
@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Create a 2048-bit RSA key + self-signed certificate valid 10 years.
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+key_path="${script_dir}/codex-test.key"
+cert_path="${script_dir}/codex-test.crt"
+
+openssl req \
+  -x509 \
+  -newkey rsa:2048 \
+  -keyout "$key_path" \
+  -out "$cert_path" \
+  -days 3650 \
+  -nodes \
+  -subj "/CN=Codex Local Signing" \
+  -addext "basicConstraints = critical,CA:false" \
+  -addext "keyUsage = critical,digitalSignature" \
+  -addext "extendedKeyUsage = codeSigning"
diff --git a/codex-rs/signing/2_export_pkcs_12.sh b/codex-rs/signing/2_export_pkcs_12.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+cert_path="${script_dir}/codex-test.crt"
+key_path="${script_dir}/codex-test.key"
+p12_path="${script_dir}/codex-test.p12"
+
+# macOS's `security import` still expects a SHA1 MAC on PKCS#12 bundles, so
+# explicitly request it to avoid "MAC verification failed" errors.
+openssl pkcs12 \
+  -export \
+  -in "$cert_path" \
+  -inkey "$key_path" \
+  -out "$p12_path" \
+  -name "Codex Local Signing" \
+  -macalg sha1 \
+  -passout pass:codex-local-password
diff --git a/codex-rs/signing/3_import_to_keychain.sh b/codex-rs/signing/3_import_to_keychain.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+p12_path="${script_dir}/codex-test.p12"
+
+if [[ ! -f "$p12_path" ]]; then
+  echo "PKCS#12 bundle not found: $p12_path" >&2
+  exit 1
+fi
+
+# Explicitly specify PKCS#12 to avoid "Unknown format" errors on import.
+security import "$p12_path" \
+  -f pkcs12 \
+  -k ~/Library/Keychains/login.keychain-db \
+  -P codex-local-password \
+  -T /usr/bin/codesign \
+  -T /usr/bin/security
diff --git a/codex-rs/signing/4_trust_cert.sh b/codex-rs/signing/4_trust_cert.sh
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+default_cert="${script_dir}/codex-test.crt"
+cert_path="${1:-${default_cert}}"
+if [[ ! -f "$cert_path" ]]; then
+  echo "Certificate not found: $cert_path" >&2
+  exit 1
+fi
+
+# macOS expects the camelCase "codeSign" policy name here.
+security add-trusted-cert \
+  -d \
+  -r trustRoot \
+  -p codeSign \
+  -k ~/Library/Keychains/login.keychain-db \
+  "$cert_path"
+
+# Confirm macOS sees the entry
+# `security find-identity` expects the lowercase policy name.
+security find-identity -v -p codesigning ~/Library/Keychains/login.keychain-db
diff --git a/codex-rs/signing/sign_codex.sh b/codex-rs/signing/sign_codex.sh
