Codex CLI install.sh: verify_archive_digest overwrites global archive_path

Inspect install.sh at verify_archive_digest and the package download flow around the archive_path and checksum_path assignments. Reproduce the package-layout path using the issue's pre-downloaded files, then verify that checksum validation does not change the archive destination and that installation reads the downloaded archive from the intended temporary path.

What version of Codex CLI is running?

Unrelated

What subscription do you have?

Unrelated

Which model were you using?

Unrelated

What platform is your computer?

Linux 6.8.0-124-generic x86_64 x86_64

What terminal emulator and version are you using (if applicable)?

bash

Codex doctor report

Unrelated

What issue are you seeing?

This is not a CLI bug, but a bug in install.sh.

Root cause

verify_archive_digest reuses the global name archive_path for its first parameter:

verify_archive_digest() {
  archive_path="$1"
  ...
}

In install.sh, the verify_archive_digest function assigns its first argument to the global variable archive_path. When install_layout="package", the script first verifies the checksum manifest file, which overwrites archive_path with the checksum file path. It then downloads the tarball to archive_path—which now points to the checksum file location. Because the tarball overwrites the checksum file in place, the install may still appear to succeed even though $tmp_dir/$asset is never written to.

Execution flow

1. archive_path="$tmp_dir/$asset" — e.g. /tmp/.../codex-package-<target>.tar.gz
2. checksum_path="$tmp_dir/$checksum_asset" — e.g. /tmp/.../codex-package_SHA256SUMS
3. download_file "$checksum_url" "$checksum_path" — checksum manifest downloaded correctly
4. verify_archive_digest "$checksum_path" "$checksum_digest" — overwrites global archive_path to checksum_path
5. download_file "$download_url" "$archive_path" — package is downloaded to the checksum file path, overwriting the manifest
6. verify_archive_digest "$archive_path" "$expected_digest" — verifies the tarball at the checksum path (may still pass)
7. install_package_release "$release_dir" "$archive_path" — extracts from the checksum path (may still succeed)

The intended path $tmp_dir/$asset is never written to.

What steps can reproduce the bug?

Pre-download the checksum file and tarball, and place them alongside install.sh. Echo checksum_url and download_url from the script to obtain the download URLs.

Modify install.sh approximately as follows:

  #archive_path="$tmp_dir/$asset"
  archive_path="$asset"
  #checksum_path="$tmp_dir/$checksum_asset"
  checksum_path="$checksum_asset"
  echo "asset: $asset"
  echo "checksum_asset: $checksum_asset"
  echo "previous archive_path: $archive_path"

  step "Downloading Codex CLI"
  if [ "$install_layout" = "package" ]; then
    checksum_digest="$(release_asset_digest "$checksum_asset")"
    #download_file "$checksum_url" "$checksum_path"
    verify_archive_digest "$checksum_path" "$checksum_digest"
    echo "later archive_path: $archive_path"
    expected_digest="$(package_archive_digest "$asset" "$checksum_path")"
  else
    expected_digest="$(release_asset_digest "$asset")"
  fi
  #download_file "$download_url" "$archive_path"
  verify_archive_digest "$archive_path" "$expected_digest"

You can observe both path variable values in the output and the checksum verification failure from verify_archive_digest.

What is the expected behavior?

Checksum verification should not overwrite the global archive_path variable.

Additional information

How this was discovered

The machine that needed Codex CLI could not download the two URLs referenced by the install script. I echoed checksum_url and download_url, downloaded both files manually on another machine, then placed them in the same directory as install.sh. I changed lines ~1000–1001 from $tmp_dir/$asset / $tmp_dir/$checksum_asset to "$asset" and "$checksum_asset" so the script would use the pre-downloaded local files.