{"record":{"id":"447ee8315cb2680c","repo":"openai/codex","slug":"invalid-codex-bwrap-sha256-value-err","errorCode":null,"errorMessage":"invalid CODEX_BWRAP_SHA256 value: {err}","messagePattern":"invalid CODEX_BWRAP_SHA256 value: (.+?)","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"codex-rs/linux-sandbox/src/bundled_bwrap.rs","lineNumber":123,"sourceCode":"    if let Some(path) = bazel_bwrap::candidate() {\n        candidates.push(path);\n    }\n    candidates\n}\n\nfn is_executable_file(path: &Path) -> bool {\n    let Ok(metadata) = path.metadata() else {\n        return false;\n    };\n    metadata.is_file() && metadata.permissions().mode() & 0o111 != 0\n}\n\nfn expected_sha256() -> Option<[u8; 32]> {\n    static EXPECTED: OnceLock<Option<[u8; 32]>> = OnceLock::new();\n    *EXPECTED.get_or_init(|| {\n        let raw_digest = option_env!(\"CODEX_BWRAP_SHA256\")?;\n        let digest = parse_sha256_hex(raw_digest)\n            .unwrap_or_else(|err| panic!(\"invalid CODEX_BWRAP_SHA256 value: {err}\"));\n        (digest != NULL_SHA256_DIGEST).then_some(digest)\n    })\n}\n\nfn verify_digest(file: &File, expected: Option<[u8; 32]>, path: &Path) -> Result<(), String> {\n    let Some(expected) = expected else {\n        return Ok(());\n    };\n\n    let mut file = file\n        .try_clone()\n        .map_err(|err| format!(\"failed to clone bundled bubblewrap fd: {err}\"))?;\n    let mut hasher = Sha256::new();\n    let mut buffer = [0_u8; 8192];\n    loop {\n        let read = file.read(&mut buffer).map_err(|err| {\n            format!(\n                \"failed to read bundled bubblewrap {} for digest verification: {err}\",","sourceCodeStart":105,"sourceCodeEnd":141,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/linux-sandbox/src/bundled_bwrap.rs#L105-L141","documentation":"The build pipeline can embed an expected SHA-256 for the bundled bwrap via the compile-time CODEX_BWRAP_SHA256 env var (option_env!). On first sandbox use, expected_sha256() parses that baked-in string and panics unless it is exactly 64 hex characters; an all-zero digest disables verification. This is a build-configuration defect compiled into the binary, evaluated lazily through a OnceLock at first sandbox launch.","triggerScenarios":"Building the linux-sandbox crate with CODEX_BWRAP_SHA256 set to a malformed value: wrong length (truncated copy-paste), a sha256: prefix left on, surrounding quotes or whitespace, or non-hex characters. The panic then hits the first time a sandboxed command runs, not at process startup.","commonSituations":"Release/packaging pipelines passing a prefixed or quoted digest; developers exporting the variable manually with a typo; CI that never launches the sandbox, so the bad value ships unnoticed.","solutions":["Set CODEX_BWRAP_SHA256 to exactly the 64 hex characters of the bwrap digest (no sha256: prefix, no quotes, no whitespace) and rebuild.","Leave the variable unset to disable digest verification entirely (typical for dev builds).","Add a build.rs or CI assertion that the value matches ^[0-9a-fA-F]{64}$ before packaging."],"exampleFix":"# before\nexport CODEX_BWRAP_SHA256='sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08'\n\n# after\nexport CODEX_BWRAP_SHA256=9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08","handlingStrategy":"validation","validationCode":"# CI gate before building or packaging\nif [ -n \"$CODEX_BWRAP_SHA256\" ] && ! echo \"$CODEX_BWRAP_SHA256\" | grep -qE '^[0-9a-fA-F]{64}$'; then\n  echo \"CODEX_BWRAP_SHA256 must be exactly 64 hex characters\" >&2\n  exit 1\nfi","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Gate packaging on the digest format so bad builds fail at build time, not at first sandbox launch.","The panic is lazy (OnceLock): run one sandboxed command in smoke tests to force expected_sha256() evaluation.","Prefer unset over empty when verification is not wanted."],"tags":["rust","build-config","env-var","sha256","sandbox","panic"],"backgroundTag":"invalid-env-var-value","analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}