bug(coder-labs/codex): install.sh SHA-256 check fails on Ubuntu/Debian (mawk default awk)

[matifali]

Module

coder-labs/codex — v5.1.0 (introduced by #908, merged 2026-06-05)

Summary

Workspace builds fail with:

Could not find SHA-256 digest for codex-package-x86_64-unknown-linux-musl.tar.gz in codex-package_SHA256SUMS.

This affects any workspace whose base image uses Ubuntu or Debian (including the Coder dogfood template), where the default awk is mawk.

Root cause

The install_codex() function now delegates to the official OpenAI installer:

curl -fsSL https://chatgpt.com/codex/install.sh | CODEX_RELEASE="..." CODEX_NON_INTERACTIVE=1 sh

That script's package_archive_digest() function uses awk interval syntax to validate the SHA-256 hex string:

$2 == asset && $1 ~ /^[0-9a-fA-F]{64}$/ {

mawk does not support interval expressions ({n}) by default, so this regex never matches and the installer always exits with the above error even though the digest is present in codex-package_SHA256SUMS.

This is a known, open upstream bug:

• install.sh checksum lookup fails on systems using mawk openai/codex#24219 (identifies mawk as root cause)
• Codex CLI 0.137.0 standalone installer is broken on Linux x64 openai/codex#26389 (still broken in 0.137.0)
• Codex CLI self-update still fails on Ubuntu 22.04: missing SHA-256 digest for Linux x64 musl package openai/codex#27194 (still broken in 0.138.0, filed 2026-06-09)

Impact

All workspace builds using the coder-labs/codex module on Ubuntu/Debian fail to install Codex. The bug was introduced when v5.1.0 replaced the npm installation path with the broken upstream script.

Proposed fix

Two options (prefer option B for robustness):

Option A — patch install.sh on the fly before piping to sh:

curl -fsSL https://chatgpt.com/codex/install.sh | \
  sed 's|\$1 ~ \/\^\[0-9a-fA-F\]{64}\$\/|length($1) == 64 \&\& $1 ~ \/^[0-9a-fA-F]+\/|g' | \
  CODEX_RELEASE="$ARG_CODEX_VERSION" CODEX_NON_INTERACTIVE=1 sh

Option B — bypass the broken upstream script entirely; download directly from GitHub releases:

function install_codex_from_github() {
  local arch
  arch=$(uname -m)
  local target="${arch}-unknown-linux-musl"
  local version="$ARG_CODEX_VERSION"
  if [ "$version" = "latest" ]; then
    version=$(curl -fsSL https://api.github.com/repos/openai/codex/releases/latest \
      | grep '"tag_name"' | head -1 | sed 's/.*"rust-v\([^"]*\)".*/\1/')
  fi
  local url="https://github.com/openai/codex/releases/download/rust-v${version}/codex-${target}.tar.gz"
  local tmp_dir
  tmp_dir=$(mktemp -d)
  curl -fL -o "${tmp_dir}/codex.tar.gz" "$url"
  tar -xzf "${tmp_dir}/codex.tar.gz" -C "${tmp_dir}"
  mkdir -p "$HOME/.local/bin"
  mv "${tmp_dir}/codex-${target}" "$HOME/.local/bin/codex"
  chmod +x "$HOME/.local/bin/codex"
  rm -rf "${tmp_dir}"
}

Option B is also cleaner because it avoids relying on chatgpt.com/codex/install.sh being stable — the same script has had two separate install path/layout bugs in the last two weeks (#26389).

Workaround for affected users

Install Codex manually via the direct GitHub releases path shown in Option B above, or set install_codex = false and pre-install Codex in the workspace image.

---

Filed by Coder Agents on behalf of a user.

[linear-code]

ENG-2855