Linux desktop docs only advertise a mutable latest/ .deb; checksum-pinned packagers break on overwrite

What is the type of issue?

• Documentation is missing
• Documentation is confusing

What is the issue?

The Linux desktop install docs point packagers and users at a mutable blob:

• https://persistent.oaistatic.com/codex-app-prod/linux/deb/latest/chatgpt_amd64.deb
• https://persistent.oaistatic.com/codex-app-prod/linux/deb/latest/chatgpt_arm64.deb

That path is overwritten in place. On 2026-08-13 20:11 UTC, latest/chatgpt_amd64.deb changed from 26.803.81509 (sha256 a9bf91a3…) to 26.810.41047 (sha256 78715fa3…, 391786694 bytes). Any PKGBUILD / Nix FOD / Guix origin that pins sha256 against latest/ fails with FAILED on the next makepkg.

The durable contract already exists and works. It is just not documented on the Linux install page:

Verified today against that Packages file:

Package: chatgpt
Version: 26.810.41047
Filename: pool/main/c/chatgpt/chatgpt_26.810.41047_amd64.deb
Size: 391786694
SHA256: 78715fa3cd136ff67070daa76819adaecc5b42e99851559659645dce1fbf2af3

This is not a request for an official Arch/Nix package. Downstream packagers can pin the official signed .deb if the versioned pool path and per-arch SHA256 stay published.

Suggested docs/packaging contract (small, already almost there):

1. Document the versioned pool URL and the Packages index on Desktop app (Linux), next to the convenience latest/ links.
2. Keep pool/main/c/chatgpt/chatgpt_${version}_${arch}.deb stable across releases (a rename breaks every pin at once).
3. Optional but useful: publish a SHA256SUMS (or a small versions JSON) next to latest/, so packagers do not have to scrape Packages.

Where did you find it?

• Docs: https://learn.chatgpt.com/docs/codex/linux/linux-app
• Same latest/ URLs are what AUR openai-codex-desktop currently vendors: https://aur.archlinux.org/packages/openai-codex-desktop
• Checksum failure already reported there on 2026-08-13 (comment by hbarcelos) after latest/ was overwritten
• Related ask on the closed Linux-app request, not filed as its own issue: https://github.com/openai/codex/issues/11023#issuecomment-5284456387

Downstream workaround (AUR)

Pin the versioned pool URL instead of latest/. Tested on Arch x86_64: openai-codex-desktop 26.810.41047-1 builds and the bundled binary reports 26.810.41047.

-pkgver=26.803.81509
-pkgrel=8
+pkgver=26.810.41047
+pkgrel=1

 source_x86_64=(
-  "${_deb_x86_64}::https://persistent.oaistatic.com/codex-app-prod/linux/deb/latest/chatgpt_amd64.deb"
+  "${_deb_x86_64}::https://persistent.oaistatic.com/codex-app-prod/linux/deb/pool/main/c/chatgpt/chatgpt_${pkgver}_amd64.deb"
 )
 source_aarch64=(
-  "${_deb_aarch64}::https://persistent.oaistatic.com/codex-app-prod/linux/deb/latest/chatgpt_arm64.deb"
+  "${_deb_aarch64}::https://persistent.oaistatic.com/codex-app-prod/linux/deb/pool/main/c/chatgpt/chatgpt_${pkgver}_arm64.deb"
 )
-sha256sums_x86_64=('a9bf91a368f9f7c4eea38082a9fb8fb46b8d005b719a6d7715d2e5a1982c38eb')
-sha256sums_aarch64=('f38fcc194eca9ab0327dc10c92340681eae77c5d75164df700384ce2adaccbc1')
+sha256sums_x86_64=('78715fa3cd136ff67070daa76819adaecc5b42e99851559659645dce1fbf2af3')
+sha256sums_aarch64=('996f793ca0397676fcb9cd002114c97755cc3741907c400f7f5ddcf6c70c0a4e')

SHA256 values taken from the official Packages index (amd64 + arm64), not from hashing latest/.

Start with the Desktop app (Linux) page linked in the issue and compare its mutable latest/ links with the versioned pool URLs and APT Packages index provided. Document the stable versioned path and checksum source next to the convenience links, while preserving the stated filename contract. Done means downstream packagers can find version and SHA256 information without relying on an overwritten latest/ blob.