Repository navigation
[Windows][Desktop 26.915.4065.0] Runtime updater redownloads a 495 MB archive hourly on two independent PCs #46768
Description
Component
ChatGPT Desktop for Windows / Codex primary runtime updater
Summary
ChatGPT Desktop repeatedly downloads the same Codex primary runtime archive from persistent.oaistatic.com. The complete archive is then rejected with errorCategory=checksum_mismatch, and the scheduled updater downloads the same archive again approximately every hour.
The expected SHA-256 and the received SHA-256 are unchanged across every attempt, so the failure appears deterministic rather than like random transfer corruption.
The same behavior has been independently observed on two separate Windows PCs in different physical locations and on independent networks: a Windows 10 PC at work and a Windows 11 PC at home. This makes a transient fault isolated to one Windows version, installation, disk, machine, or local network unlikely.
Manual downloads on Windows and on a separate US Linux server both produce the same SHA-256 served to the app. The HTTP Content-Length also differs from the size selected by the updater, which strongly indicates that the updater metadata and the published CDN object do not match.
Steps to reproduce
- Launch ChatGPT Desktop
26.915.4065.0on Windows x64. - Leave the application running with Codex enabled.
- Observe a complete runtime archive download from
persistent.oaistatic.com. - The installation fails during
verify_checksum. - Leave the application running. A scheduled update downloads the complete archive again about one hour later.
Expected behavior
- The manifest and archive agree, and the runtime installs successfully after one download.
- If a checksum mismatch occurs, the client does not repeatedly download the same known-bad 495 MB object unless the manifest or artifact changes.
- The existing healthy runtime remains usable without repeated high-bandwidth retries.
Actual behavior
- The full archive is downloaded.
- SHA-256 validation fails with the same expected and actual hashes on every attempt.
- Runtime
26.905.11957remains installed and is reported healthy. - The scheduled updater downloads the same archive again approximately hourly.
Environment
- Primary evidence PC: Windows 10 Pro 22H2, build
19045.6466, x64, at work - Second affected PC: Windows 11, x64, at home
- ChatGPT Desktop package version:
26.915.4065.0 - Package:
OpenAI.Codex_26.915.4065.0_x64__2p2nqsd0c76g0 - Existing healthy primary runtime:
26.905.11957 - Runtime selected for update:
26.915.20218,win32-x64,tar.gz - Reproducibility: observed across Windows 10 and Windows 11 on independent home and office networks. Detailed logs and traffic measurements below are from the Windows 10 PC.
Runtime artifact
- URL:
https://persistent.oaistatic.com/codex-primary-runtime/alpha/26.915.20218/codex-primary-runtime-win32-x64-26.915.20218.tar.gz - Size in the updater-selected
runtimeInstallConfig:495,161,818bytes - HTTP
Content-Lengthcurrently served by the CDN:495,163,216bytes - Size difference:
1,398bytes - SHA-256 in the updater-selected
runtimeInstallConfig:06266088a7881b8fdc31adaf070e1db070ce4162e8c6137b212334b249d2e9c3 - SHA-256 of the object actually served:
5911799885cacb45d0f95b1f1ed708cca2f5e5664d83291a95bf53643c18c368 - HTTP metadata:
Last-Modified: Wed, 16 Sep 2026 20:59:52 GMT,ETag: 0x8DF143574704677,cf-cache-status: HIT
The expected hash is not inferred from the failed download. Before downloading, the app log records the selected configuration as runtimeInstallConfig.latest.platforms.windows-x86_64.digest=062660..., with hash=sha256 and size=495161818. The updater later compares the downloaded object against that configured digest.
Independent manual verification
The same public URL was downloaded manually on Windows:
certutil.exe -hashfile .\codex-primary-runtime-win32-x64-26.915.20218.tar.gz sha256
5911799885cacb45d0f95b1f1ed708cca2f5e5664d83291a95bf53643c18c368
It was also downloaded independently on a Linux server:
sha256sum codex-primary-runtime-win32-x64-26.915.20218.tar.gz
5911799885cacb45d0f95b1f1ed708cca2f5e5664d83291a95bf53643c18c368 codex-primary-runtime-win32-x64-26.915.20218.tar.gz
Both independent downloads match the hash observed by ChatGPT Desktop and disagree with the digest selected by the updater.
Timeline and traffic impact
Local times on 2026-09-20:
11:54:50— startup-triggered download started; failed at11:55:21.12:24:14— scheduled download started; failed at12:24:42.13:24:15— scheduled download started; failed at13:24:41.14:24:16— scheduled download started; failed at14:24:43.
The traffic observer started after the first attempt and captured the last three complete downloads:
- 12:24 attempt:
496,474,624downloaded bytes. - 13:24 attempt:
496,480,994downloaded bytes. - 14:24 attempt:
496,475,464downloaded bytes. - Captured total for
persistent.oaistatic.com:1,489,452,328downloaded bytes (1,420.45 MiB), including small manifest/check connections.
At the observed hourly retry rate, leaving the app running could consume roughly 11.9 GB per day.
Sanitized installer log excerpt
The timestamps in this excerpt are UTC. User paths, stack traces, call IDs, bundle operation IDs, and unrelated events have been removed.
Installer log excerpt
2026-09-20T01:14:12.297Z info primary_runtime_dependencies_diagnose_finished bundleVersion=26.905.11957 installed=true problemCount=0
2026-09-20T03:54:50.076Z info Codex runtime config selected release=latest bundleVersion=26.915.20218 windows-x86_64.hash=sha256 windows-x86_64.digest=06266088a7881b8fdc31adaf070e1db070ce4162e8c6137b212334b249d2e9c3 windows-x86_64.size=495161818
2026-09-20T03:54:50.544Z info primary_runtime_install_started forceReinstall=false hasConfiguredRuntime=true release=latest target=win32-x64 trigger=startup_missing
2026-09-20T03:54:50.545Z info Primary runtime download source bundleVersion=26.915.20218 release=latest target=win32-x64 runtimeArchiveUrl=https://persistent.oaistatic.com/codex-primary-runtime/alpha/26.915.20218/codex-primary-runtime-win32-x64-26.915.20218.tar.gz
2026-09-20T03:55:21.122Z error primary_runtime_install_failed bundleVersion=26.915.20218 durationMs=30577 errorCategory=checksum_mismatch failureStage=verify_checksum errorMessage="Checksum mismatch: expected 06266088a7881b8fdc31adaf070e1db070ce4162e8c6137b212334b249d2e9c3, got 5911799885cacb45d0f95b1f1ed708cca2f5e5664d83291a95bf53643c18c368."
2026-09-20T04:24:14.122Z info primary_runtime_install_started forceReinstall=false hasConfiguredRuntime=true release=latest target=win32-x64 trigger=scheduled_update
2026-09-20T04:24:14.123Z info Primary runtime download source bundleVersion=26.915.20218 release=latest target=win32-x64 runtimeArchiveUrl=https://persistent.oaistatic.com/codex-primary-runtime/alpha/26.915.20218/codex-primary-runtime-win32-x64-26.915.20218.tar.gz
2026-09-20T04:24:42.387Z error primary_runtime_install_failed bundleVersion=26.915.20218 durationMs=28265 errorCategory=checksum_mismatch failureStage=verify_checksum errorMessage="Checksum mismatch: expected 06266088a7881b8fdc31adaf070e1db070ce4162e8c6137b212334b249d2e9c3, got 5911799885cacb45d0f95b1f1ed708cca2f5e5664d83291a95bf53643c18c368."
2026-09-20T05:24:15.124Z info primary_runtime_install_started forceReinstall=false hasConfiguredRuntime=true release=latest target=win32-x64 trigger=scheduled_update
2026-09-20T05:24:15.125Z info Primary runtime download source bundleVersion=26.915.20218 release=latest target=win32-x64 runtimeArchiveUrl=https://persistent.oaistatic.com/codex-primary-runtime/alpha/26.915.20218/codex-primary-runtime-win32-x64-26.915.20218.tar.gz
2026-09-20T05:24:41.400Z error primary_runtime_install_failed bundleVersion=26.915.20218 durationMs=26275 errorCategory=checksum_mismatch failureStage=verify_checksum errorMessage="Checksum mismatch: expected 06266088a7881b8fdc31adaf070e1db070ce4162e8c6137b212334b249d2e9c3, got 5911799885cacb45d0f95b1f1ed708cca2f5e5664d83291a95bf53643c18c368."
2026-09-20T06:24:16.094Z info primary_runtime_install_started forceReinstall=false hasConfiguredRuntime=true release=latest target=win32-x64 trigger=scheduled_update
2026-09-20T06:24:16.095Z info Primary runtime download source bundleVersion=26.915.20218 release=latest target=win32-x64 runtimeArchiveUrl=https://persistent.oaistatic.com/codex-primary-runtime/alpha/26.915.20218/codex-primary-runtime-win32-x64-26.915.20218.tar.gz
2026-09-20T06:24:43.599Z error primary_runtime_install_failed bundleVersion=26.915.20218 durationMs=27504 errorCategory=checksum_mismatch failureStage=verify_checksum errorMessage="Checksum mismatch: expected 06266088a7881b8fdc31adaf070e1db070ce4162e8c6137b212334b249d2e9c3, got 5911799885cacb45d0f95b1f1ed708cca2f5e5664d83291a95bf53643c18c368."
Additional notes
- I can provide the complete app log privately if needed, but it may contain sensitive local information.
- The screenshots show an earlier traffic snapshot; the sanitized CSV includes the later 14:24 retry.
Activity
github-actions commentedon Sep 20, 2026
Potential duplicates detected. Please review them and close your issue if it is a duplicate.
Powered by Codex Action
chenxibu commentedon Sep 21, 2026
My PC is hitting the same thing: the runtime updater downloads the 495 MB archive every hour and then fails checksum verification. Here is the error I'm getting:
Checksum mismatch: expected 06266088a7881b8fdc31adaf070e1db070ce4162e8c6137b212334b249d2e9c3
got 5911799885cacb45d0f95b1f1ed708cca2f5e5664d83291a95bf53643c18c368
bundleVersion=26.915.20218 failureStage=verify_checksum retryable=false
Mine has been failing for 11 days (29 attempts so far) and each failure also leaves 200–300 MB of undeleted staging data on disk. I've attached a file with the details.
Codex-runtime-checksum-mismatch-additional-data.md
vellony commentedon Sep 24, 2026
I ran into the same user-visible behavior: the primary runtime archive was being re-downloaded roughly once per hour, but with a different underlying failure mode.
Environment:
In my case the download itself succeeded. The update failed later during activation with:
failureStage=activate_runtime
errorCategory=permission_denied
errorCode=EPERM
The failing operation was a rename from:
%USERPROFILE%.cache\codex-runtimes\codex-runtime-install-*\payload\codex-primary-runtime
to:
%USERPROFILE%.cache\codex-runtimes\codex-primary-runtime
I verified that:
Using ProcMon, I found that a third-party antivirus/security process was scanning and holding files inside the freshly extracted staging runtime immediately before ChatGPT.exe attempted the final rename and received ACCESS DENIED.
After adding:
%USERPROFILE%.cache\codex-runtimes
to the antivirus/security exclusions, the runtime update completed successfully and the hourly ~500 MB downloads stopped.
So the hourly re-download behavior does not appear to be specific to checksum_mismatch: it can also happen when the update fails after download, during runtime activation.
It may be worth avoiding a full re-download when the archive has already been downloaded and verified successfully, and also adding retry/backoff around the final directory rename on Windows for short-lived file-lock/contention cases.