opencode-desktop-bin
MEDIUM
maintainer lapsus
19 votes
scanned 2026-09-20 13:33:19.261973
Why flagged
The package downloads prebuilt .deb binaries from a non-whitelisted host (opencode.ai) which are then extracted and repackaged; while the checksums are verified, the source of the binaries is not the project's public repository, creating a supply-chain risk if the host is compromised.
Triggered rules
Medium
External download from an untrusted host, not in source=()
external_download_not_in_source
curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.
-
PKGBUILD:25
curl -fsSL https://opencode.ai/update/api/latest/desktop/opencode | jq -r '.version'
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:29
source_x86_64=("opencode-desktop-${pkgver}-linux-amd64.deb::https://opencode.ai/files/bin/${pkgver}/opencode-desktop-linux-amd64.deb")
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads prebuilt .deb binaries from a non-whitelisted host (opencode.ai) which are then extracted and repackaged; while the checksums are verified, the source of the binaries is not the project's public repository, creating a supply-chain risk if the host is compromised.
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: Yakov Till <yakov.till@gmail.com>
2
3
pkgname=opencode-desktop-bin
4
pkgver=2.0.10
5
pkgrel=1
6
pkgdesc="OpenCode desktop client"
7
arch=('x86_64' 'aarch64')
8
url="https://opencode.ai"
9
license=('MIT')
10
provides=('opencode-desktop')
11
conflicts=('opencode-desktop')
12
# Arch Linux ARM ships no electron package at all (which is also why official
13
# code is absent there), so only x86_64 can run on a system runtime.
14
_electron=electron42
15
depends=('ripgrep')
16
depends_x86_64=("${_electron}")
17
depends_aarch64=('gtk3' 'nss' 'libxss' 'libxtst' 'alsa-lib' 'libsecret' 'libnotify' 'xdg-utils')
18
makedepends_x86_64=('asar')
19
optdepends=('libappindicator-gtk3: tray icon support')
20
# opencode-cli is a Bun standalone executable: stripping discards the embedded
21
# bundle and leaves a bare Bun runtime that no longer knows the "serve" command.
22
options=('!strip' '!debug')
23
24
latestver() {
25
curl -fsSL https://opencode.ai/update/api/latest/desktop/opencode | jq -r '.version'
26
}
27
28
source=("LICENSE::https://raw.githubusercontent.com/anomalyco/opencode/v${pkgver}/LICENSE")
29
source_x86_64=("opencode-desktop-${pkgver}-linux-amd64.deb::https://opencode.ai/files/bin/${pkgver}/opencode-desktop-linux-amd64.deb")
30
source_aarch64=("opencode-desktop-${pkgver}-linux-arm64.deb::https://opencode.ai/files/bin/${pkgver}/opencode-desktop-linux-arm64.deb")
31
sha256sums=('625f0f619133f89bbbb2abe37369613dfa1885eba1e50d02170deb62bb42cb6b')
32
sha256sums_x86_64=('fb8c37b76b8a5231323eb6c7f524e2c7c9f2c502b934d97260d303bbb5985521')
33
sha256sums_aarch64=('cfa84b27f2bf82b9d97fdfcc71e4ae6b441d873e7f39d2accb36924a6c0c4394')
34
35
package() {
36
local _debarch=amd64
37
[[ "${CARCH}" == aarch64 ]] && _debarch=arm64
38
bsdtar -xf "${srcdir}/opencode-desktop-${pkgver}-linux-${_debarch}.deb" data.tar.xz
39
bsdtar -xf data.tar.xz -C "${pkgdir}"
40
41
local _appdir _exec
42
if [[ "${CARCH}" == x86_64 ]]; then
43
# The app only has to work on the Electron it was built against, so refuse
44
# to package a runtime pairing upstream never shipped.
45
local _bundled
46
_bundled=$(grep -aoP 'Electron/\K[0-9]+' "${pkgdir}/opt/OpenCode/ai.opencode.desktop" | head -1)
47
if [[ "electron${_bundled}" != "${_electron}" ]]; then
48
echo "Upstream now bundles Electron ${_bundled:-<undetected>}; set _electron=electron${_bundled}" >&2
49
exit 1
50
fi
51
52
# Keep the app payload only; the bundled Chromium/Node runtime is replaced
53
# by the system electron, which ships its own sandbox, codecs and ICU data.
54
_appdir="${pkgdir}/usr/lib/opencode-desktop"
55
install -d "${_appdir}"
56
mv "${pkgdir}/opt/OpenCode/resources/"* "${_appdir}/"
57
rm -rf "${pkgdir}/opt"
58
59
# The app resolves opencode-cli relative to process.resourcesPath, which the
60
# system electron reports as its own directory. A shim app repoints it here
61
# and then loads the untouched asar.
62
asar extract-file "${_appdir}/app.asar" package.json
63
sed -i 's|"main": "./out/main/index.js"|"main": "./main.mjs"|' package.json
64
grep -q '"main": "./main.mjs"' package.json
65
install -Dm644 package.json "${_appdir}/package.json"
66
install -Dm644 /dev/stdin "${_appdir}/main.mjs" <<'EOF'
67
Object.defineProperty(process, "resourcesPath", { value: import.meta.dirname, configurable: true })
68
await import("./app.asar/out/main/index.js")
69
EOF
70
_exec="${_electron} /usr/lib/opencode-desktop"
71
else
72
_appdir="${pkgdir}/opt/OpenCode/resources"
73
_exec="/opt/OpenCode/ai.opencode.desktop"
74
fi
75
76
# Prune Debian/Ubuntu-specific and dead files
77
rm -rf "${pkgdir}/usr/share/doc"
78
rm -f "${_appdir}/apparmor-profile"
79
rm -f "${_appdir}/app-update.yml"
80
81
# Prune musl native modules (useless on glibc Arch)
82
find "${_appdir}" -name '*.musl.node' -delete
83
find "${_appdir}" -depth -type d -name '*-musl' -exec rm -rf {} +
84
85
# Launcher script (supports user flags and Wayland)
86
install -Dm755 /dev/stdin "${pkgdir}/usr/bin/opencode-desktop" <<'EOF'
87
#!/bin/bash
88
XDG_CONFIG_HOME="${XDG_CONFIG_HOME:-$HOME/.config}"
89
if [[ -f "$XDG_CONFIG_HOME/opencode-desktop-flags.conf" ]]; then
90
OPENCODE_USER_FLAGS="$(grep -v '^#' "$XDG_CONFIG_HOME/opencode-desktop-flags.conf")"
91
fi
92
exec @EXEC@ $OPENCODE_USER_FLAGS "$@"
93
EOF
94
sed -i "s|@EXEC@|${_exec}|" "${pkgdir}/usr/bin/opencode-desktop"
95
96
# Point desktop files at the wrapper (icons/StartupWMClass already match upstream names)
97
sed -i 's|Exec=/opt/OpenCode/ai\.opencode\.desktop|Exec=opencode-desktop|' \
98
"${pkgdir}"/usr/share/applications/*.desktop
99
100
install -Dm644 "${srcdir}/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
101
}
102
Changes since previous scan
--- PKGBUILD @ 2026-09-19 21:31+++ PKGBUILD @ 2026-09-20 13:33@@ -1,7 +1,7 @@ # Maintainer: Yakov Till <yakov.till@gmail.com> pkgname=opencode-desktop-bin-pkgver=1.18.31+pkgver=2.0.10 pkgrel=1 pkgdesc="OpenCode desktop client" arch=('x86_64' 'aarch64')@@ -15,21 +15,22 @@ depends=('ripgrep') depends_x86_64=("${_electron}") depends_aarch64=('gtk3' 'nss' 'libxss' 'libxtst' 'alsa-lib' 'libsecret' 'libnotify' 'xdg-utils')+makedepends_x86_64=('asar') optdepends=('libappindicator-gtk3: tray icon support')-options=('!debug')+# opencode-cli is a Bun standalone executable: stripping discards the embedded+# bundle and leaves a bare Bun runtime that no longer knows the "serve" command.+options=('!strip' '!debug') latestver() {- gh api --paginate repos/anomalyco/opencode/releases --jq \- '.[] | select(.prerelease == false and .draft == false and any(.assets[]; .name == "opencode-desktop-linux-amd64.deb") and any(.assets[]; .name == "opencode-desktop-linux-arm64.deb")) | .tag_name' |- head -1 | sed -E 's/^v//'+ curl -fsSL https://opencode.ai/update/api/latest/desktop/opencode | jq -r '.version' } source=("LICENSE::https://raw.githubusercontent.com/anomalyco/opencode/v${pkgver}/LICENSE")-source_x86_64=("opencode-desktop-${pkgver}-linux-amd64.deb::https://github.com/anomalyco/opencode/releases/download/v${pkgver}/opencode-desktop-linux-amd64.deb")-source_aarch64=("opencode-desktop-${pkgver}-linux-arm64.deb::https://github.com/anomalyco/opencode/releases/download/v${pkgver}/opencode-desktop-linux-arm64.deb")+source_x86_64=("opencode-desktop-${pkgver}-linux-amd64.deb::https://opencode.ai/files/bin/${pkgver}/opencode-desktop-linux-amd64.deb")+source_aarch64=("opencode-desktop-${pkgver}-linux-arm64.deb::https://opencode.ai/files/bin/${pkgver}/opencode-desktop-linux-arm64.deb") sha256sums=('625f0f619133f89bbbb2abe37369613dfa1885eba1e50d02170deb62bb42cb6b')-sha256sums_x86_64=('6606cd71bef7ded32ff936029d3fda68ce2148cec69bb6f1b0a3c62ff642f240')-sha256sums_aarch64=('4433503efeb792c4a807979cbebe9dd300f32df941c85d203644c706201745df')+sha256sums_x86_64=('fb8c37b76b8a5231323eb6c7f524e2c7c9f2c502b934d97260d303bbb5985521')+sha256sums_aarch64=('cfa84b27f2bf82b9d97fdfcc71e4ae6b441d873e7f39d2accb36924a6c0c4394') package() { local _debarch=amd64@@ -54,7 +55,19 @@ install -d "${_appdir}" mv "${pkgdir}/opt/OpenCode/resources/"* "${_appdir}/" rm -rf "${pkgdir}/opt"- _exec="${_electron} /usr/lib/opencode-desktop/app.asar"++ # The app resolves opencode-cli relative to process.resourcesPath, which the+ # system electron reports as its own directory. A shim app repoints it here+ # and then loads the untouched asar.+ asar extract-file "${_appdir}/app.asar" package.json+ sed -i 's|"main": "./out/main/index.js"|"main": "./main.mjs"|' package.json+ grep -q '"main": "./main.mjs"' package.json+ install -Dm644 package.json "${_appdir}/package.json"+ install -Dm644 /dev/stdin "${_appdir}/main.mjs" <<'EOF'+Object.defineProperty(process, "resourcesPath", { value: import.meta.dirname, configurable: true })+await import("./app.asar/out/main/index.js")+EOF+ _exec="${_electron} /usr/lib/opencode-desktop" else _appdir="${pkgdir}/opt/OpenCode/resources" _exec="/opt/OpenCode/ai.opencode.desktop"Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-20 13:33:19 | Medium | 3 |
| 2026-09-19 21:31:46 | Clean | 0 |
| 2026-09-14 21:18:01 | Clean | 0 |
| 2026-09-09 13:19:49 | Clean | 0 |
| 2026-09-05 01:59:11 | Clean | 0 |
| 2026-09-03 23:55:21 | Clean | 0 |
| 2026-09-02 13:50:58 | Clean | 0 |
| 2026-08-28 11:35:03 | Clean | 0 |
| 2026-08-25 05:25:49 | Clean | 0 |
| 2026-08-21 13:15:20 | Clean | 0 |
| 2026-08-20 15:11:35 | Clean | 0 |
| 2026-08-13 07:25:43 | Clean | 0 |
| 2026-08-13 01:25:20 | Clean | 0 |
| 2026-08-11 19:21:46 | Clean | 0 |
| 2026-07-30 17:15:21 | Clean | 0 |
| 2026-07-29 13:11:48 | Clean | 0 |
| 2026-07-28 17:39:33 | Clean | 0 |
| 2026-07-28 13:38:59 | Clean | 0 |
| 2026-07-27 11:35:00 | Clean | 0 |
| 2026-07-25 17:30:22 | Clean | 0 |