opencode-git
LOW
maintainer pngdeity
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a JSON file from an untrusted host for offline model data, but it is not executable and does not enable remote code execution; the main source is from GitHub and the build uses locked dependencies.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a JSON file from an untrusted host for offline model data, but it is not executable and does not enable remote code execution; the main source is from GitHub and the build uses locked dependencies.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:24
'models.dev-api.json::https://models.dev/api.json'
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: pngdeity <pngdeity@tutanota.com>
2
# Contributor: robertfoster <morf3089@gmail.com>
3
_pkgname=opencode
4
5
pkgname=${_pkgname}-git
6
_githubname=anomalyco/opencode
7
pkgver=1.14.48.r38.gcddab63
8
pkgrel=1
9
pkgdesc="The open source coding agent"
10
url="https://github.com/${_githubname}"
11
arch=(aarch64 x86_64)
12
license=(MIT)
13
provides=("$_pkgname")
14
conflicts=("$_pkgname")
15
depends=(curl fzf git glibc icu ripgrep)
16
makedepends=(bun git)
17
optdepends=('wl-clipboard: clipboard support on Wayland'
18
'xclip: clipboard support on X11')
19
options=('!debug' '!strip')
20
source=(
21
"$_pkgname::git+${url}.git"
22
# Live AI model catalog from models.dev — embedded at build time so
23
# opencode can display available models without runtime network access.
24
'models.dev-api.json::https://models.dev/api.json'
25
)
26
sha256sums=('SKIP'
27
'SKIP')
28
29
_target_arch() {
30
case "${CARCH}" in
31
'x86_64')
32
printf 'x64-baseline\n'
33
;;
34
'aarch64')
35
printf 'arm64\n'
36
;;
37
*)
38
printf 'Unsupported architecture: %s\n' "${CARCH}" >&2
39
return 1
40
;;
41
esac
42
}
43
44
pkgver() {
45
cd "$_pkgname"
46
local version tag base rev hash
47
48
version=$(sed -n 's/^[[:space:]]*"version": "\([^"]*\)",$/\1/p' packages/opencode/package.json | head -n1)
49
tag="v${version}"
50
base=$(git merge-base HEAD "${tag}")
51
rev=$(git rev-list --count "${base}..HEAD")
52
hash=$(git rev-parse --short=7 HEAD)
53
54
printf '%s.r%s.g%s\n' "${version}" "${rev}" "${hash}"
55
}
56
57
prepare() {
58
cd "$_pkgname"
59
bun install --frozen-lockfile --ignore-scripts
60
}
61
62
build() {
63
cd "$_pkgname"
64
OPENCODE_VERSION=$pkgver \
65
MODELS_DEV_API_JSON="${srcdir}/models.dev-api.json" \
66
bun run --cwd packages/opencode build --single --baseline --skip-install
67
}
68
69
check() {
70
cd "$_pkgname/packages/opencode"
71
72
# Tests currently fail due to https://github.com/oven-sh/bun/issues/30014
73
# Revisit once the bug is fixed.
74
#
75
# export GIT_CONFIG_GLOBAL=$PWD/gitconfig
76
# git config --global user.email "builduser@archlinux.org"
77
# git config --global user.name "Build User"
78
# bun test --timeout=20000 --parallel
79
}
80
81
package() {
82
local target
83
84
cd "$_pkgname"
85
target="$(_target_arch)"
86
87
install -Dm755 \
88
"packages/opencode/dist/opencode-linux-${target}/bin/opencode" \
89
"${pkgdir}/usr/bin/opencode"
90
91
SHELL=/bin/bash "${pkgdir}/usr/bin/opencode" completion \
92
| install -Dm644 /dev/stdin "${pkgdir}/usr/share/bash-completion/completions/opencode"
93
SHELL=/bin/zsh "${pkgdir}/usr/bin/opencode" completion \
94
| install -Dm644 /dev/stdin "${pkgdir}/usr/share/zsh/site-functions/_opencode"
95
96
install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
97
}
98
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |