opencode-git

maintainer pngdeity · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a JSON file from an untrusted host for offline model data, but it is not executable and does not enable remote code execution; the main source is from GitHub and the build uses locked dependencies.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a JSON file from an untrusted host for offline model data, but it is not executable and does not enable remote code execution; the main source is from GitHub and the build uses locked dependencies.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:24 'models.dev-api.json::https://models.dev/api.json'

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: pngdeity <pngdeity@tutanota.com>
    
      2# Contributor: robertfoster <morf3089@gmail.com>
    
      3_pkgname=opencode
    
      4
    
      5pkgname=${_pkgname}-git
    
      6_githubname=anomalyco/opencode
    
      7pkgver=1.14.48.r38.gcddab63
    
      8pkgrel=1
    
      9pkgdesc="The open source coding agent"
    
      10url="https://github.com/${_githubname}"
    
      11arch=(aarch64 x86_64)
    
      12license=(MIT)
    
      13provides=("$_pkgname")
    
      14conflicts=("$_pkgname")
    
      15depends=(curl fzf git glibc icu ripgrep)
    
      16makedepends=(bun git)
    
      17optdepends=('wl-clipboard: clipboard support on Wayland'
    
      18            'xclip: clipboard support on X11')
    
      19options=('!debug' '!strip')
    
      20source=(
    
      21  "$_pkgname::git+${url}.git"
    
      22  # Live AI model catalog from models.dev — embedded at build time so
    
      23  # opencode can display available models without runtime network access.
    
      24  'models.dev-api.json::https://models.dev/api.json'
    
      25)
    
      26sha256sums=('SKIP'
    
      27            'SKIP')
    
      28
    
      29_target_arch() {
    
      30  case "${CARCH}" in
    
      31    'x86_64')
    
      32      printf 'x64-baseline\n'
    
      33      ;;
    
      34    'aarch64')
    
      35      printf 'arm64\n'
    
      36      ;;
    
      37    *)
    
      38      printf 'Unsupported architecture: %s\n' "${CARCH}" >&2
    
      39      return 1
    
      40      ;;
    
      41  esac
    
      42}
    
      43
    
      44pkgver() {
    
      45  cd "$_pkgname"
    
      46  local version tag base rev hash
    
      47
    
      48  version=$(sed -n 's/^[[:space:]]*"version": "\([^"]*\)",$/\1/p' packages/opencode/package.json | head -n1)
    
      49  tag="v${version}"
    
      50  base=$(git merge-base HEAD "${tag}")
    
      51  rev=$(git rev-list --count "${base}..HEAD")
    
      52  hash=$(git rev-parse --short=7 HEAD)
    
      53
    
      54  printf '%s.r%s.g%s\n' "${version}" "${rev}" "${hash}"
    
      55}
    
      56
    
      57prepare() {
    
      58  cd "$_pkgname"
    
      59  bun install --frozen-lockfile --ignore-scripts
    
      60}
    
      61
    
      62build() {
    
      63  cd "$_pkgname"
    
      64  OPENCODE_VERSION=$pkgver \
    
      65    MODELS_DEV_API_JSON="${srcdir}/models.dev-api.json" \
    
      66    bun run --cwd packages/opencode build --single --baseline --skip-install
    
      67}
    
      68
    
      69check() {
    
      70  cd "$_pkgname/packages/opencode"
    
      71
    
      72  # Tests currently fail due to https://github.com/oven-sh/bun/issues/30014
    
      73  # Revisit once the bug is fixed.
    
      74  #
    
      75  # export GIT_CONFIG_GLOBAL=$PWD/gitconfig
    
      76  # git config --global user.email "builduser@archlinux.org"
    
      77  # git config --global user.name "Build User"
    
      78  # bun test --timeout=20000 --parallel
    
      79}
    
      80
    
      81package() {
    
      82  local target
    
      83
    
      84  cd "$_pkgname"
    
      85  target="$(_target_arch)"
    
      86
    
      87  install -Dm755 \
    
      88    "packages/opencode/dist/opencode-linux-${target}/bin/opencode" \
    
      89    "${pkgdir}/usr/bin/opencode"
    
      90
    
      91  SHELL=/bin/bash "${pkgdir}/usr/bin/opencode" completion \
    
      92    | install -Dm644 /dev/stdin "${pkgdir}/usr/share/bash-completion/completions/opencode"
    
      93  SHELL=/bin/zsh "${pkgdir}/usr/bin/opencode" completion \
    
      94    | install -Dm644 /dev/stdin "${pkgdir}/usr/share/zsh/site-functions/_opencode"
    
      95
    
      96  install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      97}
    
      98

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2