opencode2-bin

maintainer bermudi · 0 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The package installs a prebuilt binary from npm, which is the project's official distribution method, and includes a valid checksum; the source is not self-hosted or from a suspicious domain, and the binary is not executed during build but installed directly, posing low risk for supply-chain compromise.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a prebuilt binary from npm, which is the project's official distribution method, and includes a valid checksum; the source is not self-hosted or from a suspicious domain, and the binary is not executed during build but installed directly, posing low risk for supply-chain compromise.

PKGBUILD

      1# Maintainer: bermudi <github.igizp@dabg.uk>
    
      2# Auto-updated by GitHub Actions (see .github/workflows/opencode2-bin.yml)
    
      3
    
      4pkgname=opencode2-bin
    
      5pkgver=0.0.0_next_17444
    
      6pkgrel=1
    
      7pkgdesc='The AI coding agent built for the terminal.'
    
      8arch=('aarch64' 'x86_64')
    
      9url='https://opencode.ai'
    
      10license=('MIT')
    
      11provides=('opencode2')
    
      12conflicts=('opencode2')
    
      13depends=('glibc')
    
      14options=('!debug' '!strip')
    
      15
    
      16# opencode v2 has no GitHub releases — it ships per-arch binaries to npm.
    
      17# The version is the `next` dist-tag of @opencode-ai/cli; upstream prerelease
    
      18# versions are `0.0.0-next-<build>` and the `-` maps to `_` for pkgver.
    
      19_npmver="${pkgver//_/-}"
    
      20
    
      21# Update workflow rewrites pkgver, resets pkgrel, and rewrites the checksum
    
      22# entries below (hex sha512, derived from the npm `dist.integrity` field).
    
      23# Everything else here is static — do not hand-merge this file from a template.
    
      24source_x86_64=("${pkgname}_${pkgver}_x86_64.tgz::https://registry.npmjs.org/@opencode-ai/cli-linux-x64/-/cli-linux-x64-${_npmver}.tgz")
    
      25sha512sums_x86_64=('cf20f35b96982114694998ae99fa1bd1fd1b7f788d4e793b1c633cebf8a2595de84b26d43b2f3cacefacd95dfb60cdadcc7faaa6f02c95863f75d829d6c5bd26')
    
      26source_aarch64=("${pkgname}_${pkgver}_aarch64.tgz::https://registry.npmjs.org/@opencode-ai/cli-linux-arm64/-/cli-linux-arm64-${_npmver}.tgz")
    
      27sha512sums_aarch64=('64d8525af05dc563533e1bc410080c2f69204badd4eb1e05e36c864059339dfb65d8f8bcef6204c183ecad7adbe8bc426c480188010ffc989537868d7c8d2346')
    
      28
    
      29package() {
    
      30  install -Dm755 "$srcdir/package/bin/opencode2" "$pkgdir/usr/bin/opencode2"
    
      31}
    
      32

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 03:35:16	LOW	2
2026-08-17 00:18:29	LOW	2
2026-08-16 13:32:24	LOW	2