From b1f89eef852ba7f3005da97ed5e0a05b23a041bc Mon Sep 17 00:00:00 2001 From: Jarek Rozanski Date: Sat, 10 Oct 2026 17:21:37 +0200 Subject: [PATCH] Use Opencode V2 --- Containerfile | 18 +++++++++++------- README.md | 2 +- 2 files changed, 12 insertions(+), 8 deletions(-) diff --git a/Containerfile b/Containerfile index 82089af..78520ba 100644 --- a/Containerfile +++ b/Containerfile @@ -1,5 +1,5 @@ # OpenCode dev sandbox: rootless-Podman container with JDK 25, Node 24, Go, -# Rust, pnpm, git, curl, and a hash-pinned build of OpenCode +# Rust, pnpm, git, curl, and a hash-pinned build of OpenCode v2 # (github.com/anomalyco/opencode). # # Built as multi-stage: JDK, Node, Go, and Rust toolchains are pulled from @@ -67,12 +67,16 @@ ARG TARGETARCH # OpenCode version + per-arch SHA256 pins. Re-verified by hand against the # actual release assets (curl + sha256sum), not just copied from a summary: -# curl -fsSL -o oc.tar.gz https://github.com/anomalyco/opencode/releases/download/v/opencode-linux-.tar.gz +# curl -fsSL -o oc.tar.gz https://opencode.ai/files/bin//opencode-linux-.tar.gz # sha256sum oc.tar.gz # Re-run this whenever OPENCODE_VERSION is bumped, and update the two hashes. -ARG OPENCODE_VERSION=1.18.32 -ARG OPENCODE_SHA256_AMD64=3046e0404fdc60fb80307e7a47824ba07477364178a4d09baa8548496dd6d43b -ARG OPENCODE_SHA256_ARM64=568461b7d4d8c19865c97e9a1102e613049c6039d01fe772154de873c1865840 +# Why not the official ghcr.io/anomalyco/opencode: image: it is Alpine +# (musl), so its binary can't be copied into this glibc Debian stage. The +# glibc tarball below is the same release, served from opencode.ai (v2 +# releases are not attached to GitHub Releases, unlike v1). +ARG OPENCODE_VERSION=2.0.26 +ARG OPENCODE_SHA256_AMD64=6d94dde0ac1b009327189772f5e242e13f7f7916a4fcd58bf39f9c15d6a517d1 +ARG OPENCODE_SHA256_ARM64=1508f9cc9a519b2aac93439d171a0be554ffe5a2cf433405010ec664663a7eae # pnpm version, installed via pnpm's own standalone script (not Corepack -- # the pnpm team doesn't recommend Corepack, and Node 25+ dropped bundling it). @@ -260,7 +264,7 @@ RUN set -eu; \ *) echo "ERROR: unsupported TARGETARCH='$TARGETARCH'" >&2; exit 1 ;; \ esac; \ curl -fsSL -o /tmp/opencode.tar.gz \ - "https://github.com/anomalyco/opencode/releases/download/v${OPENCODE_VERSION}/opencode-linux-${OC_ARCH}.tar.gz"; \ + "https://opencode.ai/files/bin/${OPENCODE_VERSION}/opencode-linux-${OC_ARCH}.tar.gz"; \ printf '%s /tmp/opencode.tar.gz\n' "$OC_SHA256" | sha256sum -c -; \ mkdir -p /tmp/opencode-extract; \ tar -xzf /tmp/opencode.tar.gz -C /tmp/opencode-extract; \ @@ -276,7 +280,7 @@ RUN { ldd /usr/local/bin/opencode || true; } | tee /tmp/opencode-ldd.txt && \ rm -f /tmp/opencode-ldd.txt # jdtls/kotlin-lsp aren't invoked here (both block waiting on stdio LSP # input with no --version-style flag) -- just checked for presence instead. -RUN java -version && node --version && pnpm --version && git --version && curl --version && \ +RUN opencode --version && java -version && node --version && pnpm --version && git --version && curl --version && \ go version && rustc --version && rust-analyzer --version && gopls version && \ tsc --version && typescript-language-server --version && \ test -x /usr/local/bin/jdtls && \ diff --git a/README.md b/README.md index e940f04..293ba6a 100644 --- a/README.md +++ b/README.md @@ -70,7 +70,7 @@ Bumping a pinned LSP version means editing the corresponding `ARG`/`FROM` tag in **Containerfile** — multi-stage build on `debian:trixie-slim`: - JDK and Node are copied in from their official upstream images (`eclipse-temurin:25-jdk-noble`, `node:24-trixie-slim`) rather than apt-installed, keeping the final image slim while staying on a mainstream glibc distro (Alpine/musl is avoided — it breaks JVM and native Node addon compatibility). - pnpm is installed via its own standalone installer script, pinned to a specific version. -- OpenCode is downloaded directly from its canonical GitHub releases (`github.com/anomalyco/opencode`) for the container's architecture, and its SHA256 is checked against a hash pinned in the Containerfile before it's installed — there's no maintainer-published signature for OpenCode releases, so this hash is captured by hand and is the actual root of trust here. Bump `OPENCODE_VERSION` and re-run the `sha256sum` steps documented in the Containerfile's comments whenever you upgrade it. +- OpenCode v2 is downloaded directly from its official download host (`opencode.ai/files/bin`, the glibc build of v2) for the container's architecture, and its SHA256 is checked against a hash pinned in the Containerfile before it's installed — there's no maintainer-published signature for OpenCode releases, so this hash is captured by hand and is the actual root of trust here. Bump `OPENCODE_VERSION` and re-run the `sha256sum` steps documented in the Containerfile's comments whenever you upgrade it. - A few build-time smoke tests (`ldd`, `java -version`, `node --version`, etc.) fail the build immediately if anything is broken, rather than surfacing at first `make opencode`. **Makefile** — four targets: