Skip to content

2.0.31 1.19.3 v2.0.[23-31] v1.18.[30-35]+v1.19.[0-3]

Pre-release
Pre-release

Choose a tag to compare

View all tags
@Hope2333 Hope2333 released this 17 Oct 19:45
Push261016
736540a

Push261016 — seccomp hardening fix (issue #36) + v2 2.0.28–2.0.31 + v1 1.19.1–1.19.3

中文版

Overview

Two things in this batch:

  1. Issue #36 fix (seccomp hardening) — opencode1 native packages shipped
    without the libopencode-crhandler.so seccomp shim being interposed
    (DT_NEEDED missing), so on Android 12 (seccomp blocks close_range) the
    process died with SIGSYS at startup — even --version. Root cause: three
    broken links in the harden wiring (the v1 family-native chain never called
    harden-native; the v2 direct-build path bypassed it; the compressed tool
    compressed un-hardened runtimes). Fixed: family-native now hardens;
    harden-native is path-parameterized; tools/compressed-one.sh hardens
    before UPX (and refuses un-hardened external binaries). Affected packages
    repacked with the shim interposed and re-uploaded (see repack list below).
  2. New versions — v2 2.0.28–2.0.31 (4 versions) and v1 1.19.1–1.19.3
    (3 versions), each in all three families (native, UPX-compressed, wrapper
    deb-only).

84 assets: 83 packages + SHA256SUMS.txt.

Repacked (issue #36 fix — same versions, hardened)

Family Versions Formats
opencode (v2 native) 2.0.23–2.0.27 deb + .pkg.tar.xz
opencode1 (v1 native) 1.18.30–1.18.34, 1.18.35, 1.19.0 deb + .pkg.tar.xz
opencode-compressed 2.0.23–2.0.27 deb + .pkg.tar.gz
opencode1-compressed 1.18.30–1.18.34, 1.18.35, 1.19.0 deb + .pkg.tar.gz

All repacked binaries now carry DT_NEEDED[0]=libopencode-crhandler.so (the
shim interposes close_range with -ENOSYS), zero-displacement surgical patch
proven; the shim ships inside every package.

New versions

Family Versions Formats
opencode (v2 native) 2.0.28–2.0.31 deb + .pkg.tar.xz
opencode1 (v1 native) 1.19.1–1.19.3 deb + .pkg.tar.xz
opencode-compressed 2.0.28–2.0.31 deb + .pkg.tar.gz
opencode1-compressed 1.19.1–1.19.3 deb + .pkg.tar.gz
opencode-wrapper 2.0.28–2.0.31 deb only
opencode1-wrapper 1.19.1–1.19.3 deb only

All first releases → rel=1. v2 native compiled from source with per-version
opentui pins (0.5.14/0.5.16/0.5.17 by upstream catalog); v1 native via
transplant (bun 1.4.0 base, predict passed 7/7). Every package smoke-tested
(--version gate + isolated --dbpath --help + TUI probe) and upload-verified
(state/size/sha256).

Family matrix & coexistence

  • Same generation is mutually exclusive: native / wrapper / compressed
    (v2 opencode*; v1 opencode1*).
  • Cross-generation coexistence: opencode1* may coexist with opencode*.
  • v1 packages cover opencode < 2.0.0; v2 packages cover >= 2.0.0.
  • Wrapper pacman packages are not in this batch (deb-only convention).

Install

pacman -U ./opencode-2.0.31-1-aarch64.pkg.tar.xz
dpkg -i ./opencode_2.0.31_aarch64.deb

BUILD LOG

20261017: v2.0.{23-31} native / wrapper / compressed + v1.18.{30-35} + v1.19.{0-3} native / wrapper / compressed first upload
20261018: v1.18.35 + v1.19.{0-3} compressed backfill + SHA256SUMS.txt
Latest: v2.0.31 (v1: v1.19.3)

Verification

  • Version continuity: v2 2.0.0–2.0.31, v1 1.18.8–1.18.35 + 1.19.0–1.19.3.
  • SHA256SUMS.txt covers all 83 packages: sha256sum -c SHA256SUMS.txt.
  • Hardening spot check:
    readelf -dW usr/lib/opencode/runtime/opencode | grep crhandler (native) or
    after upx -d (compressed) — expect libopencode-crhandler.so.

Links

Assets 86
Loading