mirror of
https://github.com/okxlin/release-factory.git
synced 2026-09-22 08:02:15 +00:00
okxlin
e058ba3f73
Reject unsafe workstation credentials, fix native ARM64 Java, and remove duplicate extensions, caches and temporary tool layers. Pin OpenCode's baseline and Gemini's source/runtime inputs; refresh maintained browser and OS packages; fix Nginx and vendored ZIP vulnerabilities. Verify real login, default plugins, browser/CDP persistence and isolated OpenClaw sandbox operations. Build each platform once and bind release publication to the tested config and manifest digests. Keep service-specific vulnerability gates and refresh DSH APT stages during PR verification. Validation: all 13 PR verification jobs passed, including native amd64/arm64 workstations and DSH variants, plus both browser variants and OpenClaw on amd64. Publication jobs were skipped for PR verification.
36 lines
1.9 KiB
Markdown
36 lines
1.9 KiB
Markdown
# OpenCode baseline
|
|
|
|
This image bundles the Linux runtime artifacts of OpenCode 1.18.30, released at
|
|
https://github.com/anomalyco/opencode/releases/tag/v1.18.30 from source commit
|
|
`5cd8e68fdd72b27818d26d168b9c7a06b359567e`.
|
|
|
|
The package lock pins the platform packages and their npm integrity values.
|
|
Only the current Linux architecture is installed, with lifecycle scripts disabled.
|
|
amd64 uses the baseline binary so first startup also works on CPUs without AVX2.
|
|
The included MIT license is from the integrity-verified `opencode-ai@1.18.30` npm
|
|
distribution, which selects these same platform artifacts in its postinstall.
|
|
|
|
`config.dcpPackage` pins the existing optional DCP bootstrap to a specific release.
|
|
DCP is installed in the user's configuration/cache when enabled; its AGPL-3.0-or-later
|
|
license and source are available at
|
|
https://github.com/Opencode-DCP/opencode-dynamic-context-pruning.
|
|
|
|
Update the version and both optional dependencies together, then regenerate the
|
|
lock with `npm install --package-lock-only --ignore-scripts`. Verify both native
|
|
architectures, the default plugin path, and the image/userland vulnerability scans.
|
|
|
|
Security evidence reviewed on 2026-09-13: the release has no standalone SBOM
|
|
asset. Trivy can inspect package metadata and installed DCP files, but cannot
|
|
enumerate the JavaScript dependencies compiled into OpenCode's Bun executable.
|
|
The published repository advisories are fixed before the selected baseline:
|
|
|
|
- <https://github.com/anomalyco/opencode/security/advisories/GHSA-c83v-7274-4vgp>
|
|
affects versions before 1.1.10 (web UI XSS).
|
|
- <https://github.com/anomalyco/opencode/security/advisories/GHSA-vxw4-wv6m-9hhh>
|
|
affects versions before 1.0.216 (unauthenticated HTTP server).
|
|
|
|
The smoke test also verifies that `/config` rejects unauthenticated requests
|
|
when the documented server password is set. This evidence does not establish
|
|
that every embedded library is vulnerability-free; recheck upstream advisories
|
|
when updating the baseline.
|