You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I have verified this feature I'm about to request hasn't been suggested before.
Describe the enhancement you want to request
I have processes to check for updates in place for my tools (my dotfiles basically act as lockfiles for them). All documented install processes either do not validate downloads (#31390 and #42434) or assume tools I do not use (npm, bun, brew, Arch). Also consider #45757 when restoring release entities.
Thanks for the request! You're asking for OpenCode v2 binaries to be published as GitHub Release assets, with a way to check them after download (checksums and/or attestations). That would let version-pinning setups like yours track OpenCode without npm, bun, brew or a distro package. Maintainers will consider it.
Some context: GitHub Releases currently stop at v1.x, because v1 clients look for updates through GitHub's Latest release. v2 ships through opencode.ai, npm (@opencode/cli) and brew, and each version is tagged here (e.g. v2.1.2). The current v2 install script (opencode.ai/v2/install) downloads the npm tarball for your platform without checking it afterwards, so your point about unverified installs stands.
Activity
opencode-agent commentedon Oct 22, 2026
Thanks for the request! You're asking for OpenCode v2 binaries to be published as GitHub Release assets, with a way to check them after download (checksums and/or attestations). That would let version-pinning setups like yours track OpenCode without npm, bun, brew or a distro package. Maintainers will consider it.
Some context: GitHub Releases currently stop at v1.x, because v1 clients look for updates through GitHub's Latest release. v2 ships through opencode.ai, npm (
@opencode/cli) and brew, and each version is tagged here (e.g.v2.1.2). The current v2 install script (opencode.ai/v2/install) downloads the npm tarball for your platform without checking it afterwards, so your point about unverified installs stands.Related issues and PRs:
opencode upgradepiping a remote script to bash without verification (v1 era, closed as stale)opencode-v2entry