desktop: latest-linux.yml 2.0.18 lists the AppImage sha512 for the rpm entry (checksum mismatch) #51929

Summary

The latest-linux.yml published for desktop 2.0.18 carries the AppImage's sha512 in its rpm entry, so every RPM checksum verification fails — manual verification and the in-app auto-update alike (electron-updater validates sha512 before installing). Affects both x86_64 and arm64.

Environment

• opencode version: CLI v2.0.18; Desktop opencode-2.0.15-1.x86_64 (2.0.18 offered as update)
• OS: Fedora Linux 44, kernel 7.2.7-200.fc44.x86_64, x86_64
• Terminal: TERM=xterm-256color
• Shell: /bin/bash
• Install/channel: release channel, RPM from the opencode.ai CDN; updater is provider: generic, url: https://opencode.ai/update/api/latest/desktop/opencode/, channel: latest
• Active plugins: /home/steeve/ponytail-v2

Reproduction

1. curl -sSL https://opencode.ai/update/api/latest/desktop/opencode/latest-linux.yml
2. curl -sSL https://opencode.ai/files/bin/2.0.18/opencode-desktop-linux-x86_64.rpm -o rpm
3. sha512sum rpm
4. Compare with the sha512: value of the opencode-desktop-linux-x86_64.rpm entry in the yml.

Expected Behavior

Each files[] entry's sha512 matches the artifact it points to, so manual verification and the RPM auto-update both succeed.

Actual Behavior

The rpm entry's sha512 is byte-identical to the AppImage entry's sha512 — the RPM's own hash is published nowhere.

latest-linux.yml — version: 2.0.18, releaseDate: 2026-09-25T23:30:42.704Z (x86_64):

Actual RPM sha512 (2.0.18, x86_64, 166613049 bytes — matches the published size, and rpm -qp reports opencode 2.0.18-1):

hex    : ca005781d94f01ddd332d06146db10c3bd15086ab47f5d6f77b5fda12870be3e0f53fdd45b1b0b02492ad80ff1ff99b6162fa7e6a24f994854041020617c8529
base64 : ygBXgdlPAd3TMtBhRtsQw70VCGq0f11vd7X9oShwvj4PU/3UWxsLAkkq2A/x/5m2Fi+n5qJPmUhUBBAgYXyFKQ==

The arm64 feed has the same defect: in latest-linux-arm64.yml (2.0.18), the opencode-desktop-linux-aarch64.rpm sha512 equals the arm64 AppImage's sha512 (L9feZG1C…).

Additional Context

• Published size values are correct for all three artifacts; only the RPM sha512 is wrong, i.e. the hash was copied from the AppImage entry while the size was computed per file.
• The 1.x line is healthy, so this looks like a regression in the 2.x publish path:
  • releases/download/v1.18.33/latest-linux.yml → rpm sha512 y5AkwOeo… matches the actual opencode-desktop-linux-x86_64.rpm (106 478 045 bytes).
  • Same check passes for 1.18.32 (sha512 bQyJxts…, size 106 460 189) against a locally cached updater artifact.
• packages/desktop/scripts/finalize-latest-yml.ts only re-serializes electron-builder's own latest-linux.yml, so the bad value is either produced by electron-builder (targets are ["AppImage", "deb", "rpm"] in packages/desktop/electron-builder.config.ts) or introduced between build and upload.
• There is no GitHub release for tag v2.0.18 (GET /releases/tags/v2.0.18 → 404); the 2.0.x feed only exists on the CDN, which makes the bad value harder to catch.
• No SHA512SUMS / *.sha512 sidecars are published (404 on /files/bin/2.0.18/SHA512SUMS and friends) and the RPM is unsigned (Signature: (none)), so users currently have no independent way to verify an RPM download.
• Suggested fix: recompute each files[] sha512 from the artifact before uploading the feed and fail the release on any mismatch; ideally also publish SHA512SUMS alongside /files/bin/<version>/.

Workaround

Users can install manually once the file is fetched over HTTPS and its size matches the feed, but there is currently no published value to verify it against — the values above are measured locally and should be re-checked by the release pipeline.