1password

maintainer 1Password · 147 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package installs a prebuilt binary from an official but non-whitelisted host (downloads.1password.com), which is a supply-chain risk if the source were swapped, and performs privileged operations like creating a group and setting setgid on a helper binary, though all actions are consistent with legitimate 1Password functionality.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=(https://downloads.1password.com/linux/tar/stable/${CARCH}/${_tar}{,.sig})

MEDIUM Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

.install:17 chmod g+s $BROWSER_SUPPORT_PATH

MEDIUM AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs a prebuilt binary from an official but non-whitelisted host (downloads.1password.com), which is a supply-chain risk if the source were swapped, and performs privileged operations like creating a group and setting setgid on a helper binary, though all actions are consistent with legitimate 1Password functionality.

PKGBUILD

1 offending line(s) highlighted

      1pkgname=1password
    
      2
    
      3_tarver=8.12.30
    
      4_tar="1password-${_tarver}.x64.tar.gz"
    
      5pkgver=${_tarver//-/_}
    
      6pkgrel=21
    
      7conflicts=('1password-beta' '1password-beta-bin')
    
      8pkgdesc="Password manager and secure wallet"
    
      9arch=('x86_64')
    
      10url='https://1password.com'
    
      11license=('LicenseRef-1Password-Proprietary')
    
      12options=(!strip)
    
      13install="1password.install"
    
      14source=(https://downloads.1password.com/linux/tar/stable/${CARCH}/${_tar}{,.sig})
    
      15sha256sums=('8d9b8f750a3928fbdb62a37961716ade5004a8971c5a18ba44e14e4af8e25ae5'
    
      16            '6cf6a540f1017628d93bc5e990ae4ae22e6f2450c08e76564c75b6991d6e8689'
    
      17)
    
      18validpgpkeys=('3FEF9748469ADBE15DA7CA80AC2D62742012EA22')
    
      19
    
      20package() {
    
      21    depends=('hicolor-icon-theme' 'libgtk-3.so=0' 'nss' 'xdg-utils')
    
      22
    
      23    # Go to source directory
    
      24    cd "1password-${_tarver}.x64"
    
      25
    
      26    # Install icons
    
      27    resolutions=(32x32 64x64 256x256 512x512)
    
      28    for resolution in "${resolutions[@]}"
    
      29    do
    
      30        install -Dm0644 "resources/icons/hicolor/${resolution}/apps/1password.png" \
    
      31            "${pkgdir}/usr/share/icons/hicolor/${resolution}/apps/1password.png"
    
      32    done
    
      33    # Install desktop file
    
      34    install -Dm0644 resources/1password.desktop -t "${pkgdir}"/usr/share/applications/
    
      35
    
      36    # Fill in policy kit file with a list of (the first 10) human users of the system.
    
      37    export POLICY_OWNERS
    
      38    POLICY_OWNERS="$(cut -d: -f1,3 /etc/passwd | grep -E ':[0-9]{4}$' | cut -d: -f1 | head -n 10 | sed 's/^/unix-user:/' | tr '\n' ' ')"
    
      39    eval "cat <<EOF
    
      40$(cat ./com.1password.1Password.policy.tpl)
    
      41EOF" > ./com.1password.1Password.policy
    
      42
    
      43    # Install system unlock PolKit policy file
    
      44    install -Dm0644 com.1password.1Password.policy -t "${pkgdir}"/usr/share/polkit-1/actions/
    
      45
    
      46    # Install examples
    
      47    install -Dm0644 resources/custom_allowed_browsers -t "${pkgdir}"/usr/share/doc/1password/examples/
    
      48
    
      49    # Move package contents to /opt/1Password
    
      50    cd "${srcdir}"
    
      51    install -dm0755 "${pkgdir}"/opt
    
      52    mv "1password-${_tarver}.x64" "${pkgdir}/opt/1Password"
    
      53
    
      54    # Cleanup un-needed files
    
      55    rm "${pkgdir}"/opt/1Password/com.1password.1Password.policy "${pkgdir}"/opt/1Password/com.1password.1Password.policy.tpl "${pkgdir}"/opt/1Password/install_biometrics_policy.sh
    
      56    rm -r "${pkgdir}"/opt/1Password/resources/icons/
    
      57    rm "${pkgdir}"/opt/1Password/resources/1password.desktop "${pkgdir}"/opt/1Password/resources/custom_allowed_browsers
    
      58
    
      59    # Symlink /usr/bin executable to opt
    
      60    install -dm0755 "${pkgdir}"/usr/bin
    
      61    ln -s /opt/1Password/1password "${pkgdir}"/usr/bin/1password
    
      62
    
      63    # chrome-sandbox requires the setuid bit to be specifically set.
    
      64    # See https://github.com/electron/electron/issues/17972
    
      65    chmod 4755 "${pkgdir}"/opt/1Password/chrome-sandbox
    
      66}
    
      67

Changes since previous scan

--- PKGBUILD @ 2026-07-28 00:07
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,9 +1,9 @@
 pkgname=1password
 
-_tarver=8.12.28
+_tarver=8.12.30
 _tar="1password-${_tarver}.x64.tar.gz"
 pkgver=${_tarver//-/_}
-pkgrel=25
+pkgrel=21
 conflicts=('1password-beta' '1password-beta-bin')
 pkgdesc="Password manager and secure wallet"
 arch=('x86_64')
@@ -12,8 +12,8 @@
 options=(!strip)
 install="1password.install"
 source=(https://downloads.1password.com/linux/tar/stable/${CARCH}/${_tar}{,.sig})
-sha256sums=('2695d72e98c039f061fa8735608071a816616b4d88bb3725561411885dbd57a7'
-            '86495194592296f943cc26e3592ee0688d61c33d651caf46edcec6688b6c29db'
+sha256sums=('8d9b8f750a3928fbdb62a37961716ade5004a8971c5a18ba44e14e4af8e25ae5'
+            '6cf6a540f1017628d93bc5e990ae4ae22e6f2450c08e76564c75b6991d6e8689'
 )
 validpgpkeys=('3FEF9748469ADBE15DA7CA80AC2D62742012EA22')
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 21:39:42	MEDIUM	3
2026-07-28 00:07:28	LOW	3
2026-07-27 00:24:32	LOW	3
2026-07-26 00:07:32	LOW	3
2026-07-25 00:13:44	LOW	3
2026-07-24 00:02:28	LOW	3
2026-07-23 00:14:47	LOW	3
2026-07-22 00:29:32	LOW	3
2026-07-21 00:24:15	LOW	3
2026-07-20 00:19:49	LOW	3
2026-07-19 00:17:08	LOW	3
2026-07-18 00:14:48	LOW	3
2026-07-17 00:06:16	LOW	3
2026-07-16 00:05:41	LOW	3