1password

MEDIUM

maintainer 1Password 153 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package installs a prebuilt binary from an official vendor domain (1password.com) which is not on the whitelist but is plausibly the project's own; however, it also sets group ownership and the setgid bit on a helper binary in post_install/upgrade, which is a privileged action that could pose a security risk if the binary is compromised or misused, warranting a medium severity.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=(https://downloads.1password.com/linux/tar/stable/${CARCH}/${_tar}{,.sig})

Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

.install:17 chmod g+s $BROWSER_SUPPORT_PATH

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs a prebuilt binary from an official vendor domain (1password.com) which is not on the whitelist but is plausibly the project's own; however, it also sets group ownership and the setgid bit on a helper binary in post_install/upgrade, which is a privileged action that could pose a security risk if the binary is compromised or misused, warranting a medium severity.

PKGBUILD

1 offending line(s) highlighted

      1pkgname=1password
    
      2
    
      3_tarver=8.12.42
    
      4_tar="1password-${_tarver}.x64.tar.gz"
    
      5pkgver=${_tarver//-/_}
    
      6pkgrel=36
    
      7conflicts=('1password-beta' '1password-beta-bin')
    
      8pkgdesc="Password manager and secure wallet"
    
      9arch=('x86_64')
    
      10url='https://1password.com'
    
      11license=('LicenseRef-1Password-Proprietary')
    
      12options=(!strip)
    
      13install="1password.install"
    
      14source=(https://downloads.1password.com/linux/tar/stable/${CARCH}/${_tar}{,.sig})
    
      15sha256sums=('2ce64d1bd53dd6fd4408739a079d10be01aff35cb4e8eaeca3dc9b7c6a8418de'
    
      16            '150a33bbf59b0b07afd9aca43b129f7f7ba60964ccc314f07cccff90456cbb18'
    
      17)
    
      18validpgpkeys=('3FEF9748469ADBE15DA7CA80AC2D62742012EA22')
    
      19
    
      20package() {
    
      21    depends=('hicolor-icon-theme' 'libgtk-3.so=0' 'nss' 'xdg-utils')
    
      22
    
      23    # Go to source directory
    
      24    cd "1password-${_tarver}.x64"
    
      25
    
      26    # Install icons
    
      27    resolutions=(32x32 64x64 256x256 512x512)
    
      28    for resolution in "${resolutions[@]}"
    
      29    do
    
      30        install -Dm0644 "resources/icons/hicolor/${resolution}/apps/1password.png" \
    
      31            "${pkgdir}/usr/share/icons/hicolor/${resolution}/apps/1password.png"
    
      32    done
    
      33    # Install desktop file
    
      34    install -Dm0644 resources/com.onepassword.OnePassword.desktop -t "${pkgdir}"/usr/share/applications/
    
      35
    
      36    # Fill in policy kit file with a list of (the first 10) human users of the system.
    
      37    export POLICY_OWNERS
    
      38    POLICY_OWNERS="$(cut -d: -f1,3 /etc/passwd | grep -E ':[0-9]{4}$' | cut -d: -f1 | head -n 10 | sed 's/^/unix-user:/' | tr '\n' ' ')"
    
      39    eval "cat <<EOF
    
      40$(cat ./com.1password.1Password.policy.tpl)
    
      41EOF" > ./com.1password.1Password.policy
    
      42
    
      43    # Install system unlock PolKit policy file
    
      44    install -Dm0644 com.1password.1Password.policy -t "${pkgdir}"/usr/share/polkit-1/actions/
    
      45
    
      46    # Install examples
    
      47    install -Dm0644 resources/custom_allowed_browsers -t "${pkgdir}"/usr/share/doc/1password/examples/
    
      48
    
      49    # Move package contents to /opt/1Password
    
      50    cd "${srcdir}"
    
      51    install -dm0755 "${pkgdir}"/opt
    
      52    mv "1password-${_tarver}.x64" "${pkgdir}/opt/1Password"
    
      53
    
      54    # Cleanup un-needed files
    
      55    rm "${pkgdir}"/opt/1Password/com.1password.1Password.policy "${pkgdir}"/opt/1Password/com.1password.1Password.policy.tpl "${pkgdir}"/opt/1Password/install_biometrics_policy.sh
    
      56    rm -r "${pkgdir}"/opt/1Password/resources/icons/
    
      57    rm "${pkgdir}"/opt/1Password/resources/com.onepassword.OnePassword.desktop "${pkgdir}"/opt/1Password/resources/custom_allowed_browsers
    
      58
    
      59    # Symlink /usr/bin executable to opt
    
      60    install -dm0755 "${pkgdir}"/usr/bin
    
      61    ln -s /opt/1Password/1password "${pkgdir}"/usr/bin/1password
    
      62
    
      63    # chrome-sandbox requires the setuid bit to be specifically set.
    
      64    # See https://github.com/electron/electron/issues/17972
    
      65    chmod 4755 "${pkgdir}"/opt/1Password/chrome-sandbox
    
      66}
    
      67

Changes since previous scan

--- PKGBUILD @ 2026-10-20 00:10
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,9 +1,9 @@
 pkgname=1password
 
-_tarver=8.12.40
+_tarver=8.12.42
 _tar="1password-${_tarver}.x64.tar.gz"
 pkgver=${_tarver//-/_}
-pkgrel=31
+pkgrel=36
 conflicts=('1password-beta' '1password-beta-bin')
 pkgdesc="Password manager and secure wallet"
 arch=('x86_64')
@@ -12,8 +12,8 @@
 options=(!strip)
 install="1password.install"
 source=(https://downloads.1password.com/linux/tar/stable/${CARCH}/${_tar}{,.sig})
-sha256sums=('0ae9645d31be78a8fb57d15f49e5fa4f0b67a0b3608797a410e8fd36f0206266'
-            '2f777820dc2eb6e7b7b38f4557a897f97fb3259443261fdfb2008127bd975817'
+sha256sums=('2ce64d1bd53dd6fd4408739a079d10be01aff35cb4e8eaeca3dc9b7c6a8418de'
+            '150a33bbf59b0b07afd9aca43b129f7f7ba60964ccc314f07cccff90456cbb18'
 )
 validpgpkeys=('3FEF9748469ADBE15DA7CA80AC2D62742012EA22')
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	3
2026-10-31 00:07:41	Medium	3
2026-10-30 00:29:30	Medium	3
2026-10-29 19:53:24	Medium	3
2026-10-29 00:13:55	Medium	3
2026-10-28 00:06:54	Medium	3
2026-10-27 21:48:49	Medium	3
2026-10-27 00:23:28	Medium	3
2026-10-26 00:12:40	Medium	3
2026-10-25 00:20:48	Medium	3
2026-10-24 00:14:55	Medium	3
2026-10-23 00:02:19	Medium	3
2026-10-22 00:13:10	Medium	3
2026-10-21 00:12:50	Medium	3
2026-10-20 19:28:13	Medium	3
2026-10-20 00:10:31	Low	3
2026-10-19 00:03:55	Low	3
2026-10-18 00:06:55	Low	3
2026-10-17 00:21:55	Low	3
2026-10-16 00:12:47	Low	3