1password

LOW

maintainer 1Password 151 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package installs a legitimate prebuilt binary from 1Password's official domain, uses a valid PGP signature, and the privileged operations (group creation, setgid on browser helper) are part of the official app's documented integration mechanism, not malicious activity.

Triggered rules

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a legitimate prebuilt binary from 1Password's official domain, uses a valid PGP signature, and the privileged operations (group creation, setgid on browser helper) are part of the official app's documented integration mechanism, not malicious activity.

2 higher static findings superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=(https://downloads.1password.com/linux/tar/stable/${CARCH}/${_tar}{,.sig})

Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

.install:17 chmod g+s $BROWSER_SUPPORT_PATH

PKGBUILD

1 offending line(s) highlighted

      1pkgname=1password
    
      2
    
      3_tarver=8.12.36
    
      4_tar="1password-${_tarver}.x64.tar.gz"
    
      5pkgver=${_tarver//-/_}
    
      6pkgrel=42
    
      7conflicts=('1password-beta' '1password-beta-bin')
    
      8pkgdesc="Password manager and secure wallet"
    
      9arch=('x86_64')
    
      10url='https://1password.com'
    
      11license=('LicenseRef-1Password-Proprietary')
    
      12options=(!strip)
    
      13install="1password.install"
    
      14source=(https://downloads.1password.com/linux/tar/stable/${CARCH}/${_tar}{,.sig})
    
      15sha256sums=('393c93c8025fee5dda76a4d0f1e478e98526cc946e58a22efe26f540ea2b5729'
    
      16            '251177694bfdc63c431021e2bd2ed64f241b8a0247d5dd1c46d4d2dadffe7b97'
    
      17)
    
      18validpgpkeys=('3FEF9748469ADBE15DA7CA80AC2D62742012EA22')
    
      19
    
      20package() {
    
      21    depends=('hicolor-icon-theme' 'libgtk-3.so=0' 'nss' 'xdg-utils')
    
      22
    
      23    # Go to source directory
    
      24    cd "1password-${_tarver}.x64"
    
      25
    
      26    # Install icons
    
      27    resolutions=(32x32 64x64 256x256 512x512)
    
      28    for resolution in "${resolutions[@]}"
    
      29    do
    
      30        install -Dm0644 "resources/icons/hicolor/${resolution}/apps/1password.png" \
    
      31            "${pkgdir}/usr/share/icons/hicolor/${resolution}/apps/1password.png"
    
      32    done
    
      33    # Install desktop file
    
      34    install -Dm0644 resources/com.onepassword.OnePassword.desktop -t "${pkgdir}"/usr/share/applications/
    
      35
    
      36    # Fill in policy kit file with a list of (the first 10) human users of the system.
    
      37    export POLICY_OWNERS
    
      38    POLICY_OWNERS="$(cut -d: -f1,3 /etc/passwd | grep -E ':[0-9]{4}$' | cut -d: -f1 | head -n 10 | sed 's/^/unix-user:/' | tr '\n' ' ')"
    
      39    eval "cat <<EOF
    
      40$(cat ./com.1password.1Password.policy.tpl)
    
      41EOF" > ./com.1password.1Password.policy
    
      42
    
      43    # Install system unlock PolKit policy file
    
      44    install -Dm0644 com.1password.1Password.policy -t "${pkgdir}"/usr/share/polkit-1/actions/
    
      45
    
      46    # Install examples
    
      47    install -Dm0644 resources/custom_allowed_browsers -t "${pkgdir}"/usr/share/doc/1password/examples/
    
      48
    
      49    # Move package contents to /opt/1Password
    
      50    cd "${srcdir}"
    
      51    install -dm0755 "${pkgdir}"/opt
    
      52    mv "1password-${_tarver}.x64" "${pkgdir}/opt/1Password"
    
      53
    
      54    # Cleanup un-needed files
    
      55    rm "${pkgdir}"/opt/1Password/com.1password.1Password.policy "${pkgdir}"/opt/1Password/com.1password.1Password.policy.tpl "${pkgdir}"/opt/1Password/install_biometrics_policy.sh
    
      56    rm -r "${pkgdir}"/opt/1Password/resources/icons/
    
      57    rm "${pkgdir}"/opt/1Password/resources/com.onepassword.OnePassword.desktop "${pkgdir}"/opt/1Password/resources/custom_allowed_browsers
    
      58
    
      59    # Symlink /usr/bin executable to opt
    
      60    install -dm0755 "${pkgdir}"/usr/bin
    
      61    ln -s /opt/1Password/1password "${pkgdir}"/usr/bin/1password
    
      62
    
      63    # chrome-sandbox requires the setuid bit to be specifically set.
    
      64    # See https://github.com/electron/electron/issues/17972
    
      65    chmod 4755 "${pkgdir}"/opt/1Password/chrome-sandbox
    
      66}
    
      67

Changes since previous scan

--- PKGBUILD @ 2026-08-26 00:12
+++ PKGBUILD @ 2026-09-17 00:27
@@ -1,9 +1,9 @@
 pkgname=1password
 
-_tarver=8.12.32
+_tarver=8.12.36
 _tar="1password-${_tarver}.x64.tar.gz"
 pkgver=${_tarver//-/_}
-pkgrel=33
+pkgrel=42
 conflicts=('1password-beta' '1password-beta-bin')
 pkgdesc="Password manager and secure wallet"
 arch=('x86_64')
@@ -12,8 +12,8 @@
 options=(!strip)
 install="1password.install"
 source=(https://downloads.1password.com/linux/tar/stable/${CARCH}/${_tar}{,.sig})
-sha256sums=('760e3649034c4bbefedfddec0cfebac1e677dd55482a3390119c1a2bcda27d97'
-            '49b450988b974c1c36874141bedfedfaec570d623d97e3822780e7ec8dcfcb97'
+sha256sums=('393c93c8025fee5dda76a4d0f1e478e98526cc946e58a22efe26f540ea2b5729'
+            '251177694bfdc63c431021e2bd2ed64f241b8a0247d5dd1c46d4d2dadffe7b97'
 )
 validpgpkeys=('3FEF9748469ADBE15DA7CA80AC2D62742012EA22')
 
@@ -31,7 +31,7 @@
             "${pkgdir}/usr/share/icons/hicolor/${resolution}/apps/1password.png"
     done
     # Install desktop file
-    install -Dm0644 resources/1password.desktop -t "${pkgdir}"/usr/share/applications/
+    install -Dm0644 resources/com.onepassword.OnePassword.desktop -t "${pkgdir}"/usr/share/applications/
 
     # Fill in policy kit file with a list of (the first 10) human users of the system.
     export POLICY_OWNERS
@@ -54,7 +54,7 @@
     # Cleanup un-needed files
     rm "${pkgdir}"/opt/1Password/com.1password.1Password.policy "${pkgdir}"/opt/1Password/com.1password.1Password.policy.tpl "${pkgdir}"/opt/1Password/install_biometrics_policy.sh
     rm -r "${pkgdir}"/opt/1Password/resources/icons/
-    rm "${pkgdir}"/opt/1Password/resources/1password.desktop "${pkgdir}"/opt/1Password/resources/custom_allowed_browsers
+    rm "${pkgdir}"/opt/1Password/resources/com.onepassword.OnePassword.desktop "${pkgdir}"/opt/1Password/resources/custom_allowed_browsers
 
     # Symlink /usr/bin executable to opt
     install -dm0755 "${pkgdir}"/usr/bin

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	3
2026-09-16 00:03:17	Low	3
2026-09-15 00:25:31	Low	3
2026-09-14 00:27:57	Low	3
2026-09-13 00:19:54	Low	3
2026-09-12 00:25:17	Low	3
2026-09-11 23:24:29	Low	3
2026-09-11 19:23:32	Low	3
2026-08-26 00:12:07	Clean	3
2026-08-25 17:27:20	Low	2
2026-08-12 00:27:08	Clean	3
2026-08-11 15:21:23	Low	2
2026-08-11 00:07:57	Medium	3
2026-08-10 00:09:14	Medium	3
2026-08-09 00:07:45	Medium	3
2026-08-08 00:18:14	Medium	3
2026-08-07 00:19:04	Medium	3
2026-08-06 00:26:13	Medium	3
2026-08-05 00:12:14	Medium	3
2026-08-04 00:01:00	Medium	3