1password-beta
MEDIUM
maintainer 1Password
4 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package installs a prebuilt binary from a non-whitelisted host (downloads.1password.com), which is a supply-chain risk if the host were compromised, and it sets privileged permissions (setgid) on a helper binary via the .install script.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:14
source=(https://downloads.1password.com/linux/tar/beta/${CARCH}/${_tar}{,.sig})
Medium
Privileged / out-of-pacman install (sudoers, setuid, or self-update)
privileged_install
The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.
-
.install:17
chmod g+s $BROWSER_SUPPORT_PATH
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package installs a prebuilt binary from a non-whitelisted host (downloads.1password.com), which is a supply-chain risk if the host were compromised, and it sets privileged permissions (setgid) on a helper binary via the .install script.
PKGBUILD
1 offending line(s) highlighted
1
pkgname=1password-beta
2
3
_tarver=8.12.44-25.BETA
4
_tar="1password-${_tarver}.x64.tar.gz"
5
pkgver=${_tarver//-/_}
6
pkgrel=25
7
conflicts=('1password' '1password-beta-bin')
8
pkgdesc="Password manager and secure wallet"
9
arch=('x86_64')
10
url='https://1password.com'
11
license=('LicenseRef-1Password-Proprietary')
12
options=(!strip)
13
install="1password.install"
14
source=(https://downloads.1password.com/linux/tar/beta/${CARCH}/${_tar}{,.sig})
15
sha256sums=('fda21595f35cd4b6f4a64cb23c85d51f43195c5051f472e066e46babcc6e45b6'
16
'2febed7726d4cd18617acfa56b5c11d698499a9e236bb44b77c5266297b27ffd'
17
)
18
validpgpkeys=('3FEF9748469ADBE15DA7CA80AC2D62742012EA22')
19
20
package() {
21
depends=('hicolor-icon-theme' 'libgtk-3.so=0' 'nss' 'xdg-utils')
22
23
# Go to source directory
24
cd "1password-${_tarver}.x64"
25
26
# Install icons
27
resolutions=(32x32 64x64 256x256 512x512)
28
for resolution in "${resolutions[@]}"
29
do
30
install -Dm0644 "resources/icons/hicolor/${resolution}/apps/1password.png" \
31
"${pkgdir}/usr/share/icons/hicolor/${resolution}/apps/1password.png"
32
done
33
# Install desktop file
34
install -Dm0644 resources/com.onepassword.OnePassword.desktop -t "${pkgdir}"/usr/share/applications/
35
36
# Fill in policy kit file with a list of (the first 10) human users of the system.
37
export POLICY_OWNERS
38
POLICY_OWNERS="$(cut -d: -f1,3 /etc/passwd | grep -E ':[0-9]{4}$' | cut -d: -f1 | head -n 10 | sed 's/^/unix-user:/' | tr '\n' ' ')"
39
eval "cat <<EOF
40
$(cat ./com.1password.1Password.policy.tpl)
41
EOF" > ./com.1password.1Password.policy
42
43
# Install system unlock PolKit policy file
44
install -Dm0644 com.1password.1Password.policy -t "${pkgdir}"/usr/share/polkit-1/actions/
45
46
# Install examples
47
install -Dm0644 resources/custom_allowed_browsers -t "${pkgdir}"/usr/share/doc/1password/examples/
48
49
# Move package contents to /opt/1Password
50
cd "${srcdir}"
51
install -dm0755 "${pkgdir}"/opt
52
mv "1password-${_tarver}.x64" "${pkgdir}/opt/1Password"
53
54
# Cleanup un-needed files
55
rm "${pkgdir}"/opt/1Password/com.1password.1Password.policy "${pkgdir}"/opt/1Password/com.1password.1Password.policy.tpl "${pkgdir}"/opt/1Password/install_biometrics_policy.sh
56
rm -r "${pkgdir}"/opt/1Password/resources/icons/
57
rm "${pkgdir}"/opt/1Password/resources/com.onepassword.OnePassword.desktop "${pkgdir}"/opt/1Password/resources/custom_allowed_browsers
58
59
# Symlink /usr/bin executable to opt
60
install -dm0755 "${pkgdir}"/usr/bin
61
ln -s /opt/1Password/1password "${pkgdir}"/usr/bin/1password
62
63
# chrome-sandbox requires the setuid bit to be specifically set.
64
# See https://github.com/electron/electron/issues/17972
65
chmod 4755 "${pkgdir}"/opt/1Password/chrome-sandbox
66
}
67
Changes since previous scan
--- PKGBUILD @ 2026-10-29 00:13+++ PKGBUILD @ 2026-11-01 00:21@@ -1,9 +1,9 @@ pkgname=1password-beta -_tarver=8.12.42-34.BETA+_tarver=8.12.44-25.BETA _tar="1password-${_tarver}.x64.tar.gz" pkgver=${_tarver//-/_}-pkgrel=34+pkgrel=25 conflicts=('1password' '1password-beta-bin') pkgdesc="Password manager and secure wallet" arch=('x86_64')@@ -12,8 +12,8 @@ options=(!strip) install="1password.install" source=(https://downloads.1password.com/linux/tar/beta/${CARCH}/${_tar}{,.sig})-sha256sums=('be6e23d67172a00559b39111e73ea051970677c9daacfea9027b748308eaf271'- '91bba1a4a01541c992562f5f0c26daeccc89ecb7961cf39a12bad0ca26581c4e'+sha256sums=('fda21595f35cd4b6f4a64cb23c85d51f43195c5051f472e066e46babcc6e45b6'+ '2febed7726d4cd18617acfa56b5c11d698499a9e236bb44b77c5266297b27ffd' ) validpgpkeys=('3FEF9748469ADBE15DA7CA80AC2D62742012EA22') Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Medium | 3 |
| 2026-10-31 00:07:41 | Medium | 3 |
| 2026-10-30 00:29:30 | Medium | 3 |
| 2026-10-29 19:53:24 | Medium | 3 |
| 2026-10-29 00:13:55 | Low | 3 |
| 2026-10-28 00:06:54 | Low | 3 |
| 2026-10-27 00:23:28 | Low | 3 |
| 2026-10-26 00:12:40 | Low | 3 |
| 2026-10-25 00:20:48 | Low | 3 |
| 2026-10-24 00:14:55 | Low | 3 |
| 2026-10-23 00:02:19 | Low | 3 |
| 2026-10-22 00:13:10 | Low | 3 |
| 2026-10-21 17:32:44 | Medium | 2 |
| 2026-10-21 00:12:50 | Medium | 3 |
| 2026-10-20 00:10:31 | Medium | 3 |
| 2026-10-19 00:03:55 | Medium | 3 |
| 2026-10-18 00:06:55 | Medium | 3 |
| 2026-10-17 00:21:55 | Medium | 3 |
| 2026-10-16 00:12:47 | Medium | 3 |
| 2026-10-15 00:28:05 | Medium | 3 |