1password-beta

maintainer 1Password · 4 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package installs a legitimate beta version of 1Password from the official 1password.com domain; the non-standard host is part of their official download infrastructure, and the privileged operations (group creation, setgid binary) are required for browser integration and are safely scoped.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package installs a legitimate beta version of 1Password from the official 1password.com domain; the non-standard host is part of their official download infrastructure, and the privileged operations (group creation, setgid binary) are required for browser integration and are safely scoped.

2 higher static findings superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=(https://downloads.1password.com/linux/tar/beta/${CARCH}/${_tar}{,.sig})

MEDIUM Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

.install:17 chmod g+s $BROWSER_SUPPORT_PATH

PKGBUILD

1 offending line(s) highlighted

      1pkgname=1password-beta
    
      2
    
      3_tarver=8.12.32-26.BETA
    
      4_tar="1password-${_tarver}.x64.tar.gz"
    
      5pkgver=${_tarver//-/_}
    
      6pkgrel=26
    
      7conflicts=('1password' '1password-beta-bin')
    
      8pkgdesc="Password manager and secure wallet"
    
      9arch=('x86_64')
    
      10url='https://1password.com'
    
      11license=('LicenseRef-1Password-Proprietary')
    
      12options=(!strip)
    
      13install="1password.install"
    
      14source=(https://downloads.1password.com/linux/tar/beta/${CARCH}/${_tar}{,.sig})
    
      15sha256sums=('f4bb6c3917bfa35f92c417de18215fea188ed6ec2e056c888c756cda35b414da'
    
      16            'fd58f8b63b9fad8f154388a77cca400b1578a02569f9e9127fef00a82527a961'
    
      17)
    
      18validpgpkeys=('3FEF9748469ADBE15DA7CA80AC2D62742012EA22')
    
      19
    
      20package() {
    
      21    depends=('hicolor-icon-theme' 'libgtk-3.so=0' 'nss' 'xdg-utils')
    
      22
    
      23    # Go to source directory
    
      24    cd "1password-${_tarver}.x64"
    
      25
    
      26    # Install icons
    
      27    resolutions=(32x32 64x64 256x256 512x512)
    
      28    for resolution in "${resolutions[@]}"
    
      29    do
    
      30        install -Dm0644 "resources/icons/hicolor/${resolution}/apps/1password.png" \
    
      31            "${pkgdir}/usr/share/icons/hicolor/${resolution}/apps/1password.png"
    
      32    done
    
      33    # Install desktop file
    
      34    install -Dm0644 resources/1password.desktop -t "${pkgdir}"/usr/share/applications/
    
      35
    
      36    # Fill in policy kit file with a list of (the first 10) human users of the system.
    
      37    export POLICY_OWNERS
    
      38    POLICY_OWNERS="$(cut -d: -f1,3 /etc/passwd | grep -E ':[0-9]{4}$' | cut -d: -f1 | head -n 10 | sed 's/^/unix-user:/' | tr '\n' ' ')"
    
      39    eval "cat <<EOF
    
      40$(cat ./com.1password.1Password.policy.tpl)
    
      41EOF" > ./com.1password.1Password.policy
    
      42
    
      43    # Install system unlock PolKit policy file
    
      44    install -Dm0644 com.1password.1Password.policy -t "${pkgdir}"/usr/share/polkit-1/actions/
    
      45
    
      46    # Install examples
    
      47    install -Dm0644 resources/custom_allowed_browsers -t "${pkgdir}"/usr/share/doc/1password/examples/
    
      48
    
      49    # Move package contents to /opt/1Password
    
      50    cd "${srcdir}"
    
      51    install -dm0755 "${pkgdir}"/opt
    
      52    mv "1password-${_tarver}.x64" "${pkgdir}/opt/1Password"
    
      53
    
      54    # Cleanup un-needed files
    
      55    rm "${pkgdir}"/opt/1Password/com.1password.1Password.policy "${pkgdir}"/opt/1Password/com.1password.1Password.policy.tpl "${pkgdir}"/opt/1Password/install_biometrics_policy.sh
    
      56    rm -r "${pkgdir}"/opt/1Password/resources/icons/
    
      57    rm "${pkgdir}"/opt/1Password/resources/1password.desktop "${pkgdir}"/opt/1Password/resources/custom_allowed_browsers
    
      58
    
      59    # Symlink /usr/bin executable to opt
    
      60    install -dm0755 "${pkgdir}"/usr/bin
    
      61    ln -s /opt/1Password/1password "${pkgdir}"/usr/bin/1password
    
      62
    
      63    # chrome-sandbox requires the setuid bit to be specifically set.
    
      64    # See https://github.com/electron/electron/issues/17972
    
      65    chmod 4755 "${pkgdir}"/opt/1Password/chrome-sandbox
    
      66}
    
      67

Changes since previous scan

--- PKGBUILD @ 2026-07-29 00:25
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,9 +1,9 @@
 pkgname=1password-beta
 
-_tarver=8.12.30-19.BETA
+_tarver=8.12.32-26.BETA
 _tar="1password-${_tarver}.x64.tar.gz"
 pkgver=${_tarver//-/_}
-pkgrel=19
+pkgrel=26
 conflicts=('1password' '1password-beta-bin')
 pkgdesc="Password manager and secure wallet"
 arch=('x86_64')
@@ -12,8 +12,8 @@
 options=(!strip)
 install="1password.install"
 source=(https://downloads.1password.com/linux/tar/beta/${CARCH}/${_tar}{,.sig})
-sha256sums=('5436009feee46e985da362f95578d7201a985cba4bf0eef015bcae99e49ed691'
-            '418350d51a156dafa1273fe97ccad110de1d066800d2a69389c0c5385a6f5a2d'
+sha256sums=('f4bb6c3917bfa35f92c417de18215fea188ed6ec2e056c888c756cda35b414da'
+            'fd58f8b63b9fad8f154388a77cca400b1578a02569f9e9127fef00a82527a961'
 )
 validpgpkeys=('3FEF9748469ADBE15DA7CA80AC2D62742012EA22')
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 00:14:10	LOW	3
2026-07-30 00:17:23	LOW	3
2026-07-29 11:11:22	MEDIUM	2
2026-07-29 00:25:53	LOW	3
2026-07-28 00:07:28	LOW	3
2026-07-27 00:24:32	LOW	3
2026-07-26 00:07:32	LOW	3
2026-07-25 00:13:44	LOW	3
2026-07-24 00:02:28	LOW	3
2026-07-23 00:14:47	LOW	3
2026-07-22 00:29:32	LOW	3
2026-07-21 00:24:15	LOW	3
2026-07-20 00:19:49	LOW	3
2026-07-19 00:17:08	LOW	3
2026-07-18 00:14:48	LOW	3
2026-07-17 00:06:16	LOW	3
2026-07-16 00:05:41	LOW	3