1password-beta

LOW

maintainer 1Password 4 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt binary from 1Password's official domain and installs it to /opt, which is standard for proprietary software; the non-standard host is actually the vendor's official release infrastructure, and the setgid bit on the browser helper is a legitimate requirement for inter-process communication, not a privilege escalation.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt binary from 1Password's official domain and installs it to /opt, which is standard for proprietary software; the non-standard host is actually the vendor's official release infrastructure, and the setgid bit on the browser helper is a legitimate requirement for inter-process communication, not a privilege escalation.

2 higher static findings superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=(https://downloads.1password.com/linux/tar/beta/${CARCH}/${_tar}{,.sig})

Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

.install:17 chmod g+s $BROWSER_SUPPORT_PATH

PKGBUILD

1 offending line(s) highlighted

      1pkgname=1password-beta
    
      2
    
      3_tarver=8.12.38-25.BETA
    
      4_tar="1password-${_tarver}.x64.tar.gz"
    
      5pkgver=${_tarver//-/_}
    
      6pkgrel=25
    
      7conflicts=('1password' '1password-beta-bin')
    
      8pkgdesc="Password manager and secure wallet"
    
      9arch=('x86_64')
    
      10url='https://1password.com'
    
      11license=('LicenseRef-1Password-Proprietary')
    
      12options=(!strip)
    
      13install="1password.install"
    
      14source=(https://downloads.1password.com/linux/tar/beta/${CARCH}/${_tar}{,.sig})
    
      15sha256sums=('c6d302a2c7404a7ded34a3c4f1c401a43eafeed8b147d128dcb416284c2c2b71'
    
      16            'cc0f00054749c32d77fba31a12a8dece812e409f4b9d81850d2f9b50fab55dca'
    
      17)
    
      18validpgpkeys=('3FEF9748469ADBE15DA7CA80AC2D62742012EA22')
    
      19
    
      20package() {
    
      21    depends=('hicolor-icon-theme' 'libgtk-3.so=0' 'nss' 'xdg-utils')
    
      22
    
      23    # Go to source directory
    
      24    cd "1password-${_tarver}.x64"
    
      25
    
      26    # Install icons
    
      27    resolutions=(32x32 64x64 256x256 512x512)
    
      28    for resolution in "${resolutions[@]}"
    
      29    do
    
      30        install -Dm0644 "resources/icons/hicolor/${resolution}/apps/1password.png" \
    
      31            "${pkgdir}/usr/share/icons/hicolor/${resolution}/apps/1password.png"
    
      32    done
    
      33    # Install desktop file
    
      34    install -Dm0644 resources/com.onepassword.OnePassword.desktop -t "${pkgdir}"/usr/share/applications/
    
      35
    
      36    # Fill in policy kit file with a list of (the first 10) human users of the system.
    
      37    export POLICY_OWNERS
    
      38    POLICY_OWNERS="$(cut -d: -f1,3 /etc/passwd | grep -E ':[0-9]{4}$' | cut -d: -f1 | head -n 10 | sed 's/^/unix-user:/' | tr '\n' ' ')"
    
      39    eval "cat <<EOF
    
      40$(cat ./com.1password.1Password.policy.tpl)
    
      41EOF" > ./com.1password.1Password.policy
    
      42
    
      43    # Install system unlock PolKit policy file
    
      44    install -Dm0644 com.1password.1Password.policy -t "${pkgdir}"/usr/share/polkit-1/actions/
    
      45
    
      46    # Install examples
    
      47    install -Dm0644 resources/custom_allowed_browsers -t "${pkgdir}"/usr/share/doc/1password/examples/
    
      48
    
      49    # Move package contents to /opt/1Password
    
      50    cd "${srcdir}"
    
      51    install -dm0755 "${pkgdir}"/opt
    
      52    mv "1password-${_tarver}.x64" "${pkgdir}/opt/1Password"
    
      53
    
      54    # Cleanup un-needed files
    
      55    rm "${pkgdir}"/opt/1Password/com.1password.1Password.policy "${pkgdir}"/opt/1Password/com.1password.1Password.policy.tpl "${pkgdir}"/opt/1Password/install_biometrics_policy.sh
    
      56    rm -r "${pkgdir}"/opt/1Password/resources/icons/
    
      57    rm "${pkgdir}"/opt/1Password/resources/com.onepassword.OnePassword.desktop "${pkgdir}"/opt/1Password/resources/custom_allowed_browsers
    
      58    # Symlink /usr/bin executable to opt
    
      59    install -dm0755 "${pkgdir}"/usr/bin
    
      60    ln -s /opt/1Password/1password "${pkgdir}"/usr/bin/1password
    
      61
    
      62    # chrome-sandbox requires the setuid bit to be specifically set.
    
      63    # See https://github.com/electron/electron/issues/17972
    
      64    chmod 4755 "${pkgdir}"/opt/1Password/chrome-sandbox
    
      65}
    
      66

Changes since previous scan

--- PKGBUILD @ 2026-09-11 19:23
+++ PKGBUILD @ 2026-09-17 00:27
@@ -1,9 +1,9 @@
 pkgname=1password-beta
 
-_tarver=8.12.34-29.BETA
+_tarver=8.12.38-25.BETA
 _tar="1password-${_tarver}.x64.tar.gz"
 pkgver=${_tarver//-/_}
-pkgrel=29
+pkgrel=25
 conflicts=('1password' '1password-beta-bin')
 pkgdesc="Password manager and secure wallet"
 arch=('x86_64')
@@ -12,8 +12,8 @@
 options=(!strip)
 install="1password.install"
 source=(https://downloads.1password.com/linux/tar/beta/${CARCH}/${_tar}{,.sig})
-sha256sums=('6894b283a534cf94b07903fb38966a0aab2e37f75ee3848ce340308819aadddb'
-            '8d4df4d0a80d2be7aad7d91ad964a750c8f32db5007261045003c191690c8246'
+sha256sums=('c6d302a2c7404a7ded34a3c4f1c401a43eafeed8b147d128dcb416284c2c2b71'
+            'cc0f00054749c32d77fba31a12a8dece812e409f4b9d81850d2f9b50fab55dca'
 )
 validpgpkeys=('3FEF9748469ADBE15DA7CA80AC2D62742012EA22')
 
@@ -31,7 +31,7 @@
             "${pkgdir}/usr/share/icons/hicolor/${resolution}/apps/1password.png"
     done
     # Install desktop file
-    install -Dm0644 resources/1password.desktop -t "${pkgdir}"/usr/share/applications/
+    install -Dm0644 resources/com.onepassword.OnePassword.desktop -t "${pkgdir}"/usr/share/applications/
 
     # Fill in policy kit file with a list of (the first 10) human users of the system.
     export POLICY_OWNERS
@@ -54,8 +54,7 @@
     # Cleanup un-needed files
     rm "${pkgdir}"/opt/1Password/com.1password.1Password.policy "${pkgdir}"/opt/1Password/com.1password.1Password.policy.tpl "${pkgdir}"/opt/1Password/install_biometrics_policy.sh
     rm -r "${pkgdir}"/opt/1Password/resources/icons/
-    rm "${pkgdir}"/opt/1Password/resources/1password.desktop "${pkgdir}"/opt/1Password/resources/custom_allowed_browsers
-
+    rm "${pkgdir}"/opt/1Password/resources/com.onepassword.OnePassword.desktop "${pkgdir}"/opt/1Password/resources/custom_allowed_browsers
     # Symlink /usr/bin executable to opt
     install -dm0755 "${pkgdir}"/usr/bin
     ln -s /opt/1Password/1password "${pkgdir}"/usr/bin/1password

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	3
2026-09-16 00:03:17	Low	3
2026-09-15 00:25:31	Low	3
2026-09-14 00:27:57	Low	3
2026-09-13 00:19:54	Low	3
2026-09-12 00:25:17	Low	3
2026-09-11 23:24:29	Medium	2
2026-09-11 19:23:32	Medium	2
2026-09-11 00:19:22	Low	3
2026-09-10 00:22:44	Low	3
2026-09-09 00:04:09	Low	3
2026-09-08 00:18:08	Low	3
2026-09-07 00:30:15	Low	3
2026-09-06 00:17:06	Low	3
2026-09-05 00:16:27	Low	3
2026-09-04 00:03:13	Low	3
2026-09-03 00:15:47	Low	3
2026-09-02 00:02:31	Low	3
2026-09-01 00:11:19	Low	3
2026-08-31 00:19:57	Low	3