1password-secret-service-git
LOW
maintainer a_i
0 votes
scanned 2026-08-22 05:16:50.653524
Why flagged
The package builds from a public Git repository with a SKIP'd checksum, but it is the project's own source code, not a prebuilt binary, and no malicious behavior is evident; the low severity reflects the unverifiable source and newness, not active danger.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from a public Git repository with a SKIP'd checksum, but it is the project's own source code, not a prebuilt binary, and no malicious behavior is evident; the low severity reflects the unverifiable source and newness, not active danger.
PKGBUILD
1
# Maintainer: Alex Indigo <ai@aegis.one>
2
3
pkgname=1password-secret-service-git
4
_projname=1password-secret-service
5
_release_ver=0.1.0.r0
6
pkgver=0.1.0.r2.g56a2fe0
7
pkgrel=1
8
pkgdesc="Freedesktop Secret Service (org.freedesktop.secrets) provider backed by 1Password (git version)"
9
arch=('x86_64' 'aarch64')
10
url="https://github.com/alexindigo/1password-secret-service"
11
license=('GPL-3.0-or-later')
12
depends=('1password' 'sqlite' 'glibc')
13
makedepends=('go' 'git')
14
provides=('1password-secret-service')
15
conflicts=('1password-secret-service')
16
# Go's debug split produces broken build-id symlinks; disable it.
17
options=('!debug')
18
source=("${pkgname}::git+${url}.git")
19
sha256sums=('SKIP')
20
21
pkgver() {
22
cd "${srcdir}/${pkgname}"
23
local out
24
out=$(git describe --long --tags 2>/dev/null) || out=""
25
if [ -n "$out" ]; then
26
printf "%s" "$out" | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/^v//'
27
else
28
echo "${_release_ver}.g$(git rev-parse --short HEAD)"
29
fi
30
}
31
32
build() {
33
cd "${srcdir}/${pkgname}"
34
export CGO_ENABLED=1
35
local _ver
36
_ver=$(pkgver)
37
go build -trimpath -buildmode=pie \
38
-ldflags="-s -w -linkmode=external -extldflags=-Wl,-z,relro,-z,now -X main.integrationVersion=v${_ver}" \
39
-o "${_projname}" "./cmd/${_projname}"
40
}
41
42
package() {
43
cd "${srcdir}/${pkgname}"
44
install -Dm755 "${_projname}" "${pkgdir}/usr/bin/${_projname}"
45
install -Dm644 packaging/1password-secret-service.service \
46
"${pkgdir}/usr/lib/systemd/user/1password-secret-service.service"
47
install -Dm644 packaging/org.freedesktop.secrets.service \
48
"${pkgdir}/usr/share/dbus-1/services/org.freedesktop.secrets.service"
49
install -Dm644 LICENSE \
50
"${pkgdir}/usr/share/licenses/${_projname}/LICENSE"
51
}
52
Changes since previous scan
--- PKGBUILD @ 2026-08-17 00:18+++ PKGBUILD @ 2026-08-22 05:16@@ -3,7 +3,7 @@ pkgname=1password-secret-service-git _projname=1password-secret-service _release_ver=0.1.0.r0-pkgver="${_release_ver}.g0000000"+pkgver=0.1.0.r2.g56a2fe0 pkgrel=1 pkgdesc="Freedesktop Secret Service (org.freedesktop.secrets) provider backed by 1Password (git version)" arch=('x86_64' 'aarch64')@@ -13,6 +13,8 @@ makedepends=('go' 'git') provides=('1password-secret-service') conflicts=('1password-secret-service')+# Go's debug split produces broken build-id symlinks; disable it.+options=('!debug') source=("${pkgname}::git+${url}.git") sha256sums=('SKIP') @@ -30,7 +32,10 @@ build() { cd "${srcdir}/${pkgname}" export CGO_ENABLED=1- go build -trimpath -buildmode=pie -ldflags="-s -w" \+ local _ver+ _ver=$(pkgver)+ go build -trimpath -buildmode=pie \+ -ldflags="-s -w -linkmode=external -extldflags=-Wl,-z,relro,-z,now -X main.integrationVersion=v${_ver}" \ -o "${_projname}" "./cmd/${_projname}" } Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-22 05:16:50 | Low | 2 |
| 2026-08-17 00:18:29 | Clean | 2 |
| 2026-08-16 09:32:18 | Low | 1 |