Review Results

Comment

The change is a straightforward version bump in .SRCINFO for the 1Password upstream tarball, with HTTPS sources, a pinned release URL, and updated checksums/PGP key unchanged. No new build steps, scripts, privileges, or additional sources were introduced. The only notable oddity is the pkgrel decreasing from 40 to 25, but that affects packaging metadata rather than security and does not by itself indicate a malicious change.

@@ -1,7 +1,7 @@
 pkgbase = 1password
 	pkgdesc = Password manager and secure wallet
-	pkgver = 8.12.26
-	pkgrel = 40
+	pkgver = 8.12.28
+	pkgrel = 25
 	url = https://1password.com
 	install = 1password.install
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO from 8.12.26 to 8.12.28, with corresponding checksum updates. The source remains the official HTTPS 1Password download endpoint, and the PGP key pinning is unchanged. No new sources, scripts, build steps, or packaging metadata that would suggest privilege escalation, persistence, or integrity bypass were introduced in this diff. Risk is low.

@@ -9,11 +9,11 @@ pkgbase = 1password
 	conflicts = 1password-beta
 	conflicts = 1password-beta-bin
 	options = !strip
-	source = https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.12.26.x64.tar.gz
-	source = https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.12.26.x64.tar.gz.sig
+	source = https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.12.28.x64.tar.gz
+	source = https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.12.28.x64.tar.gz.sig
 	validpgpkeys = 3FEF9748469ADBE15DA7CA80AC2D62742012EA22
-	sha256sums = c489cf6d9d6613466a52b06bd44211d54b6f032fdf612cd5c647fc88eedddae4
-	sha256sums = dfbbf5545a73abe52c5b3d393e4e89ac484d091759a93c418888475fa09e18be
+	sha256sums = 2695d72e98c039f061fa8735608071a816616b4d88bb3725561411885dbd57a7
+	sha256sums = 86495194592296f943cc26e3592ee0688d61c33d651caf46edcec6688b6c29db
 
 pkgname = 1password
 	depends = hicolor-icon-theme

Comment

The change only bumps the upstream tarball version from 8.12.26 to 8.12.28 and resets pkgrel accordingly. No build logic, source URLs, checksums, install scripts, or packaging behavior changed in the provided diff hunk. On its face this is a routine version update with no new security red flags visible in the reviewed change.

@@ -1,9 +1,9 @@
 pkgname=1password
 
-_tarver=8.12.26
+_tarver=8.12.28
 _tar="1password-${_tarver}.x64.tar.gz"
 pkgver=${_tarver//-/_}
-pkgrel=40
+pkgrel=25
 conflicts=('1password-beta' '1password-beta-bin')
 pkgdesc="Password manager and secure wallet"
 arch=('x86_64')

Comment

The change is a straightforward version bump for the proprietary 1Password tarball from 8.12.26 to 8.12.28, with matching SHA256 updates for the archive and signature. The source remains the official HTTPS download endpoint, and there are no new build steps, scripts, patches, or privilege/persistence mechanisms introduced in this diff. Risk is low; the main residual concern is the usual trust in an upstream binary release, but that is unchanged by this patch.

@@ -12,8 +12,8 @@ license=('LicenseRef-1Password-Proprietary')
 options=(!strip)
 install="1password.install"
 source=(https://downloads.1password.com/linux/tar/stable/${CARCH}/${_tar}{,.sig})
-sha256sums=('c489cf6d9d6613466a52b06bd44211d54b6f032fdf612cd5c647fc88eedddae4'
-            'dfbbf5545a73abe52c5b3d393e4e89ac484d091759a93c418888475fa09e18be'
+sha256sums=('2695d72e98c039f061fa8735608071a816616b4d88bb3725561411885dbd57a7'
+            '86495194592296f943cc26e3592ee0688d61c33d651caf46edcec6688b6c29db'
 )
 validpgpkeys=('3FEF9748469ADBE15DA7CA80AC2D62742012EA22')