Review Results

Comment

The only change in .SRCINFO is a version bump from 8.12.28-25 to 8.12.30-21. This metadata file does not introduce new sources, build steps, install scripts, permissions, or dependency changes, so there is no direct security signal in the diff itself. I would still want to inspect the corresponding PKGBUILD/source changes for integrity, but based on this isolated .SRCINFO hunk the risk is minimal.

@@ -1,7 +1,7 @@
 pkgbase = 1password
 	pkgdesc = Password manager and secure wallet
-	pkgver = 8.12.28
-	pkgrel = 25
+	pkgver = 8.12.30
+	pkgrel = 21
 	url = https://1password.com
 	install = 1password.install
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO from 8.12.28 to 8.12.30, with corresponding checksum updates. The source remains the official 1password HTTPS download endpoint, and the PGP key pinning is unchanged. No new sources, scripts, build steps, or packaging metadata were introduced in this diff, so there is no evident security regression in the reviewed hunk.

@@ -9,11 +9,11 @@ pkgbase = 1password
 	conflicts = 1password-beta
 	conflicts = 1password-beta-bin
 	options = !strip
-	source = https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.12.28.x64.tar.gz
-	source = https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.12.28.x64.tar.gz.sig
+	source = https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.12.30.x64.tar.gz
+	source = https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.12.30.x64.tar.gz.sig
 	validpgpkeys = 3FEF9748469ADBE15DA7CA80AC2D62742012EA22
-	sha256sums = 2695d72e98c039f061fa8735608071a816616b4d88bb3725561411885dbd57a7
-	sha256sums = 86495194592296f943cc26e3592ee0688d61c33d651caf46edcec6688b6c29db
+	sha256sums = 8d9b8f750a3928fbdb62a37961716ade5004a8971c5a18ba44e14e4af8e25ae5
+	sha256sums = 6cf6a540f1017628d93bc5e990ae4ae22e6f2450c08e76564c75b6991d6e8689
 
 pkgname = 1password
 	depends = hicolor-icon-theme

Comment

The change is a routine upstream version bump for a proprietary binary package, with updated checksums for the tarball and signature. The source remains an HTTPS download from the official 1Password domain, and there are no new build-time commands, install-script changes, privilege escalations, or additional sources. The only notable packaging change is a pkgrel decrease, which is unusual but not a security issue by itself. No evidence of supply-chain tampering or malicious behavior in this diff.

@@ -1,9 +1,9 @@
 pkgname=1password
 
-_tarver=8.12.28
+_tarver=8.12.30
 _tar="1password-${_tarver}.x64.tar.gz"
 pkgver=${_tarver//-/_}
-pkgrel=25
+pkgrel=21
 conflicts=('1password-beta' '1password-beta-bin')
 pkgdesc="Password manager and secure wallet"
 arch=('x86_64')

Comment

The change is a routine upstream version bump for a proprietary binary package: it updates the tarball version from 8.12.28 to 8.12.30 and refreshes the SHA-256 checksums accordingly. The source still comes from the official 1Password HTTPS download endpoint, and the existing PGP key pinning remains unchanged. No new build steps, scripts, privilege changes, or additional sources were introduced in this diff. Risk is low, though as with any binary-only package the trust boundary remains upstream.

@@ -12,8 +12,8 @@ license=('LicenseRef-1Password-Proprietary')
 options=(!strip)
 install="1password.install"
 source=(https://downloads.1password.com/linux/tar/stable/${CARCH}/${_tar}{,.sig})
-sha256sums=('2695d72e98c039f061fa8735608071a816616b4d88bb3725561411885dbd57a7'
-            '86495194592296f943cc26e3592ee0688d61c33d651caf46edcec6688b6c29db'
+sha256sums=('8d9b8f750a3928fbdb62a37961716ade5004a8971c5a18ba44e14e4af8e25ae5'
+            '6cf6a540f1017628d93bc5e990ae4ae22e6f2450c08e76564c75b6991d6e8689'
 )
 validpgpkeys=('3FEF9748469ADBE15DA7CA80AC2D62742012EA22')