Review Results

Comment

The change is a routine version bump in .SRCINFO for the 1password package, updating the upstream tarball URL, signature URL, and checksums from 8.12.30 to 8.12.32. The source remains HTTPS on the official 1password domain, the package is still pinned to a specific release artifact, and there are no new build-time commands, scripts, or privilege-related changes in this diff. No security red flags are introduced by this metadata-only update.

@@ -1,7 +1,7 @@
 pkgbase = 1password
 	pkgdesc = Password manager and secure wallet
-	pkgver = 8.12.30
-	pkgrel = 21
+	pkgver = 8.12.32
+	pkgrel = 33
 	url = https://1password.com
 	install = 1password.install
 	arch = x86_64

Comment

The change only bumps the upstream 1Password tarball and its detached signature/checksums from 8.12.30 to 8.12.32. Sources remain HTTPS from the official 1password download domain, the package continues to use a pinned release tarball plus PGP signature verification, and there are no new build-time commands, install scripts, or packaging changes in this diff. No additional supply-chain or privilege-escalation risk is introduced by this metadata-only version update.

@@ -9,11 +9,11 @@ pkgbase = 1password
 	conflicts = 1password-beta
 	conflicts = 1password-beta-bin
 	options = !strip
-	source = https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.12.30.x64.tar.gz
-	source = https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.12.30.x64.tar.gz.sig
+	source = https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.12.32.x64.tar.gz
+	source = https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.12.32.x64.tar.gz.sig
 	validpgpkeys = 3FEF9748469ADBE15DA7CA80AC2D62742012EA22
-	sha256sums = 8d9b8f750a3928fbdb62a37961716ade5004a8971c5a18ba44e14e4af8e25ae5
-	sha256sums = 6cf6a540f1017628d93bc5e990ae4ae22e6f2450c08e76564c75b6991d6e8689
+	sha256sums = 760e3649034c4bbefedfddec0cfebac1e677dd55482a3390119c1a2bcda27d97
+	sha256sums = 49b450988b974c1c36874141bedfedfaec570d623d97e3822780e7ec8dcfcb97
 
 pkgname = 1password
 	depends = hicolor-icon-theme

Comment

The change is a routine upstream version bump for a proprietary binary package: it updates the tarball version from 8.12.30 to 8.12.32 and refreshes the corresponding SHA256 checksums. The source remains an HTTPS download from the official 1Password domain, with the signature file still included and the pinned PGP key unchanged. No new build-time network fetches, scripts, privilege changes, or packaging logic were introduced in this diff. The only notable oddity is the large pkgrel jump, but that is not a security issue by itself in the reviewed hunk.

@@ -1,9 +1,9 @@
 pkgname=1password
 
-_tarver=8.12.30
+_tarver=8.12.32
 _tar="1password-${_tarver}.x64.tar.gz"
 pkgver=${_tarver//-/_}
-pkgrel=21
+pkgrel=33
 conflicts=('1password-beta' '1password-beta-bin')
 pkgdesc="Password manager and secure wallet"
 arch=('x86_64')

Comment

The change is a routine upstream version bump for a proprietary binary package, with only the tarball and detached signature checksums updated. The source remains HTTPS from the official 1Password download domain, and the PKGBUILD still pins and verifies the release artifact with a valid PGP key. No new build steps, scripts, privileges, or install-time behaviors were introduced in this diff. Risk is low.

@@ -12,8 +12,8 @@ license=('LicenseRef-1Password-Proprietary')
 options=(!strip)
 install="1password.install"
 source=(https://downloads.1password.com/linux/tar/stable/${CARCH}/${_tar}{,.sig})
-sha256sums=('8d9b8f750a3928fbdb62a37961716ade5004a8971c5a18ba44e14e4af8e25ae5'
-            '6cf6a540f1017628d93bc5e990ae4ae22e6f2450c08e76564c75b6991d6e8689'
+sha256sums=('760e3649034c4bbefedfddec0cfebac1e677dd55482a3390119c1a2bcda27d97'
+            '49b450988b974c1c36874141bedfedfaec570d623d97e3822780e7ec8dcfcb97'
 )
 validpgpkeys=('3FEF9748469ADBE15DA7CA80AC2D62742012EA22')
 

Comment

The change only repoints three 1Password secret references from one vault/item namespace to another (`cgl-build-release-archlinux-aur-prod` -> `core-release-archlinux-aur-prod`). There is no code execution, no new network behavior, and no packaging logic change in the diff itself. The risk is limited to potential secret access/operational scope changes outside the package build, but based on the provided hunk alone this does not introduce a direct supply-chain or persistence issue in the AUR package.

@@ -1,3 +1,3 @@
-SSH_PRIVATE_KEY_B64 = "op://cgl-build-release-archlinux-aur-prod/AUR_SSH_PRIVATE_KEY_B64/credential"
-SSH_PASSPHRASE_B64 = "op://cgl-build-release-archlinux-aur-prod/AUR_SSH_PASSPHRASE_B64/credential"
-SSH_KNOWN_HOSTS = "op://cgl-build-release-archlinux-aur-prod/AUR_SSH_KNOWN_HOSTS/credential"
+SSH_PRIVATE_KEY_B64 = "op://core-release-archlinux-aur-prod/AUR_SSH_PRIVATE_KEY_B64/credential"
+SSH_PASSPHRASE_B64 = "op://core-release-archlinux-aur-prod/AUR_SSH_PASSPHRASE_B64/credential"
+SSH_KNOWN_HOSTS = "op://core-release-archlinux-aur-prod/AUR_SSH_KNOWN_HOSTS/credential"