Review Results

Comment

The change only bumps 1Password from 8.12.34 to 8.12.36 and updates the corresponding upstream tarball/signature URLs and checksums in .SRCINFO. The sources remain HTTPS on the official 1password.com download host, and there are no new build-time commands, scripts, or privilege-related changes in this diff. No security red flags are introduced by this metadata-only version bump.

@@ -1,7 +1,7 @@
 pkgbase = 1password
 	pkgdesc = Password manager and secure wallet
-	pkgver = 8.12.34
-	pkgrel = 34
+	pkgver = 8.12.36
+	pkgrel = 42
 	url = https://1password.com
 	install = 1password.install
 	arch = x86_64

Comment

The change is a routine upstream version bump in .SRCINFO for the 1password binary package. It keeps the official HTTPS download URL on the vendor domain, preserves the existing PGP verification key, and only updates the tarball/signature checksums to match the new release. No new sources, scripts, build steps, privilege changes, or packaging behavior are introduced in this diff. Based on the provided hunk alone, there are no security red flags.

@@ -9,11 +9,11 @@ pkgbase = 1password
 	conflicts = 1password-beta
 	conflicts = 1password-beta-bin
 	options = !strip
-	source = https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.12.34.x64.tar.gz
-	source = https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.12.34.x64.tar.gz.sig
+	source = https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.12.36.x64.tar.gz
+	source = https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.12.36.x64.tar.gz.sig
 	validpgpkeys = 3FEF9748469ADBE15DA7CA80AC2D62742012EA22
-	sha256sums = 297784aa66770b645607a7f04c9ba2c4aebed4f46d21202487f521ba572b7b13
-	sha256sums = ec085bef60de748895d3c51a8208301ba2ac8fb47db99334539ba4bd1d3260d7
+	sha256sums = 393c93c8025fee5dda76a4d0f1e478e98526cc946e58a22efe26f540ea2b5729
+	sha256sums = 251177694bfdc63c431021e2bd2ed64f241b8a0247d5dd1c46d4d2dadffe7b97
 
 pkgname = 1password
 	depends = hicolor-icon-theme

Comment

The change is a routine upstream version bump plus desktop-file path updates and refreshed checksums. The source remains HTTPS from the official 1Password download host, still pinned to a specific release tarball with a matching signature and valid PGP key. No new build-time network access, privilege escalation, or suspicious install-script behavior is introduced by this diff. The only notable risk in the package overall is the existing setuid chrome-sandbox handling, but that is unchanged here and documented as required by Electron. For this specific change, I see no new security issue.

@@ -1,9 +1,9 @@
 pkgname=1password
 
-_tarver=8.12.34
+_tarver=8.12.36
 _tar="1password-${_tarver}.x64.tar.gz"
 pkgver=${_tarver//-/_}
-pkgrel=34
+pkgrel=42
 conflicts=('1password-beta' '1password-beta-bin')
 pkgdesc="Password manager and secure wallet"
 arch=('x86_64')

Comment

The change only updates the pinned SHA-256 checksums for the upstream 1Password tarball and its detached signature. The source URL remains HTTPS and points to the official 1Password download host, with no new build steps, scripts, or packaging behavior introduced. I don't see any added execution, persistence, privilege escalation, or integrity regression in this diff. Risk is low because the only effect is accepting a new upstream release artifact.

@@ -12,8 +12,8 @@ license=('LicenseRef-1Password-Proprietary')
 options=(!strip)
 install="1password.install"
 source=(https://downloads.1password.com/linux/tar/stable/${CARCH}/${_tar}{,.sig})
-sha256sums=('297784aa66770b645607a7f04c9ba2c4aebed4f46d21202487f521ba572b7b13'
-            'ec085bef60de748895d3c51a8208301ba2ac8fb47db99334539ba4bd1d3260d7'
+sha256sums=('393c93c8025fee5dda76a4d0f1e478e98526cc946e58a22efe26f540ea2b5729'
+            '251177694bfdc63c431021e2bd2ed64f241b8a0247d5dd1c46d4d2dadffe7b97'
 )
 validpgpkeys=('3FEF9748469ADBE15DA7CA80AC2D62742012EA22')
 

Comment

The change is limited to installing a different desktop entry filename: `resources/com.onepassword.OnePassword.desktop` instead of `resources/1password.desktop`. This does not introduce new execution paths, network access, privilege escalation, or packaging hygiene issues by itself. I would want to inspect the new desktop file contents if it were part of the diff, but based on the provided hunk alone this is a low-risk metadata/path change.

@@ -31,7 +31,7 @@ package() {
             "${pkgdir}/usr/share/icons/hicolor/${resolution}/apps/1password.png"
     done
     # Install desktop file
-    install -Dm0644 resources/1password.desktop -t "${pkgdir}"/usr/share/applications/
+    install -Dm0644 resources/com.onepassword.OnePassword.desktop -t "${pkgdir}"/usr/share/applications/
 
     # Fill in policy kit file with a list of (the first 10) human users of the system.
     export POLICY_OWNERS

Comment

The change is a narrow packaging-path fix in PKGBUILD: it updates the cleanup list to remove the renamed desktop file `com.onepassword.OnePassword.desktop` instead of the old `1password.desktop`. This does not introduce new code execution, network access, privilege changes, or packaging behavior beyond deleting an extra file from the package payload. No security-relevant red flags are present in the diff hunk itself.

@@ -54,7 +54,7 @@ EOF" > ./com.1password.1Password.policy
     # Cleanup un-needed files
     rm "${pkgdir}"/opt/1Password/com.1password.1Password.policy "${pkgdir}"/opt/1Password/com.1password.1Password.policy.tpl "${pkgdir}"/opt/1Password/install_biometrics_policy.sh
     rm -r "${pkgdir}"/opt/1Password/resources/icons/
-    rm "${pkgdir}"/opt/1Password/resources/1password.desktop "${pkgdir}"/opt/1Password/resources/custom_allowed_browsers
+    rm "${pkgdir}"/opt/1Password/resources/com.onepassword.OnePassword.desktop "${pkgdir}"/opt/1Password/resources/custom_allowed_browsers
 
     # Symlink /usr/bin executable to opt
     install -dm0755 "${pkgdir}"/usr/bin