Review Results

Comment

The change is a straightforward version bump in .SRCINFO for the 1password package, updating the upstream tarball URL, signature URL, and checksums to 8.12.44. The source remains HTTPS on the official 1password download domain, and there are no new build steps, scripts, or packaging changes introduced here. No security issues are evident in this diff alone.

@@ -1,7 +1,7 @@
 pkgbase = 1password
 	pkgdesc = Password manager and secure wallet
-	pkgver = 8.12.42
-	pkgrel = 36
+	pkgver = 8.12.44
+	pkgrel = 33
 	url = https://1password.com
 	install = 1password.install
 	arch = x86_64

Comment

The change is a straightforward version bump of the upstream 1Password tarball and its detached signature, with updated SHA-256 checksums. Sources remain HTTPS from the official 1password download domain, the package still uses the same pinned PGP key, and there are no new build-time commands, scripts, or packaging behaviors introduced in this .SRCINFO-only diff. No obvious supply-chain or persistence risk is added by this metadata update alone.

@@ -9,11 +9,11 @@ pkgbase = 1password
 	conflicts = 1password-beta
 	conflicts = 1password-beta-bin
 	options = !strip
-	source = https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.12.42.x64.tar.gz
-	source = https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.12.42.x64.tar.gz.sig
+	source = https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.12.44.x64.tar.gz
+	source = https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.12.44.x64.tar.gz.sig
 	validpgpkeys = 3FEF9748469ADBE15DA7CA80AC2D62742012EA22
-	sha256sums = 2ce64d1bd53dd6fd4408739a079d10be01aff35cb4e8eaeca3dc9b7c6a8418de
-	sha256sums = 150a33bbf59b0b07afd9aca43b129f7f7ba60964ccc314f07cccff90456cbb18
+	sha256sums = de23d2601971eb3bd125787b963ce00e67d28907e826ddd12f77c98785140785
+	sha256sums = 451b9ab85daf968ef23c7105fb185672cf617e1dc1305605b44e7eaef9cbbb75
 
 pkgname = 1password
 	depends = hicolor-icon-theme

Comment

The change only bumps the upstream 1Password release tarball from 8.12.42 to 8.12.44 and updates the corresponding SHA256 checksums. No new sources, build steps, scripts, or packaging logic were introduced, and the package still uses the same pinned HTTPS download and PGP verification. The pkgrel decrease is unusual but not a security issue by itself. Based on the diff provided, there are no new red flags in this change.

@@ -1,9 +1,9 @@
 pkgname=1password
 
-_tarver=8.12.42
+_tarver=8.12.44
 _tar="1password-${_tarver}.x64.tar.gz"
 pkgver=${_tarver//-/_}
-pkgrel=36
+pkgrel=33
 conflicts=('1password-beta' '1password-beta-bin')
 pkgdesc="Password manager and secure wallet"
 arch=('x86_64')

Comment

The change only updates the packaged upstream release from 8.12.42 to 8.12.44 and refreshes the corresponding SHA256 checksums for the tarball and signature. The source remains the official HTTPS 1Password download endpoint, with the same pinned PGP key verification. No build logic, install script, permissions, or additional sources were changed. This looks like a routine version bump with no evident security regression in the diff provided.

@@ -12,8 +12,8 @@ license=('LicenseRef-1Password-Proprietary')
 options=(!strip)
 install="1password.install"
 source=(https://downloads.1password.com/linux/tar/stable/${CARCH}/${_tar}{,.sig})
-sha256sums=('2ce64d1bd53dd6fd4408739a079d10be01aff35cb4e8eaeca3dc9b7c6a8418de'
-            '150a33bbf59b0b07afd9aca43b129f7f7ba60964ccc314f07cccff90456cbb18'
+sha256sums=('de23d2601971eb3bd125787b963ce00e67d28907e826ddd12f77c98785140785'
+            '451b9ab85daf968ef23c7105fb185672cf617e1dc1305605b44e7eaef9cbbb75'
 )
 validpgpkeys=('3FEF9748469ADBE15DA7CA80AC2D62742012EA22')