1password-cli 2.41.1-1
seededverified· maintained by slurpee· custom
1Password command line tool
Pinned to revision
cb119bdd3bd2
(not head) · back to headshelly install aur 1password-cli --aur-url https://atoll.seafoam-labs.org
This can be permanently set in the shelly
config.json file.
git clone https://atoll.seafoam-labs.org/packages/1password-cli.git
Served Git SHAs are synthesized by Atoll when it commits stored revisions - they do not match
upstream AUR.
/v1/packages/1password-cli/versions SHAs are authoritative.
Metadata
Relations
Security
Revision scans
| Revision | Status | Scanned | Findings |
|---|---|---|---|
| 4cd1ceb66de7head | verified | 2026-11-05 16:10 | 4 |
| cb119bdd3bd2 | verified | 2026-11-05 16:18 | 4 |
| 19fc66341c86 | verified | 2026-11-05 16:02 | 4 |
Revision findings
medium
command-substitution
in
1password-cli.installDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
if [ $(getent group onepassword-cli) ]; then
medium
variable-indirection
in
package-update.shBash indirect variable expansion - the referenced variable is resolved at runtime and cannot be statically resolved.
for a in "${!arch[@]}"; domedium
risky-tool
in
package-update.sh'wget' is invoked - this fetches/executes external code outside alpm's control.
wget -q https://cache.agilebits.com/dist/1P/op2/pkg/v"${PKGVER}"/op_linux_"${_arch[a]}"_v"${PKGVER}".zipmedium
command-substitution
in
package-update.shDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
sha256=$(sha256sum op_linux_"${_arch[a]}"_v"${PKGVER}".zip | awk '{print $1}')Findings below High severity are retained for review but do not block serving. Verified means no obvious red flags from static analysis - never a guarantee that a package is safe.