1password-cli & app interaction issues

[ThePhatLeee]

1password-cli OP files should be located on /usr/local/bin, but i cant see those since bin is empty and that might be issue why cli and app cant talk. i see op config on correct place

[travier]

We can not place things in /usr/local. Why should files be there?

[ThePhatLeee]

I check 1password-cli integration info and that is default place where it is installed it works if I don't have 1password app I can add manually account to cli, but when I install app cli won't work OP is there still Sent from Proton Mail Android

…

-------- Original Message --------

On 25/06/2025 14.00, Timothée Ravier wrote: travier left a comment [(travier/fedora-sysexts#135)](https://github.com/travier/fedora-sysexts/issues/135#issuecomment-3004355539) We can not place things in /usr/local. Why should files be there? — Reply to this email directly, [view it on GitHub](https://github.com/travier/fedora-sysexts/issues/135#issuecomment-3004355539), or [unsubscribe](https://github.com/notifications/unsubscribe-auth/BS7UPL7NYOYPRWJVMXNMFND3FJ6LRAVCNFSM6AAAAAB77UB7IWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTAMBUGM2TKNJTHE). You are receiving this because you authored the thread.Message ID: ***@***.***>

[travier]

I'm sorry I don't understand your comments and your issue. You will have to give more context and maybe some steps to reproduce the issue.

[ThePhatLeee]

Sorry for that

First if I have only 1password-cli installed and type op vault list it asks me to sign in to my 1password account. This is just CLI usage and it works all secrets are working.

Second I install 1password app and sign in to that it works, but when I type op vault list it can't find app or CLI giving this error

phatle@Silverblue:~$ op vault list
[ERROR] 2025/05/21 12:02:39 connecting to desktop app: read: connection reset, make sure 1Password CLI
is installed correctly, then open the 1Password app, select 1Password > Settings > Developer and make
sure the 'Integrate with 1Password CLI' setting is turned on. If you're still having trouble connecting,
visit https://developer.1password.com/docs/cli/app-integration#troubleshooting for more help.

There I was following the link given on error and that made me put this issue since couldn't find the OP on the path it states. So issue is just talk/xdg-portal side since it can't talk to app

[travier]

It looks like 1password is not open source so I can not find the code to figure out what it needs.

From reading the docs, it looks like it may setup some polkit rules / actions and some daemon maybe? That's where I would start looking.

[ThePhatLeee]

this is for now what i see when starting from terminal

ERROR 2025-06-29T09:06:52.345+00:00 [1P] no application groups existed on the system INFO 2025-06-29T09:06:52.346+00:00 [1P] Extension connecting. ERROR 2025-06-29T09:06:52.346+00:00 [1P] Failed to accept new connection.: PipeAuthError(NoCreds) ERROR 2025-06-29T09:07:16.312+00:00 [1P] no application groups existed on the system INFO 2025-06-29T09:07:16.312+00:00 [1P] Extension connecting. ERROR 2025-06-29T09:07:16.312+00:00 [1P] Failed to accept new connection.: PipeAuthError(NoCreds) ERROR 2025-06-29T09:09:16.182+00:00 [1P] no application groups existed on the system INFO 2025-06-29T09:09:16.182+00:00 [1P] Extension connecting. ERROR 2025-06-29T09:09:16.182+00:00 [1P] Failed to accept new connection.: PipeAuthError(NoCreds) ERROR 2025-06-29T09:12:53.657+00:00 [1P] no application groups existed on the system INFO 2025-06-29T09:12:53.657+00:00 [1P] Extension connecting. ERROR 2025-06-29T09:12:53.657+00:00 [1P] Failed to accept new connection.: PipeAuthError(NoCreds) INFO 2025-06-29T09:16:36.023+00:00 [1P] Front end event: window closed ERROR 2025-06-29T09:16:47.654+00:00 [1P] no application groups existed on the system INFO 2025-06-29T09:16:47.654+00:00 [1P] Extension connecting. ERROR 2025-06-29T09:16:47.654+00:00 [1P] Failed to accept new connection.: PipeAuthError(NoCreds)

there is also this one

ERROR 2025-06-29T09:18:22.096+00:00 [1P] Error creating system vault for account (xxxxxxxxxxxxxxxxx): FetchDataError(FetchError(<unknown reason>, code: HttpStatus(400), Session ID: Some(Session ID: xxxxxxxxxxxxxxxxxx)))

[travier]

[1P] no application groups existed on the system

Does the package create a group in its scriptlets? Can you dump the scripts from this package?

[ThePhatLeee]

I will check if I can find everything and then dumb here might be tomorrow or late night today Sent from Proton Mail Android

…

-------- Original Message --------

On 29/06/2025 14.05, Timothée Ravier wrote: travier left a comment [(travier/fedora-sysexts#135)](https://github.com/travier/fedora-sysexts/issues/135#issuecomment-3016594179) [1P] no application groups existed on the system Does the package create a group in its scriptlets? Can you dump the scripts from this package? — Reply to this email directly, [view it on GitHub](https://github.com/travier/fedora-sysexts/issues/135#issuecomment-3016594179), or [unsubscribe](https://github.com/notifications/unsubscribe-auth/BS7UPL4IYSXDB7XFTXHGVST3F7B6RAVCNFSM6AAAAAB77UB7IWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTAMJWGU4TIMJXHE). You are receiving this because you authored the thread.Message ID: ***@***.***>

[ThePhatLeee]

this is what i now have found on 1password-cli installer script will try to extract 1password.rpm if i can find more info

ARCH="<choose between 386/amd64/arm/arm64>" && \ wget "https://cache.agilebits.com/dist/1P/op2/pkg/v2.31.1/op_linux_${ARCH}_v2.31.1.zip" -O op.zip && \ unzip -d op op.zip && \ sudo mv op/op /usr/local/bin/ && \ rm -r op.zip op && \ sudo groupadd -f onepassword-cli && \ sudo chgrp onepassword-cli /usr/local/bin/op && \ sudo chmod g+s /usr/local/bin/op

[travier]

You can use https://stackoverflow.com/questions/5616668/view-rpm-scripts-with-rpm-scripts-qp to get the scriptlets from an RPM.

[travier]

sudo groupadd -f onepassword-cli && \
    sudo chgrp onepassword-cli /usr/local/bin/op && \
    sudo chmod g+s /usr/local/bin/op

OK, that definitely looks like something that could matter here. Unfortunately, we can not easily do that kind of things in sysexts. We might have to allocate a static UID/GID for this using userdb JSON static records.

[ThePhatLeee]

this is full output from 1password-latest.rpm

phatle@kinoite:/var/home/phatle/Downloads$ rpm  -qlp --scripts 1password-latest.rpm 
warning: 1password-latest.rpm: Header V4 RSA/SHA512 Signature, key ID 2012ea22: NOKEY
postinstall scriptlet (using /bin/sh):
#!/bin/sh
set -eu

CHANNEL="stable"
PLATFORM="rpm"
  
# This script requires a header.

ONEPASSWORD_KEY_URL="https://downloads.1password.com/linux/keys/1password.asc"

installDebChannel() {
  echo "Installing the debian auto-update channel"
  # XXXX: Commands reaching out over the network output into a tempfile and move into the final
  #       location once we know everything is ok. This avoids breaking existing installs if the
  #       network is lost or we deploy a change while a client is applying their downloaded update.
  #       If a client hits this condition, apt will report that there was an error but should
  #       succeed the next time the update is installed (if the network is back up).
  TEMPDIR=$(mktemp -d)
  curl -fsS "$ONEPASSWORD_KEY_URL" | gpg --dearmor --output "$TEMPDIR/1password.gpg"
  curl -fsSo "$TEMPDIR/1password.pol" https://downloads.1password.com/linux/debian/debsig/1password.pol

  # Setup apt repository
  cp "$TEMPDIR/1password.gpg" /usr/share/keyrings/1password-archive-keyring.gpg
  cat > /etc/apt/sources.list.d/1password.list <<-EOM
# This file is automatically added and configured by the 1Password package. Modifications may be overwritten.
deb [arch=amd64 signed-by=/usr/share/keyrings/1password-archive-keyring.gpg] https://downloads.1password.com/linux/debian/amd64 ${CHANNEL} main
EOM
  # Setup debsig verification
  mkdir -p /etc/debsig/policies/AC2D62742012EA22/
  mv "$TEMPDIR/1password.pol" /etc/debsig/policies/AC2D62742012EA22/1password.pol

  mkdir -p /usr/share/debsig/keyrings/AC2D62742012EA22/
  mv "$TEMPDIR/1password.gpg" /usr/share/debsig/keyrings/AC2D62742012EA22/debsig.gpg

  rm -rf "$TEMPDIR"
}

installRpmChannel() {
  case $CHANNEL in
    "stable")
      NAME="1Password Stable Channel"
      ;;

    "beta")
      NAME="1Password Beta Channel"
      ;;

    "edge")
      NAME="1Password Edge Channel"
      ;;

    *)
      NAME="1Password"
      ;;
  esac

  # repo_gpgcheck is disabled(system default)
  # This is due to DNF not using keys that have been imported.
  # Package signatures are still verified due to gpgcheck=1
  # https://bugzilla.redhat.com/show_bug.cgi?id=1768206
  if [ -d /etc/yum.repos.d ]; then
    cat > /etc/yum.repos.d/1password.repo <<- EOM
# This file is automatically added and configured by the 1Password package. Modifications may be overwritten.
[1password]
name="$NAME"
baseurl=https://downloads.1password.com/linux/rpm/${CHANNEL}/\$basearch
enabled=1
gpgcheck=1
#repo_gpgcheck=1
gpgkey="$ONEPASSWORD_KEY_URL"
EOM
  fi

  if [ -d /etc/zypp ]; then
    cat > /etc/zypp/repos.d/1password.repo <<- EOM
# This file is automatically added and configured by the 1Password package. Modifications may be overwritten.
[1password]
name="$NAME"
baseurl=https://downloads.1password.com/linux/rpm/${CHANNEL}/\$basearch
enabled=1
gpgcheck=1
autorefresh=1
#repo_gpgcheck=1
gpgkey=$ONEPASSWORD_KEY_URL
EOM
  fi
}

installAutoupdateChannel() {
  if [ "$PLATFORM" = "rpm" ]; then
    installRpmChannel
  elif [ "$PLATFORM" = "deb" ]; then
    installDebChannel
  fi
}

installFiles() {
  CWD=$(pwd)
  cd /opt/1Password/

  # Fill in policy kit file with a list of (the first 10) human users of the system.
  export POLICY_OWNERS
  POLICY_OWNERS="$(cut -d: -f1,3 /etc/passwd | grep -E ':[0-9]{4}$' | cut -d: -f1 | head -n 10 | sed 's/^/unix-user:/' | tr '\n' ' ')"
  eval "cat <<EOF
$(cat ./com.1password.1Password.policy.tpl)
EOF" > ./com.1password.1Password.policy

  # Install policy kit file for system unlock
  install -Dm0644 ./com.1password.1Password.policy -t /usr/share/polkit-1/actions/

  # Install examples
  install -Dm0644 ./resources/custom_allowed_browsers -t /usr/share/doc/1password/examples/

  # chrome-sandbox requires the setuid bit to be specifically set.
  # See https://github.com/electron/electron/issues/17972
  chmod 4755 ./chrome-sandbox

  GROUP_NAME="onepassword"

  # Setup the Core App Integration helper binary with the correct permissions and group
  if [ ! "$(getent group "${GROUP_NAME}")" ]; then
    groupadd "${GROUP_NAME}"
  fi

  BROWSER_SUPPORT_PATH="./1Password-BrowserSupport"

  # This gives no extra permissions to the binary. It only hardens it against environmental tampering.
  chgrp "${GROUP_NAME}" $BROWSER_SUPPORT_PATH
  chmod g+s $BROWSER_SUPPORT_PATH

  # Add .desktop file and icons for .tar.gz installs
  if [ $PLATFORM = "tar" ]; then
    if [ -d /usr/share/applications ]; then
      # xdg-desktop-menu will only be available if xdg-utils is installed, which is likely but not guaranteed
      if [ -n "$(which xdg-desktop-menu)" ]; then
        xdg-desktop-menu install --mode system --novendor ./resources/1password.desktop
      else
        install -m0644 ./resources/1password.desktop /usr/share/applications
      fi
    fi
    if [ -d /usr/share/icons ]; then
      cp -rf ./resources/icons/* /usr/share/icons/
      # Update theme mtime to indicate update
      touch /usr/share/icons/hicolor
    fi
  fi

  # Restore previous directory
  cd "$CWD"

  # Register path symlink
  ln -sf /opt/1Password/1password /usr/bin/1password
}

if [ "$(id -u)" -ne 0 ]; then
  echo "You must be running as root to run 1Password's post-installation process"
  exit
fi

installFiles
installAutoupdateChannel

exit 0
postuninstall scriptlet (using /bin/sh):
#!/bin/sh
set -eu

CHANNEL="stable"
PLATFORM="rpm"
  
# This script requires a header.

# https://wiki.debian.org/MaintainerScripts
# https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/

if [ "$(id -u)" -ne 0 ]; then
  echo "You must be running as root to run 1Password's post-uninstallation process"
  exit
fi

if [ "$PLATFORM" = "rpm" ] && [ "${1:-0}" -gt 0 ]; then
  # RPM Upgrade in progress, keep existing files.
  # This script is run from the old version
  # after the post install has run on the new version.
  exit
fi

# Remove policy kit file for system unlock
rm -f /usr/share/polkit-1/actions/com.1password.1Password.policy
# Remove docs
rm -rf /usr/share/doc/1password

# Clean up desktop icon
if [ $PLATFORM = "tar" ]; then
  if [ -n "$(which xdg-desktop-menu)" ]; then
    xdg-desktop-menu uninstall --mode system 1password.desktop
  else
    rm -f /usr/share/applications/1password.desktop
  fi
  rm -f /usr/share/icons/hicolor/*/apps/1password.png
fi

# Cleanup symlink
rm -f /usr/bin/1password

exit 0
/opt/1Password/1Password-BrowserSupport
/opt/1Password/1Password-Crash-Handler
/opt/1Password/1Password-LastPass-Exporter
/opt/1Password/1password
/opt/1Password/LICENSE.electron.txt
/opt/1Password/LICENSES.chromium.html
/opt/1Password/after-install.sh
/opt/1Password/after-remove.sh
/opt/1Password/chrome-sandbox
/opt/1Password/chrome_100_percent.pak
/opt/1Password/chrome_200_percent.pak
/opt/1Password/chrome_crashpad_handler
/opt/1Password/com.1password.1Password.policy.tpl
/opt/1Password/icudtl.dat
/opt/1Password/install_biometrics_policy.sh
/opt/1Password/libEGL.so
/opt/1Password/libGLESv2.so
/opt/1Password/libffmpeg.so
/opt/1Password/libvk_swiftshader.so
/opt/1Password/libvulkan.so.1
/opt/1Password/locales/af.pak
/opt/1Password/locales/am.pak
/opt/1Password/locales/ar.pak
/opt/1Password/locales/bg.pak
/opt/1Password/locales/bn.pak
/opt/1Password/locales/ca.pak
/opt/1Password/locales/cs.pak
/opt/1Password/locales/da.pak
/opt/1Password/locales/de.pak
/opt/1Password/locales/el.pak
/opt/1Password/locales/en-GB.pak
/opt/1Password/locales/en-US.pak
/opt/1Password/locales/es-419.pak
/opt/1Password/locales/es.pak
/opt/1Password/locales/et.pak
/opt/1Password/locales/fa.pak
/opt/1Password/locales/fi.pak
/opt/1Password/locales/fil.pak
/opt/1Password/locales/fr.pak
/opt/1Password/locales/gu.pak
/opt/1Password/locales/he.pak
/opt/1Password/locales/hi.pak
/opt/1Password/locales/hr.pak
/opt/1Password/locales/hu.pak
/opt/1Password/locales/id.pak
/opt/1Password/locales/it.pak
/opt/1Password/locales/ja.pak
/opt/1Password/locales/kn.pak
/opt/1Password/locales/ko.pak
/opt/1Password/locales/lt.pak
/opt/1Password/locales/lv.pak
/opt/1Password/locales/ml.pak
/opt/1Password/locales/mr.pak
/opt/1Password/locales/ms.pak
/opt/1Password/locales/nb.pak
/opt/1Password/locales/nl.pak
/opt/1Password/locales/pl.pak
/opt/1Password/locales/pt-BR.pak
/opt/1Password/locales/pt-PT.pak
/opt/1Password/locales/ro.pak
/opt/1Password/locales/ru.pak
/opt/1Password/locales/sk.pak
/opt/1Password/locales/sl.pak
/opt/1Password/locales/sr.pak
/opt/1Password/locales/sv.pak
/opt/1Password/locales/sw.pak
/opt/1Password/locales/ta.pak
/opt/1Password/locales/te.pak
/opt/1Password/locales/th.pak
/opt/1Password/locales/tr.pak
/opt/1Password/locales/uk.pak
/opt/1Password/locales/ur.pak
/opt/1Password/locales/vi.pak
/opt/1Password/locales/zh-CN.pak
/opt/1Password/locales/zh-TW.pak
/opt/1Password/op-ssh-sign
/opt/1Password/resources.pak
/opt/1Password/resources/1password.desktop
/opt/1Password/resources/app.asar
/opt/1Password/resources/app.asar.unpacked/CREDITS.html
/opt/1Password/resources/app.asar.unpacked/index.node
/opt/1Password/resources/apparmor-profile
/opt/1Password/resources/custom_allowed_browsers
/opt/1Password/resources/icons/hicolor/256x256/apps/1password.png
/opt/1Password/resources/icons/hicolor/32x32/apps/1password.png
/opt/1Password/resources/icons/hicolor/512x512/apps/1password.png
/opt/1Password/resources/icons/hicolor/64x64/apps/1password.png
/opt/1Password/snapshot_blob.bin
/opt/1Password/v8_context_snapshot.bin
/opt/1Password/vk_swiftshader_icd.json
/usr/share/applications/1password.desktop
/usr/share/icons/hicolor/128x128/apps/1password.png
/usr/share/icons/hicolor/16x16/apps/1password.png
/usr/share/icons/hicolor/256x256/apps/1password.png
/usr/share/icons/hicolor/32x32/apps/1password.png
/usr/share/icons/hicolor/48x48/apps/1password.png
/usr/share/icons/hicolor/512x512/apps/1password.png
/usr/share/icons/hicolor/64x64/apps/1password.png
phatle@kinoite:/var/home/phatle/Downloads$ 

[travier]

Ah, this is similar to https://github.com/travier/fedora-sysexts/issues/72. You will have to setup some of those things manually on your system (polkit action, groups, etc.) as it's not easy to do via the sysext. See the discussion there.