Add the 1Password repository as an approved third-party repository on Fedora Workstation #529
Labels
No labels
a11y
btrfs
Closed As
Can't fix
Closed As
Deferred to upstream
Closed As
Fixed
Closed As
Won't fix
default-apps
easyfix
experience
help-wanted
installation
meeting
meeting-request
nvidia
packaging
pending-action
qa
testing
user-docs
wg-docs
wg-meta
No milestone
No project
No assignees
4 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
workstation/tickets#529
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Hello!
I was wondering if you could add 1Password as an approved third-party repository in Fedora Workstation, so that it's easier for users to enable. 1Password already hosts a RHEL/Fedora repository, and has good Linux integration, but it is non-free.
It uses the key https://downloads.1password.com/linux/keys/1password.asc and the baseurl https://downloads.1password.com/linux/rpm/stable/$basearch
Currently, end users have to manually configure the repository or use Flatpak, where Flatpak has less features than the full-fledged desktop edition, some features you lose are: web-browser syncing, SSH keys, developer tools, OS unlocking, etc. They may also use Fyra Labs' Terra, who currently redistribute the package. This is a security risk as it's not coming from a trusted source, and packages could be modified downstream. For a program that holds all of your passwords, security needs to be strong. Exposing the 1Password repository would give a much easier and safer download path.
This wouldn't need Fedora to redistribute the package, the proposal is just to include the upstream repository config as an opt-in repository source.
Hm, this is proprietary software. Do we really need to promote proprietary software over open source options like Bitwarden or KeePass?
Even if it were open source, which it is not: I want fewer third-party repositories, not more.
Isn't that one of the points of the 3rd party repos? What are the criteria for inclusion?
Here are the criteria for inclusion.
@catanzaro wrote in #529 (comment):
I understand wanting fewer third-party repositories, but for some things, it's materially safer to have them. With 1Password, they do various types of contracts, people could be locked into Education or Business contracts, or yearly subscriptions. They also have really good security, using Secret Keys and such. From their own website, they list a figure of 200,000 businesses and millions of families (https://1password.com/pricing/personal). Now, when you mix a program designed to hold passwords, SSH keys and debit cards with third-party repositories like RPM Fusion (RPM Fusion don't currently package it, just an example. Terra does) or Fyra Labs' Terra, where they aren't owned by RHEL/Fedora's team nor anyone trusted, it becomes a bit of a security risk. I'd rather add the 3PR than someone being hacked due to a third-party repository packaging the same thing but with something slipped downstream.
For what it's worth, I am a user of 1Password, and I certainly would like having it available in the third party repositories.
The other options mentioned (KeePassXC and Bitwarden) have been packaged in Fedora already in some form. At least in the case of Bitwarden, we have
rbwandvaultwarden. KeePassXC has been in Fedora for some time. The official Bitwarden clients don't have YUM repositories to ship, though if someone wanted to package them for Fedora it probably could be done now that Electron is in Fedora.We voted today to include it, pending the repository being set up correctly (that is, it has AppStream repodata so it shows up in software centers). If it does not, I will attempt to reach out to 1Password and see if the technical blockers can be resolved.
(I want to note that I voted against this change.)
That’s amazing! Thanks!
@ngompa wrote in #529 (comment):