Skip to content
Frostyard docs

1Password CLI

The 1Password CLI extension adds the op command to a Frostyard bootc image. Use it to work with 1Password from a terminal or a script. Every image carries the extension’s definition, switched off. The extension itself is not in the image: Updex turns it on and downloads it.

Before you start

Section titled “Before you start”

You need:

  • A Frostyard bootc image. Every image built on Base has systemd-sysext and frostyard-updex.
  • Root access to enable, update, and remove the extension.
  • Network access to https://repository.frostyard.org/ext/1password-cli/.
  • Free space in /var for the image.

1Password CLI has no published test results on Frostyard images yet. Try it on a machine you can spare first.

Enable 1Password CLI

Section titled “Enable 1Password CLI”

See what Updex found, then enable the feature and download it now:

Terminal window
updex features list --component=1password-cli
sudo updex features enable 1password-cli --now

1password-cli appears as a component, with its feature disabled. The enable command downloads the image, checks its checksum and signature, links it, and refreshes the merge.

Check the merge and the command that the extension adds:

Terminal window
systemd-sysext status
command -v op

systemd-sysext status lists 1password-cli, and command -v op prints /usr/bin/op.

If enable --now exits with a refresh error (refresh_error in JSON), the download worked, but the activation did not. If the output says activation did not finish, the extension is merged, but users and groups can be missing: reboot. Otherwise the merge state is unknown: reboot. A sudo systemd-sysext refresh by hand does not create users and groups. Then run the checks above again.

Update, roll back, and remove

Section titled “Update, roll back, and remove”

Check for an update, then install it:

Terminal window
updex features check --component=1password-cli
sudo updex features update --component=1password-cli

Updex downloads and verifies the new image, switches the link, deletes older versions, and refreshes the merge. See Manage system extensions for --no-vacuum, --dry-run, and the update timer. The refresh swaps /usr under the running system.

Roll back with sudo updex features rollback 1password-cli. It takes effect at the next boot. See Roll back.

Remove 1Password CLI:

Terminal window
sudo updex features disable 1password-cli --now --force

Updex unmerges all extensions on the host, deletes the image, and merges the rest again. The op command goes. Reboot when the command finishes. Without --force, Updex refuses while the image is merged.

What ships

Section titled “What ships”
Item What you get
Package request 1password-cli
Command /usr/bin/op
Version The image file name carries the 1password-cli package version, plus a +rN snosi revision when one is set
Image file 1password-cli_<version>_<os>_<arch>.raw.zst; .raw.xz, .raw.gz, and .raw also work
Download From https://repository.frostyard.org/ext/1password-cli/, signature required (Verify=true), into /var/lib/extensions.d/
Services None

Each build checks that /usr/bin/op is present. A build without it fails.

See also

Section titled “See also”

Sources

Section titled “Sources”

Reviewed 2026-10-27; Updex facts reviewed 2026-10-30. snosi commit b2858ca0222814c395cf8248db98f3e096d57dc9; Updex v2.1.3 commit 2661e987faac986f2594d1d9bbbadf1bf3053f5b.