Skip to content
Frostyard docs

1Password desktop

The 1Password desktop extension adds the 1Password app to a Frostyard desktop image, with its browser-support helper and the op-ssh-sign Git signing helper. Use it when you want 1Password on a desktop image. Every image carries the extension’s definition, switched off. The extension itself is not in the image: Updex turns it on and downloads it.

Before you start

Section titled “Before you start”

You need:

  • A Frostyard desktop bootc image: Snow, Snowfield, or Sundog, not Floe.
  • Root access to enable, update, and remove the extension.
  • Network access to https://repository.frostyard.org/ext/1password/.
  • Free space in /var for the download and the installed image.

The 1Password desktop extension has no published test results on Frostyard images yet. Try it on a machine you can spare first.

Enable 1Password desktop

Section titled “Enable 1Password desktop”

See what Updex found, then enable the feature and download it now:

Terminal window
updex features list --component=1password
sudo updex features enable 1password --now

1password appears as a component, with its feature disabled. The enable command downloads the image, checks its checksum and signature, links it, and refreshes the merge.

Check the merge and the files that the extension adds:

Terminal window
systemd-sysext status
command -v 1password op-ssh-sign
ls /usr/share/applications/1password.desktop

systemd-sysext status lists 1password. Each name prints a path, and ls prints the launcher file.

If enable --now exits with a refresh error (refresh_error in JSON), the download worked, but the activation did not. If the output says activation did not finish, the extension is merged, but users and groups can be missing: reboot. Otherwise the merge state is unknown: reboot. A sudo systemd-sysext refresh by hand does not create users and groups. Then run the checks above again.

Use 1Password desktop

Section titled “Use 1Password desktop”

Start 1Password from your applications, or run 1password.

The extension adds two groups: onepassword (GID 1936) and onepassword-mcp (GID 1938). They are created at boot, and by a refresh from Updex v2.1.3 and later. The browser-support helper and the 1password-mcp helper run with these groups.

The polkit policy that the extension ships names the onepassword group as its owner. Members of that group get the system authentication integration for the 1Password command line and the SSH agent.

To join the group, run:

Terminal window
sudo usermod -aG onepassword "$USER"

Then sign out and sign in again. id lists onepassword after you sign in.

The extension copies custom_allowed_browsers into /etc/1password/ from /usr/share/factory/etc/1password at boot, and on a refresh by Updex v2.1.3 and later. Edit the copy in /etc to change which browsers 1Password allows.

Update, roll back, and remove

Section titled “Update, roll back, and remove”

See whether a newer image exists, then update:

Terminal window
updex features check --component=1password
sudo updex features update --component=1password

The update downloads the newest image and links it. A refresh replaces /usr under a running app, and a running app can fail. Close 1Password desktop before you run updex features update, or update with --no-refresh and reboot. See Manage system extensions for the check output and the update timer.

Roll back with sudo updex features rollback 1password. It takes effect at the next boot. See Roll back.

Remove 1Password desktop now:

Terminal window
sudo updex features disable 1password --now --force

Updex unmerges all extensions on the host, deletes the 1Password desktop image, and merges the rest again. Your 1Password data stays in your home directory. Reboot when the command finishes. Without --force, Updex refuses while the image is merged.

What ships

Section titled “What ships”
Item What you get
Package requests The 1Password .deb (a pinned download), plus curl, gnupg2, libasound2, libatk-bridge2.0-0, libatk1.0-0, libcurl4, libdrm2, libgbm1, libgtk-3-0, libnotify4, libnss3, libxcb-shape0, libxcb-xfixes0, libxshmfence1, libudev1, and xdg-utils
Version The image file name carries the 1password version, plus a +rN snosi revision when one is set
Command and launcher /usr/bin/1password, /usr/bin/op-ssh-sign, and /usr/share/applications/1password.desktop
Groups onepassword (GID 1936) and onepassword-mcp (GID 1938), created at boot after the merge, or by a refresh from Updex v2.1.3 and later
Files in /etc /etc/1password/custom_allowed_browsers, copied from /usr/share/factory/etc/1password at boot, or by a refresh from Updex v2.1.3 and later
Polkit A system-authentication policy that names the onepassword group as owner
Services None
Image file 1password_<version>_<os>_<arch>.raw.zst; .raw.xz, .raw.gz, and .raw also work
Download From https://repository.frostyard.org/ext/1password/, signature required (Verify=true), into /var/lib/extensions.d/

Each build checks that these paths are present: the 1Password binary, the sandbox helper, the browser-support helper, the two /usr/bin links, the launcher and icon, the sysusers and tmpfiles files, the factory custom_allowed_browsers file, and the polkit policy. A build that is missing one fails.

See also

Section titled “See also”

Sources

Section titled “Sources”

Reviewed 2026-10-27; Updex facts reviewed 2026-10-30. snosi commit b2858ca0222814c395cf8248db98f3e096d57dc9; Updex v2.1.3 commit 2661e987faac986f2594d1d9bbbadf1bf3053f5b.