ib-tws
maintainer bpa
· 43 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The package downloads a standalone installer from Interactive Brokers' official domain, which is the project's legitimate source; the download host, while not on a standard whitelist, is plausibly official and the installer is a standard part of the build process, not an obfuscated or malicious payload.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a standalone installer from Interactive Brokers' official domain, which is the project's legitimate source; the download host, while not on a standard whitelist, is plausibly official and the installer is a standard part of the build process, not an obfuscated or malicious payload.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:25
"tws-${pkgver}-standalone-linux-x64.sh"::'https://download2.interactivebrokers.com/installers/tws/latest-standalone/tws-latest-standalone-linux-x64.sh')
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Ben Alex <ben.alex@acegi.com.au>
2
# Contributor: Jon Wiersma <archaur@jonw.org>
3
# Contributor: bgh <aur at bgh dot io>
4
5
pkgname=ib-tws
6
pkgver=10.49.1c
7
pkgrel=1
8
epoch=1
9
pkgdesc='Electronic trading platform from discount brokerage firm Interactive Brokers (IBKR)'
10
arch=('x86_64')
11
url="http://interactivebrokers.com/"
12
license=('custom')
13
backup=('etc/ib-tws.conf' 'etc/ib-gw.conf')
14
depends=(alsa-lib at-spi2-core bash cairo fontconfig freetype2 ttf-dejavu ttf-liberation gcc-libs gdk-pixbuf2 glib2 glibc gtk3 libgl libx11 libxext libxi libxrender libxtst libxxf86vm pango)
15
optdepends=(ffmpeg3.4)
16
makedepends=(libarchive findutils sed)
17
18
source=('LICENSE'
19
'ib-tws'
20
'ib-tws.conf'
21
'ib-tws.desktop'
22
'ib-gw'
23
'ib-gw.conf'
24
'ib-gw.desktop'
25
"tws-${pkgver}-standalone-linux-x64.sh"::'https://download2.interactivebrokers.com/installers/tws/latest-standalone/tws-latest-standalone-linux-x64.sh')
26
sha256sums=('4b65b33dc88d77fef6e7ba1bdc1ae88b149296d3e1eb87db251bfcdf119a1f22'
27
'a04249976b99b9446fa666872be251ea5532beab9655c2801841de1af2bcab99'
28
'b359c8b5ccc7d884316ba9c88395450ff3a5dfd6af376741f091f837a5db7c26'
29
'3a45eb7d43c0b7be2babc3fb0c83d723db2676eb1b608ecefc2f1415be8d7a62'
30
'467980a76c604f0e5932c234ff7b81d3e71f5d7ba3ace5e0a8740e2579b6d1f6'
31
'21070fa89c9053dff06ba799b6f9838bfd5ff209fd8dd710c5a97c3fc684af44'
32
'9f74a204c45d47f551861cb231de89f2536f9966942da41f95d8f0ce5bcd13a4'
33
'591ee70484956f2182cb6432a0e115b12870c22f57bcf7bbefa1995f33522c5f')
34
35
build() {
36
cd ${srcdir}
37
rm -rf ${srcdir}/target ${srcdir}/jre ${srcdir}/*.jar
38
mkdir ${srcdir}/target ${srcdir}/jre
39
40
chmod +x tws-${pkgver}-standalone-linux-x64.sh
41
./tws-${pkgver}-standalone-linux-x64.sh -q -dir ${srcdir}/target
42
43
echo "Attempting to locate the Install4J-compatible Java installation"
44
if grep -q -e "Install file.*/java;" ${srcdir}/target/.install4j/installation.log; then
45
echo "Installer script indicates Java was installed by Install4j; finding log entry for full path"
46
BUNDLED_JRE_LOCATION=$(grep -e "Install file.*/java;" ${srcdir}/target/.install4j/installation.log | head -n 1 | cut -d ';' -f 1|sed -e 's/ .*Install file\: //g'|sed 's/\/bin\/java//')
47
if [ -z "${BUNDLED_JRE_LOCATION}" ]; then
48
echo "Could not find bundled JRE installation entry in Install4J log; unable to proceed"
49
exit 1
50
fi
51
echo "Java installed by Install4J at ${BUNDLED_JRE_LOCATION}"
52
else
53
echo "Install4J log did not install Java; attempting to locate a previous Java installation it re-used"
54
LOG_JRE_LOCATION=$(grep java.home ${srcdir}/target/.install4j/installation.log | head -n 1 | cut -d '=' -f 2 | sed 's/\.\.\.//g')
55
if [ -z "${LOG_JRE_LOCATION}" ]; then
56
echo "Install4J log did not provide a java.home; unable to proceed"
57
exit 1
58
fi
59
echo "Previous Install4J-installed Java reported in log as ${LOG_JRE_LOCATION}"
60
CANONICALIZED_JRE_LOCATION=$(echo ${LOG_JRE_LOCATION}*)
61
echo "Canonicalized path resolved to ${CANONICALIZED_JRE_LOCATION}"
62
FIND_OUTPUT=$(find ${CANONICALIZED_JRE_LOCATION} -path '*/bin/java' | head -n 1)
63
echo "Search for Java result: $FIND_OUTPUT"
64
BUNDLED_JRE_LOCATION=$(echo ${FIND_OUTPUT} | sed 's/\(.*\)\/bin\/java/\1/')
65
echo "Final Java installation directory resolved to ${BUNDLED_JRE_LOCATION}"
66
fi
67
if [ -f "${BUNDLED_JRE_LOCATION}/bin/java" ]; then
68
echo "Confirmed java in ${BUNDLED_JRE_LOCATION}"
69
else
70
echo "Cannot find java; last tried ${BUNDLED_JRE_LOCATION}"
71
exit 1
72
fi
73
74
# copy the bundled JRE (do not move it as other install4j applications may be sharing it)
75
cp -r "${BUNDLED_JRE_LOCATION}"/* ${srcdir}/jre
76
mv ${srcdir}/target/jars/*.jar ${srcdir}
77
rm -f "${HOME}"/Desktop/Trader\ Workstation*.desktop "${HOME}"/.local/share/applications/install4j_*-tws.desktop
78
79
# icons
80
bsdtar --extract --include trader/common/images/ibkr_icon_w12.32_h24.svg --strip-components=3 \
81
--to-stdout --file jts4launch-*.jar | tee ib-tws.svg ib-gw.svg
82
sed --in-place --expression='s/{fill: #911421;}/{fill: #0d0d0d;}/' \
83
--expression='s/{fill: #d81222;}/{fill: #161616;}/' ib-gw.svg # recolor gw icon to differentiate
84
}
85
86
package() {
87
cd ${srcdir}
88
mkdir -p ${pkgdir}/usr/share/licenses/${pkgname}
89
install -Dm644 LICENSE ${pkgdir}/usr/share/licenses/${pkgname}/LICENSE
90
install -Dm755 ${pkgname} ${pkgdir}/usr/bin/${pkgname}
91
install -Dm755 ib-gw ${pkgdir}/usr/bin/ib-gw
92
install -Dm644 ${pkgname}.conf ${pkgdir}/etc/$pkgname.conf
93
install -Dm644 ib-gw.conf ${pkgdir}/etc/ib-gw.conf
94
install -Dm644 ${pkgname}.desktop ${pkgdir}/usr/share/applications/${pkgname}.desktop
95
install -Dm644 ib-gw.desktop ${pkgdir}/usr/share/applications/ib-gw.desktop
96
mkdir -p ${pkgdir}/usr/share/icons/
97
install -Dm644 ib-*.svg "${pkgdir}/usr/share/icons/"
98
mkdir -p ${pkgdir}/usr/share/${pkgname}/jre
99
cp -R jre ${pkgdir}/usr/share/${pkgname}
100
mkdir -p ${pkgdir}/usr/share/${pkgname}/jars
101
install -Dm644 *.jar ${pkgdir}/usr/share/${pkgname}/jars
102
}
103
Changes since previous scan
--- PKGBUILD @ 2026-07-31 00:14+++ PKGBUILD @ 2026-08-03 00:08@@ -3,7 +3,7 @@ # Contributor: bgh <aur at bgh dot io> pkgname=ib-tws-pkgver=10.48.1f+pkgver=10.49.1c pkgrel=1 epoch=1 pkgdesc='Electronic trading platform from discount brokerage firm Interactive Brokers (IBKR)'@@ -30,7 +30,7 @@ '467980a76c604f0e5932c234ff7b81d3e71f5d7ba3ace5e0a8740e2579b6d1f6' '21070fa89c9053dff06ba799b6f9838bfd5ff209fd8dd710c5a97c3fc684af44' '9f74a204c45d47f551861cb231de89f2536f9966942da41f95d8f0ce5bcd13a4'- '83a8bdbb68d8c89f68c19d98599951937ebe602b558ca041edfbd86c2df532d8')+ '591ee70484956f2182cb6432a0e115b12870c22f57bcf7bbefa1995f33522c5f') build() { cd ${srcdir}Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 07:17:22 | MEDIUM | 1 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 07:37:32 | MEDIUM | 1 |
| 2026-07-15 00:09:25 | CLEAN | 2 |
| 2026-07-14 07:44:03 | MEDIUM | 1 |
| 2026-07-14 00:09:48 | LOW | 2 |
| 2026-07-13 00:19:36 | LOW | 2 |
| 2026-07-12 00:27:26 | LOW | 2 |
| 2026-07-11 00:25:18 | LOW | 2 |
| 2026-07-10 00:20:30 | LOW | 2 |
| 2026-07-09 00:22:38 | LOW | 2 |
| 2026-07-08 00:26:52 | LOW | 2 |
| 2026-07-07 00:22:52 | LOW | 2 |
| 2026-07-06 00:10:58 | LOW | 2 |
| 2026-07-05 00:27:08 | LOW | 2 |