ib-tws

LOW

maintainer bpa 43 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a legitimate Interactive Brokers installer from an official domain (download2.interactivebrokers.com), which is not on standard whitelists but is plausibly the project's own; the build process extracts and repackages the official software without executing arbitrary remote code or introducing untrusted binaries.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a legitimate Interactive Brokers installer from an official domain (download2.interactivebrokers.com), which is not on standard whitelists but is plausibly the project's own; the build process extracts and repackages the official software without executing arbitrary remote code or introducing untrusted binaries.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:25 "tws-${pkgver}-standalone-linux-x64.sh"::'https://download2.interactivebrokers.com/installers/tws/latest-standalone/tws-latest-standalone-linux-x64.sh')

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Ben Alex <ben.alex@acegi.com.au>
    
      2# Contributor: Jon Wiersma <archaur@jonw.org>
    
      3# Contributor: bgh <aur at bgh dot io>
    
      4
    
      5pkgname=ib-tws
    
      6pkgver=10.51.1a
    
      7pkgrel=1
    
      8epoch=1
    
      9pkgdesc='Electronic trading platform from discount brokerage firm Interactive Brokers (IBKR)'
    
      10arch=('x86_64')
    
      11url="http://interactivebrokers.com/"
    
      12license=('custom')
    
      13backup=('etc/ib-tws.conf' 'etc/ib-gw.conf')
    
      14depends=(alsa-lib at-spi2-core bash cairo fontconfig freetype2 ttf-dejavu ttf-liberation gcc-libs gdk-pixbuf2 glib2 glibc gtk3 libgl libx11 libxext libxi libxrender libxtst libxxf86vm pango)
    
      15optdepends=(ffmpeg3.4)
    
      16makedepends=(libarchive findutils sed)
    
      17
    
      18source=('LICENSE'
    
'ib-tws'
    
'ib-tws.conf'
    
'ib-tws.desktop'
    
'ib-gw'
    
'ib-gw.conf'
    
'ib-gw.desktop'
    
"tws-${pkgver}-standalone-linux-x64.sh"::'https://download2.interactivebrokers.com/installers/tws/latest-standalone/tws-latest-standalone-linux-x64.sh')
    
      26sha256sums=('4b65b33dc88d77fef6e7ba1bdc1ae88b149296d3e1eb87db251bfcdf119a1f22'
    
          'a04249976b99b9446fa666872be251ea5532beab9655c2801841de1af2bcab99'
    
          'b359c8b5ccc7d884316ba9c88395450ff3a5dfd6af376741f091f837a5db7c26'
    
          '3a45eb7d43c0b7be2babc3fb0c83d723db2676eb1b608ecefc2f1415be8d7a62'
    
          '467980a76c604f0e5932c234ff7b81d3e71f5d7ba3ace5e0a8740e2579b6d1f6'
    
          '21070fa89c9053dff06ba799b6f9838bfd5ff209fd8dd710c5a97c3fc684af44'
    
          '9f74a204c45d47f551861cb231de89f2536f9966942da41f95d8f0ce5bcd13a4'
    
          '6770f02b402c48450f5bb4f61efc1406bac9bace7013025dd6b82efd61e5b62b')
    
      34
    
      35build() {
    
cd ${srcdir}
    
rm -rf ${srcdir}/target ${srcdir}/jre ${srcdir}/*.jar
    
mkdir ${srcdir}/target ${srcdir}/jre
    
      39
    
chmod +x tws-${pkgver}-standalone-linux-x64.sh
    
./tws-${pkgver}-standalone-linux-x64.sh -q -dir ${srcdir}/target
    
      42
    
echo "Attempting to locate the Install4J-compatible Java installation"
    
if grep -q -e "Install file.*/java;" ${srcdir}/target/.install4j/installation.log; then
    
  echo "Installer script indicates Java was installed by Install4j; finding log entry for full path"
    
  BUNDLED_JRE_LOCATION=$(grep -e "Install file.*/java;" ${srcdir}/target/.install4j/installation.log | head -n 1 | cut -d ';' -f 1|sed -e 's/ .*Install file\: //g'|sed 's/\/bin\/java//')
    
  if [ -z "${BUNDLED_JRE_LOCATION}" ]; then
    
    echo "Could not find bundled JRE installation entry in Install4J log; unable to proceed"
    
    exit 1
    
  fi
    
  echo "Java installed by Install4J at ${BUNDLED_JRE_LOCATION}"
    
else
    
  echo "Install4J log did not install Java; attempting to locate a previous Java installation it re-used"
    
  LOG_JRE_LOCATION=$(grep java.home ${srcdir}/target/.install4j/installation.log | head -n 1 | cut -d '=' -f 2 | sed 's/\.\.\.//g')
    
  if [ -z "${LOG_JRE_LOCATION}" ]; then
    
    echo "Install4J log did not provide a java.home; unable to proceed"
    
    exit 1
    
  fi
    
  echo "Previous Install4J-installed Java reported in log as ${LOG_JRE_LOCATION}"
    
  CANONICALIZED_JRE_LOCATION=$(echo ${LOG_JRE_LOCATION}*)
    
  echo "Canonicalized path resolved to ${CANONICALIZED_JRE_LOCATION}"
    
  FIND_OUTPUT=$(find ${CANONICALIZED_JRE_LOCATION} -path '*/bin/java' | head -n 1)
    
  echo "Search for Java result: $FIND_OUTPUT"
    
  BUNDLED_JRE_LOCATION=$(echo ${FIND_OUTPUT} | sed 's/\(.*\)\/bin\/java/\1/')
    
  echo "Final Java installation directory resolved to ${BUNDLED_JRE_LOCATION}"
    
fi
    
if [ -f "${BUNDLED_JRE_LOCATION}/bin/java" ]; then
    
  echo "Confirmed java in ${BUNDLED_JRE_LOCATION}"
    
else
    
  echo "Cannot find java; last tried ${BUNDLED_JRE_LOCATION}"
    
  exit 1
    
fi
    
      73
    
# copy the bundled JRE (do not move it as other install4j applications may be sharing it)
    
cp -r "${BUNDLED_JRE_LOCATION}"/* ${srcdir}/jre
    
mv ${srcdir}/target/jars/*.jar ${srcdir}
    
rm -f "${HOME}"/Desktop/Trader\ Workstation*.desktop "${HOME}"/.local/share/applications/install4j_*-tws.desktop
    
      78
    
# icons
    
bsdtar --extract --include trader/common/images/ibkr_icon_w12.32_h24.svg --strip-components=3 \
    
  --to-stdout --file jts4launch-*.jar | tee ib-tws.svg ib-gw.svg
    
sed --in-place --expression='s/{fill: #911421;}/{fill: #0d0d0d;}/' \
    
  --expression='s/{fill: #d81222;}/{fill: #161616;}/' ib-gw.svg # recolor gw icon to differentiate
    
      84}
    
      85
    
      86package() {
    
cd ${srcdir}
    
mkdir -p ${pkgdir}/usr/share/licenses/${pkgname}
    
install -Dm644 LICENSE ${pkgdir}/usr/share/licenses/${pkgname}/LICENSE
    
install -Dm755 ${pkgname} ${pkgdir}/usr/bin/${pkgname}
    
install -Dm755 ib-gw ${pkgdir}/usr/bin/ib-gw
    
install -Dm644 ${pkgname}.conf ${pkgdir}/etc/$pkgname.conf
    
install -Dm644 ib-gw.conf ${pkgdir}/etc/ib-gw.conf
    
install -Dm644 ${pkgname}.desktop ${pkgdir}/usr/share/applications/${pkgname}.desktop
    
install -Dm644 ib-gw.desktop ${pkgdir}/usr/share/applications/ib-gw.desktop
    
mkdir -p ${pkgdir}/usr/share/icons/
    
install -Dm644 ib-*.svg "${pkgdir}/usr/share/icons/"
    
mkdir -p ${pkgdir}/usr/share/${pkgname}/jre
    
cp -R jre ${pkgdir}/usr/share/${pkgname}
    
mkdir -p ${pkgdir}/usr/share/${pkgname}/jars
    
install -Dm644 *.jar ${pkgdir}/usr/share/${pkgname}/jars
    
      102}
    
      103

Changes since previous scan

--- PKGBUILD @ 2026-09-15 00:25
+++ PKGBUILD @ 2026-09-17 00:27
@@ -3,7 +3,7 @@
 # Contributor: bgh <aur at bgh dot io>
 
 pkgname=ib-tws
-pkgver=10.50.1e
+pkgver=10.51.1a
 pkgrel=1
 epoch=1
 pkgdesc='Electronic trading platform from discount brokerage firm Interactive Brokers (IBKR)'
@@ -30,7 +30,7 @@
             '467980a76c604f0e5932c234ff7b81d3e71f5d7ba3ace5e0a8740e2579b6d1f6'
             '21070fa89c9053dff06ba799b6f9838bfd5ff209fd8dd710c5a97c3fc684af44'
             '9f74a204c45d47f551861cb231de89f2536f9966942da41f95d8f0ce5bcd13a4'
-            '1cd7dd40dd30de4ab39f69476b179a047b9db7023d7dbe9e414715ceebd372df')
+            '6770f02b402c48450f5bb4f61efc1406bac9bace7013025dd6b82efd61e5b62b')
 
 build() {
   cd ${srcdir}

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 07:19:15	Medium	1
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2