ibgateway-stable

MEDIUM

maintainer ANTONI 0 votes scanned 2026-09-28 17:23:17.479743

View on AUR

Why flagged

Downloads and executes a prebuilt proprietary installer shell script from download2.interactivebrokers.com (a non-standard subdomain that could be swapped), but the domain is plausibly official Interactive Brokers infrastructure and a sha512 checksum is provided, reducing but not eliminating supply-chain risk from the unverified executable.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("https://download2.interactivebrokers.com/installers/ibgateway/$_channel-standalone/ibgateway-$_channel-standalone-linux-x64.sh")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Downloads and executes a prebuilt proprietary installer shell script from download2.interactivebrokers.com (a non-standard subdomain that could be swapped), but the domain is plausibly official Interactive Brokers infrastructure and a sha512 checksum is provided, reducing but not eliminating supply-chain risk from the unverified executable.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Antoni Michał Przybylik <antoni@taon.io>
    
      2
    
      3_channel=stable
    
      4pkgname="ibgateway-stable"
    
      5provides=('ibgateway')
    
      6conflicts=('ibgateway')
    
      7_version_short=10.50
    
      8pkgver="$_version_short".1e
    
      9pkgrel=1
    
      10pkgdesc='InteractiveBrokers Gateway - Stable'
    
      11arch=('x86_64')
    
      12url='https://www.interactivebrokers.com/en/trading/ibgateway-stable.php'
    
      13license=('custom:proprietary')
    
      14depends=('jdk-openjdk')
    
      15optdepends=()
    
      16source=("https://download2.interactivebrokers.com/installers/ibgateway/$_channel-standalone/ibgateway-$_channel-standalone-linux-x64.sh")
    
      17sha512sums=('9598d35b4df6b77fba1435fb8a70e6021ae28bca4a0770d781eb30991015f515b218d5a07a00e5884d5fca99adb17369919136d637adb93c36cbe01907c875e0')
    
      18options=('!strip' '!debug')
    
      19
    
      20prepare() {
    
      21    local isolated_home="$srcdir/isolated_home"
    
      22    mkdir -p "$isolated_home" 
    
      23    env HOME="$isolated_home" sh "./ibgateway-$_channel-standalone-linux-x64.sh" -q -dir "$srcdir/ibgateway" -overwrite
    
      24    rm -rf "$isolated_home"
    
      25
    
      26    sed -i "s|$srcdir/ibgateway|/opt/ibgateway|" \
    
      27        "$srcdir/ibgateway/ibgateway.vmoptions" \
    
      28        "$srcdir/ibgateway/.install4j/response.varfile" \
    
      29        "$srcdir/ibgateway/.install4j/install.prop" \
    
      30        "$srcdir/ibgateway/.install4j/files.log"
    
      31
    
      32    rm -f "$srcdir/ibgateway/.install4j/installation.log"
    
      33    rm -f "$srcdir/ibgateway/.install4j/install4j_"*"-ibgateway.desktop"
    
      34}
    
      35
    
      36package() {
    
      37    cd ${srcdir}
    
      38
    
      39    install -d "$pkgdir/opt/ibgateway"
    
      40    cp -a $srcdir/ibgateway/. "$pkgdir/opt/ibgateway"
    
      41
    
      42    chmod 755 "$pkgdir/opt/ibgateway"
    
      43
    
      44    install -d "$pkgdir"/usr/{bin,share/{pixmaps,applications}}
    
      45    ln -s /opt/ibgateway/ibgateway "$pkgdir"/usr/bin/ibgateway
    
      46    ln -s /opt/ibgateway/.install4j/ibgateway.png "$pkgdir"/usr/share/pixmaps/ibgateway.png
    
      47
    
      48    rm -f "$pkgdir/opt/ibgateway/IB Gateway $_version_short.desktop" 2>/dev/null || true
    
      49    install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/ibgateway.desktop" <<EOF
    
      50[Desktop Entry]
    
      51Name=IB Gateway
    
      52Comment=Interactive Brokers Gateway
    
      53Exec=/opt/ibgateway/ibgateway %U
    
      54Icon=/opt/ibgateway/.install4j/ibgateway.png
    
      55Terminal=false
    
      56Type=Application
    
      57Categories=Finance;
    
      58StartupWMClass=install4j-ibgateway-GWClient
    
      59EOF
    
      60}
    
      61

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-28 17:23:17	Medium	3
2026-09-28 17:21:20	Medium	2