thincast-client

maintainer huu · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a source tarball from the project's official domain with a verifiable checksum; the non-whitelisted host is the project's own, making this a normal and safe AUR package build.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The package downloads a source tarball from the project's official domain with a verifiable checksum; the non-whitelisted host is the project's own, making this a normal and safe AUR package build.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:35 "thincast-client-${_version}.tar.xz::https://thincast.com/software/download/artifact/by-hash/${_commit}"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: neitherportal <neitherportal@proton.me>
    
      2# Contributor: neitherportal <neitherportal@proton.me>
    
      3
    
      4pkgname=thincast-client
    
      5pkgver=1.1.634
    
      6pkgrel=1
    
      7pkgdesc="A free Remote Desktop Client for Linux, macOS and Windows"
    
      8arch=('x86_64')
    
      9url="https://thincast.com/en/products/client"
    
      10license=('custom')
    
      11
    
      12# Dependencies based on inspection of the binaries and .desktop file
    
      13depends=(
    
      14    'qt5-base' 'qt5-svg' 'qt5-webengine' 'qt5-multimedia' 
    
      15    'qt5-graphicaleffects' 'qt5-quickcontrols2' 'qt5-x11extras' 
    
      16    'libx11' 'libxcb' 'libxkbcommon-x11' 'krb5' 'pcsclite' 'openssl' 'zlib'
    
      17    'libsecret' 'libusb' 'freerdp'
    
      18)
    
      19
    
      20optdepends=(
    
      21    'pulseaudio: Audio support'
    
      22    'libpulse: PulseAudio support'
    
      23    'libxtst: X11 testing - record extension'
    
      24)
    
      25
    
      26options=('!strip')
    
      27install="${pkgname}.install"
    
      28
    
      29# Version information
    
      30_version='1.1.0'
    
      31_commit='651f42111a21d80e3d9abf59fb04acd8a89482879bb322cf1eda939af9f6ae0d'
    
      32
    
      33# Primary source URL and checksum
    
      34source=(
    
      35    "thincast-client-${_version}.tar.xz::https://thincast.com/software/download/artifact/by-hash/${_commit}"
    
      36    "${pkgname}.install"
    
      37)
    
      38
    
      39# Verify checksums
    
      40sha256sums=(
    
      41    '651f42111a21d80e3d9abf59fb04acd8a89482879bb322cf1eda939af9f6ae0d'  # Source tarball
    
      42    'SKIP'  # .install file
    
      43)
    
      44
    
      45# Skip extraction of .a and .la files
    
      46options+=(!strip !libtool)
    
      47
    
      48# Function to check for new versions
    
      49pkgver() {
    
      50    # Try to get the latest version from the website
    
      51    curl -s https://thincast.com/en/products/client | \
    
      52    grep -oP 'Version\s+[0-9]+\.[0-9]+\.[0-9]+' | \
    
      53    head -1 | \
    
      54    awk '{print $2}'
    
      55}
    
      56
    
      57# Function to download from primary or fallback sources
    
      58download_source() {
    
      59    local url="$1"
    
      60    local filename="$2"
    
      61    local expected_sha256="$3"
    
      62    
    
      63    # Try primary source first
    
      64    msg2 "Downloading from primary source: $url"
    
      65    if curl -L -f -o "$filename" "$url"; then
    
      66        if ! echo "$expected_sha256  $filename" | sha256sum -c --quiet -; then
    
      67            warning "Checksum verification failed for primary source"
    
      68            rm -f "$filename"
    
      69        else
    
      70            return 0
    
      71        fi
    
      72    fi
    
      73    
    
      74    # Try archive.org fallback
    
      75    local archive_url="https://web.archive.org/web/2024/$url"
    
      76    warning "Primary source failed, trying archive.org mirror..."
    
      77    if curl -L -f -o "$filename" "$archive_url"; then
    
      78        if ! echo "$expected_sha256  $filename" | sha256sum -c --quiet -; then
    
      79            error "Checksum verification failed for archive.org mirror"
    
      80            return 1
    
      81        fi
    
      82        return 0
    
      83    fi
    
      84    
    
      85    # All download attempts failed
    
      86    error "All download attempts failed"
    
      87    return 1
    
      88}
    
      89
    
      90prepare() {
    
      91    local source_url="https://thincast.com/software/download/artifact/by-hash/${_commit}"
    
      92    local source_file="thincast-client-${_version}.tar.xz"
    
      93    
    
      94    # Download the source
    
      95    if [ ! -f "${srcdir}/${source_file}" ]; then
    
      96        download_source "$source_url" "${srcdir}/${source_file}" "${sha256sums[0]}" || return 1
    
      97    fi
    
      98    
    
      99    # Create a temporary directory for extraction
    
      100    local _tmpdir="${srcdir}/_extracted"
    
      101    mkdir -p "${_tmpdir}"
    
      102    
    
      103    # Extract the tarball to temporary directory
    
      104    msg2 "Extracting ${source_file}..."
    
      105    bsdtar -xf "${srcdir}/${source_file}" -C "${_tmpdir}" --no-same-owner --no-same-permissions
    
      106}
    
      107
    
      108package() {
    
      109    local _tmpdir="${srcdir}/_extracted"
    
      110    if [ ! -d "${_tmpdir}" ]; then
    
      111        error "Source directory not found. Did prepare() run successfully?"
    
      112        return 1
    
      113    fi
    
      114    # Create package directories
    
      115    install -dm755 "${pkgdir}/usr/bin"
    
      116    install -dm755 "${pkgdir}/usr/share/applications"
    
      117    install -dm755 "${pkgdir}/usr/share/icons/hicolor/64x64/apps"
    
      118    install -dm755 "${pkgdir}/usr/share/icons/hicolor/128x128/apps"
    
      119    install -dm755 "${pkgdir}/usr/share/doc/${pkgname}"
    
      120    
    
      121    # Move binaries
    
      122    if [ -f "${_tmpdir}/bin/rdc" ]; then
    
      123        install -Dm755 "${_tmpdir}/bin/rdc" "${pkgdir}/usr/bin/rdc"
    
      124        ln -sf "rdc" "${pkgdir}/usr/bin/thincast-client"
    
      125    fi
    
      126    
    
      127    # Move desktop file
    
      128    if [ -f "${_tmpdir}/share/applications/com.thincast.client.desktop" ]; then
    
      129        install -Dm644 "${_tmpdir}/share/applications/com.thincast.client.desktop" \
    
      130            "${pkgdir}/usr/share/applications/com.thincast.client.desktop"
    
      131    fi
    
      132    
    
      133    # Install icons from flatpak directory to standard hicolor theme
    
      134    for size in 16 22 24 32 48 64 128 256; do
    
      135        if [ -d "${_tmpdir}/share/app-info/icons/flatpak/${size}x${size}" ]; then
    
      136            install -dm755 "${pkgdir}/usr/share/icons/hicolor/${size}x${size}/apps/"
    
      137            find "${_tmpdir}/share/app-info/icons/flatpak/${size}x${size}" -name 'com.thincast.client.png' -exec install -Dm644 {} "${pkgdir}/usr/share/icons/hicolor/${size}x${size}/apps/" \;
    
      138        fi
    
      139    done
    
      140    
    
      141    # Also install SVG icon if available
    
      142    if [ -f "${_tmpdir}/share/icons/hicolor/scalable/apps/com.thincast.client.svg" ]; then
    
      143        install -Dm644 "${_tmpdir}/share/icons/hicolor/scalable/apps/com.thincast.client.svg" \
    
      144            "${pkgdir}/usr/share/icons/hicolor/scalable/apps/com.thincast.client.svg"
    
      145    fi
    
      146    
    
      147    # Handle libraries - move to /usr/lib instead of /lib
    
      148    if [ -d "${_tmpdir}/lib" ]; then
    
      149        install -dm755 "${pkgdir}/usr/lib/${pkgname}"
    
      150        cp -a "${_tmpdir}/lib/"* "${pkgdir}/usr/lib/${pkgname}/" || true
    
      151        
    
      152        # Create a wrapper script to set LD_LIBRARY_PATH
    
      153        cat > "${pkgdir}/usr/bin/rdc-wrapper" << 'EOF'
    
      154#!/bin/bash
    
      155LD_LIBRARY_PATH="/usr/lib/thincast-client${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}" \
    
      156/usr/bin/rdc "$@"
    
      157EOF
    
      158        
    
      159        chmod +x "${pkgdir}/usr/bin/rdc-wrapper"
    
      160        
    
      161        # Update desktop file to use the wrapper
    
      162        sed -i 's|Exec=rdc|Exec=rdc-wrapper|g' "${pkgdir}/usr/share/applications/com.thincast.client.desktop"
    
      163    fi
    
      164    
    
      165    # Clean up
    
      166    rm -rf "${_tmpdir}"
    
      167    
    
      168    # Print installation success message
    
      169    msg ""
    
      170    msg "Thincast Remote Desktop Client has been installed successfully!"
    
      171    msg "You can now run it from your application menu or by typing 'rdc' or 'thincast-client' in the terminal."
    
      172    msg ""
    
      173    msg "If you encounter any issues, please report them at:"
    
      174    msg "https://aur.archlinux.org/packages/thincast-client/"
    
      175    msg ""
    
      176}
    
      177
    
      178# vim:set ts=4 sw=4 et:
    
      179

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2