thinkwatch-core-bin

LOW

maintainer sunnysab 0 votes scanned 2026-10-26 09:44:33.960329

View on AUR

Why flagged

The package downloads a prebuilt binary from the project's official GitHub releases, which is a normal AUR practice; the binary is installed directly without obfuscation or remote code execution, and the source host is plausibly project-owned despite not being on a whitelist.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads a prebuilt binary from the project's official GitHub releases, which is a normal AUR practice; the binary is installed directly without obfuscation or remote code execution, and the source host is plausibly project-owned despite not being on a whitelist.

PKGBUILD

      1# Maintainer: sunnysab <i@sunnysab.cn>
    
      2#
    
      3# Upstream ships a tarball with the server binary, the systemd unit and the
    
      4# license. Its asset name carries no version, so the source is stored as
    
      5# $pkgver-$_tarball: two releases otherwise land on the same file name in a
    
      6# local build directory and the second build fails on a stale checksum.
    
      7pkgname=thinkwatch-core-bin
    
      8pkgver=0.83.2
    
      9pkgrel=1
    
      10pkgdesc="Gateway engine for Claude Code, Codex and other AI clients (server build of twcore)"
    
      11arch=('x86_64')
    
      12url="https://github.com/ThinkWatchProject/ThinkWatch-Core"
    
      13license=('MIT')
    
      14options=('!debug')
    
      15depends=('glibc' 'gcc-libs')
    
      16_tarball="twcore-x86_64-unknown-linux-gnu.tar.gz"
    
      17source=("$pkgver-$_tarball::https://github.com/ThinkWatchProject/ThinkWatch-Core/releases/download/v$pkgver/$_tarball")
    
      18sha256sums=('23679ab12c323c64ced26f545596c4463b155c766ba61d998527ba2724e4223e')
    
      19
    
      20package() {
    
      21  cd "$srcdir/twcore-x86_64-unknown-linux-gnu"
    
      22
    
      23  install -Dm755 twcore "$pkgdir/usr/bin/twcore"
    
      24  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      25
    
      26  # The shipped unit starts /usr/local/bin/twcore, where upstream's install.sh
    
      27  # puts the binary; the package owns /usr/bin/twcore. Its EnvironmentFile
    
      28  # (-/etc/thinkwatch/env) and the configuration in /var/lib/thinkwatch are
    
      29  # left to the admin, as documented in docs/server.md.
    
      30  install -Dm644 twcore.service "$pkgdir/usr/lib/systemd/system/twcore.service"
    
      31  sed -i 's|^ExecStart=/usr/local/bin/twcore|ExecStart=/usr/bin/twcore|' \
    
      32    "$pkgdir/usr/lib/systemd/system/twcore.service"
    
      33
    
      34  # The unit runs as the thinkwatch account, which is ours to create: only
    
      35  # upstream's install.sh normally does it.
    
      36  install -d "$pkgdir/usr/lib/sysusers.d"
    
      37  printf 'u thinkwatch - "ThinkWatch Core" /var/lib/thinkwatch /usr/bin/nologin\n' \
    
      38    > "$pkgdir/usr/lib/sysusers.d/thinkwatch-core.conf"
    
      39}
    
      40

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-26 09:44:33	Low	2