bcl2fastq-bin
LOW
maintainer balwierz
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a source file from the Internet Archive, but it is a verifiable, byte-identical copy of the official Illumina software, with checksums provided and no execution of remote code.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a source file from the Internet Archive, but it is a verifiable, byte-identical copy of the official Illumina software, with checksums provided and no execution of remote code.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:24
https://archive.org/download/bcl2fastq2-v"${_pkg_ver//./-}"-linux-x86-64/bcl2fastq2-v"${_pkg_ver//./-}"-linux-x86-64.zip -
PKGBUILD:25
https://support.illumina.com/content/dam/illumina-support/documents/downloads/software/bcl2fastq/bcl2fastq2-v"${_eula_ver}"-eula.pdf
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: Piotr Balwierz <his surname at google's email service>
2
# Contributor: Clint Valentine <valentine.clint@gmail.com>
3
4
_pkg_ver=2.20.0
5
_pkg_build=422
6
_eula_ver=2-20
7
_guide_file=bcl2fastq2-v2-20-software-guide-15051736-03.pdf
8
9
pkgname=bcl2fastq-bin
10
pkgver="${_pkg_ver}"."${_pkg_build}"
11
pkgrel=4
12
pkgdesc="Demultiplexes data and converts BCL files generated by Illumina sequencers to FASTQ for downstream analysis"
13
arch=('x86_64')
14
url=https://support.illumina.com/downloads/bcl2fastq-conversion-software-v"${_eula_ver}".html
15
license=('custom:illumina')
16
provides=('bcl2fastq')
17
conflicts=('bcl2fastq')
18
# Illumina no longer offers a public direct-download URL for the v2.20 archive
19
# (it is gated behind a login). This sources a byte-identical copy from the
20
# Internet Archive -- verified by the sha256sum below -- so the package builds
21
# unattended. Original (login-gated) download page:
22
# https://support.illumina.com/downloads/bcl2fastq-conversion-software-v2-20.html
23
source=(
24
https://archive.org/download/bcl2fastq2-v"${_pkg_ver//./-}"-linux-x86-64/bcl2fastq2-v"${_pkg_ver//./-}"-linux-x86-64.zip
25
https://support.illumina.com/content/dam/illumina-support/documents/downloads/software/bcl2fastq/bcl2fastq2-v"${_eula_ver}"-eula.pdf
26
https://support.illumina.com/content/dam/illumina-support/documents/documentation/software_documentation/bcl2fastq/"${_guide_file}"
27
)
28
sha256sums=(
29
'3744bc1c02fff1dd17d18c8e8b8b2cc2405b37d7d248b8889f4f8a8fc220b434'
30
'0a8236fad01c86f72d43247606c7f6c029cebdedf23f4bcb691367602bd061de'
31
'8e6bf9029282096470da3c5a2b427ffe12ab5082b5c3b797c707ff44422eab79'
32
)
33
34
prepare() {
35
echo 'Download of this software requires agreement with EULA at:'
36
echo "https://support.illumina.com/content/dam/illumina-support/documents/downloads/software/bcl2fastq/bcl2fastq2-v${_eula_ver}-eula.pdf"
37
}
38
39
build() {
40
mkdir -p "${srcdir}"/"${pkgname}"-"${_pkg_ver}" && cd "$_"
41
mv ../bcl2fastq2-v"${_pkg_ver}"."${_pkg_build}"-Linux-x86_64.rpm ./
42
bsdtar -xf bcl2fastq2-v"${_pkg_ver}"."${_pkg_build}"-Linux-x86_64.rpm
43
}
44
45
package() {
46
install -Dm644 \
47
"${srcdir}"/bcl2fastq2-v"${_eula_ver}"-eula.pdf \
48
"${pkgdir}"/usr/share/licenses/bcl2fastq/bcl2fastq2-v"${_eula_ver}"-eula.pdf
49
50
install -Dm644 \
51
"${srcdir}"/"${_guide_file}" \
52
"${pkgdir}"/usr/share/doc/bcl2fastq/"${_guide_file}"
53
54
cd "${srcdir}"/"${pkgname}"-"${_pkg_ver}"
55
install -Dm644 usr/local/share/COPYRIGHT "${pkgdir}"/usr/share/licenses/bcl2fastq/COPYRIGHT
56
install -Dm644 usr/local/share/Changes "${pkgdir}"/usr/share/licenses/bcl2fastq/Changes
57
install -Dm755 usr/local/bin/bcl2fastq "${pkgdir}"/usr/bin/bcl2fastq
58
}
59
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |