orad-bin
LOW
maintainer balwierz
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
Installs a prebuilt vendor binary (orad) from Illumina's official public S3 bucket with a pinned sha256 checksum, and documentation PDFs from Illumina's own CDN with matching checksums; all sources are from the vendor's own infrastructure with integrity verification, so the main concern is merely that it is a prebuilt binary rather than built from source.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 80%): Installs a prebuilt vendor binary (orad) from Illumina's official public S3 bucket with a pinned sha256 checksum, and documentation PDFs from Illumina's own CDN with matching checksums; all sources are from the vendor's own infrastructure with integrity verification, so the main concern is merely that it is a prebuilt binary rather than built from source.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:29
"https://s3.amazonaws.com/webdata.illumina.com/downloads/software/dragen-decompression/orad.${_pkg_ver}.linux.tar.gz" -
PKGBUILD:30
"https://support.illumina.com/content/dam/illumina-support/documents/downloads/software/dragen-decompression/${_eula}"
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: Piotr Balwierz <his surname at google's email service>
2
3
_pkg_ver=2.7.0
4
5
pkgname=orad-bin
6
pkgver="${_pkg_ver}"
7
pkgrel=1
8
pkgdesc="Illumina DRAGEN ORA decompression tool (orad): converts FASTQ.ORA back to FASTQ.GZ; bundles the default human reference"
9
arch=('x86_64')
10
url=https://support.illumina.com/sequencing/sequencing_software/DRAGENORA/software-downloads.html
11
license=('custom:illumina')
12
provides=("orad=${pkgver}")
13
conflicts=('orad')
14
# orad needs only glibc + libuuid (libstdc++ is statically linked; see readelf
15
# NEEDED: libc/libm/libpthread/librt/libdl/ld-linux + libuuid.so.1). Max symbol
16
# version required is GLIBC_2.14.
17
depends=('glibc' 'util-linux-libs')
18
# Prebuilt vendor binary: don't strip or try to build a debug package from it.
19
options=('!strip' '!debug')
20
21
_eula=1000000139522_02_Ora_Decompression_SW_EULA.pdf
22
_relnotes=200057653_00_DRAGEN_ORA_Decompression_v2.7.0_Customer_Release_Notes.pdf
23
24
# The Linux installer is served, without a login gate, from Illumina's public S3
25
# bucket (verified by the sha256 below). The EULA / release-notes / readme PDFs
26
# live on the support.illumina.com CDN. The readme's upstream filename contains
27
# spaces, so it is fetched under a clean local name via makepkg's rename syntax.
28
source=(
29
"https://s3.amazonaws.com/webdata.illumina.com/downloads/software/dragen-decompression/orad.${_pkg_ver}.linux.tar.gz"
30
"https://support.illumina.com/content/dam/illumina-support/documents/downloads/software/dragen-decompression/${_eula}"
31
"https://support.illumina.com/content/dam/illumina-support/documents/downloads/software/dragen-decompression/${_relnotes}"
32
"orad-readme-v${_pkg_ver}.pdf::https://support.illumina.com/content/dam/illumina-support/documents/downloads/software/dragen-decompression/200057807_00-%20ORA%20decompression%20v2.7.0%20linux%20and%20mac%20Readme.pdf"
33
)
34
sha256sums=(
35
'7a20c3cc1329598194bba032131de65aedadbde4e0f639f0d5f550e9459ff933'
36
'dfebcd553b19b5c889a802f08c3bd7b727c25fb59617c7406a5abff99eb38675'
37
'd12122eb455abd4e48c7214bb67219f053f83d7de3d94b7cfe5ba774e0edab50'
38
'91392da7e084ed92f1cb4cf06cfdd0fb268ceefb0f9b6e85cfd985280165a1cd'
39
)
40
41
package() {
42
cd "${srcdir}/orad.${_pkg_ver}.linux"
43
44
# Self-contained vendor tree under /opt. orad locates its reference genome by
45
# reading /proc/self/exe and searching that *real* directory for a "refbin"
46
# file -- it does NOT descend into an oradata/ subdirectory for the exec-dir
47
# lookup (that path is only auto-appended for $HOME). So the bundled default
48
# human reference must sit directly beside the binary, not in oradata/.
49
install -Dm755 orad "${pkgdir}/opt/orad/orad"
50
install -Dm644 oradata/refbin "${pkgdir}/opt/orad/refbin"
51
52
# Expose orad on PATH. /proc/self/exe resolves through this symlink to the
53
# real /opt/orad/orad, so the bundled reference is still found with zero
54
# configuration (no ORA_REF_PATH needed for the default human reference).
55
install -d "${pkgdir}/usr/bin"
56
ln -s /opt/orad/orad "${pkgdir}/usr/bin/orad"
57
58
# License (custom:illumina requires shipping it) + upstream documentation.
59
install -Dm644 "${srcdir}/${_eula}" \
60
"${pkgdir}/usr/share/licenses/${pkgname}/${_eula}"
61
install -Dm644 "${srcdir}/${_relnotes}" \
62
"${pkgdir}/usr/share/doc/${pkgname}/${_relnotes}"
63
install -Dm644 "${srcdir}/orad-readme-v${_pkg_ver}.pdf" \
64
"${pkgdir}/usr/share/doc/${pkgname}/orad-readme-v${_pkg_ver}.pdf"
65
# tiny upstream note describing the bundled reference (species + xxhash)
66
install -Dm644 oradata/README \
67
"${pkgdir}/usr/share/doc/${pkgname}/refbin.README"
68
}
69
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |