orad-bin
LOW
maintainer balwierz
0 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
Installs a prebuilt vendor binary (orad) from Illumina's official public S3 bucket with a pinned sha256 checksum, and documentation PDFs from Illumina's own CDN with matching checksums; all sources are from the vendor's own infrastructure with integrity verification, so the main concern is merely that it is a prebuilt binary rather than built from source.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 80%): Installs a prebuilt vendor binary (orad) from Illumina's official public S3 bucket with a pinned sha256 checksum, and documentation PDFs from Illumina's own CDN with matching checksums; all sources are from the vendor's own infrastructure with integrity verification, so the main concern is merely that it is a prebuilt binary rather than built from source.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:29
"https://s3.amazonaws.com/webdata.illumina.com/downloads/software/dragen-decompression/orad.${_pkg_ver}.linux.tar.gz" -
PKGBUILD:30
"https://support.illumina.com/content/dam/illumina-support/documents/downloads/software/dragen-decompression/${_eula}"
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: Piotr Balwierz <his surname at google's email service>
2
3
_pkg_ver=2.7.0
4
5
pkgname=orad-bin
6
pkgver="${_pkg_ver}"
7
pkgrel=1
8
pkgdesc="Illumina DRAGEN ORA decompression tool (orad): converts FASTQ.ORA back to FASTQ.GZ; bundles the default human reference"
9
arch=('x86_64')
10
url=https://support.illumina.com/sequencing/sequencing_software/DRAGENORA/software-downloads.html
11
license=('custom:illumina')
12
provides=("orad=${pkgver}")
13
conflicts=('orad')
14
# orad needs only glibc + libuuid (libstdc++ is statically linked; see readelf
15
# NEEDED: libc/libm/libpthread/librt/libdl/ld-linux + libuuid.so.1). Max symbol
16
# version required is GLIBC_2.14.
17
depends=('glibc' 'util-linux-libs')
18
# Prebuilt vendor binary: don't strip or try to build a debug package from it.
19
options=('!strip' '!debug')
20
21
_eula=1000000139522_02_Ora_Decompression_SW_EULA.pdf
22
_relnotes=200057653_00_DRAGEN_ORA_Decompression_v2.7.0_Customer_Release_Notes.pdf
23
24
# The Linux installer is served, without a login gate, from Illumina's public S3
25
# bucket (verified by the sha256 below). The EULA / release-notes / readme PDFs
26
# live on the support.illumina.com CDN. The readme's upstream filename contains
27
# spaces, so it is fetched under a clean local name via makepkg's rename syntax.
28
source=(
29
"https://s3.amazonaws.com/webdata.illumina.com/downloads/software/dragen-decompression/orad.${_pkg_ver}.linux.tar.gz"
30
"https://support.illumina.com/content/dam/illumina-support/documents/downloads/software/dragen-decompression/${_eula}"
31
"https://support.illumina.com/content/dam/illumina-support/documents/downloads/software/dragen-decompression/${_relnotes}"
32
"orad-readme-v${_pkg_ver}.pdf::https://support.illumina.com/content/dam/illumina-support/documents/downloads/software/dragen-decompression/200057807_00-%20ORA%20decompression%20v2.7.0%20linux%20and%20mac%20Readme.pdf"
33
)
34
sha256sums=(
35
'7a20c3cc1329598194bba032131de65aedadbde4e0f639f0d5f550e9459ff933'
36
'dfebcd553b19b5c889a802f08c3bd7b727c25fb59617c7406a5abff99eb38675'
37
'd12122eb455abd4e48c7214bb67219f053f83d7de3d94b7cfe5ba774e0edab50'
38
'91392da7e084ed92f1cb4cf06cfdd0fb268ceefb0f9b6e85cfd985280165a1cd'
39
)
40
41
package() {
42
cd "${srcdir}/orad.${_pkg_ver}.linux"
43
44
# Self-contained vendor tree under /opt. orad locates its reference genome by
45
# reading /proc/self/exe and searching that *real* directory for a "refbin"
46
# file -- it does NOT descend into an oradata/ subdirectory for the exec-dir
47
# lookup (that path is only auto-appended for $HOME). So the bundled default
48
# human reference must sit directly beside the binary, not in oradata/.
49
install -Dm755 orad "${pkgdir}/opt/orad/orad"
50
install -Dm644 oradata/refbin "${pkgdir}/opt/orad/refbin"
51
52
# Expose orad on PATH. /proc/self/exe resolves through this symlink to the
53
# real /opt/orad/orad, so the bundled reference is still found with zero
54
# configuration (no ORA_REF_PATH needed for the default human reference).
55
install -d "${pkgdir}/usr/bin"
56
ln -s /opt/orad/orad "${pkgdir}/usr/bin/orad"
57
58
# License (custom:illumina requires shipping it) + upstream documentation.
59
install -Dm644 "${srcdir}/${_eula}" \
60
"${pkgdir}/usr/share/licenses/${pkgname}/${_eula}"
61
install -Dm644 "${srcdir}/${_relnotes}" \
62
"${pkgdir}/usr/share/doc/${pkgname}/${_relnotes}"
63
install -Dm644 "${srcdir}/orad-readme-v${_pkg_ver}.pdf" \
64
"${pkgdir}/usr/share/doc/${pkgname}/orad-readme-v${_pkg_ver}.pdf"
65
# tiny upstream note describing the bundled reference (species + xxhash)
66
install -Dm644 oradata/README \
67
"${pkgdir}/usr/share/doc/${pkgname}/refbin.README"
68
}
69
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |