orad-bin

maintainer balwierz · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged Installs a prebuilt vendor binary (orad) from Illumina's official public S3 bucket with a pinned sha256 checksum, and documentation PDFs from Illumina's own CDN with matching checksums; all sources are from the vendor's own infrastructure with integrity verification, so the main concern is merely that it is a prebuilt binary rather than built from source.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 80%): Installs a prebuilt vendor binary (orad) from Illumina's official public S3 bucket with a pinned sha256 checksum, and documentation PDFs from Illumina's own CDN with matching checksums; all sources are from the vendor's own infrastructure with integrity verification, so the main concern is merely that it is a prebuilt binary rather than built from source.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:29 "https://s3.amazonaws.com/webdata.illumina.com/downloads/software/dragen-decompression/orad.${_pkg_ver}.linux.tar.gz"
PKGBUILD:30 "https://support.illumina.com/content/dam/illumina-support/documents/downloads/software/dragen-decompression/${_eula}"

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Piotr Balwierz <his surname at google's email service>
    
      2
    
      3_pkg_ver=2.7.0
    
      4
    
      5pkgname=orad-bin
    
      6pkgver="${_pkg_ver}"
    
      7pkgrel=1
    
      8pkgdesc="Illumina DRAGEN ORA decompression tool (orad): converts FASTQ.ORA back to FASTQ.GZ; bundles the default human reference"
    
      9arch=('x86_64')
    
      10url=https://support.illumina.com/sequencing/sequencing_software/DRAGENORA/software-downloads.html
    
      11license=('custom:illumina')
    
      12provides=("orad=${pkgver}")
    
      13conflicts=('orad')
    
      14# orad needs only glibc + libuuid (libstdc++ is statically linked; see readelf
    
      15# NEEDED: libc/libm/libpthread/librt/libdl/ld-linux + libuuid.so.1). Max symbol
    
      16# version required is GLIBC_2.14.
    
      17depends=('glibc' 'util-linux-libs')
    
      18# Prebuilt vendor binary: don't strip or try to build a debug package from it.
    
      19options=('!strip' '!debug')
    
      20
    
      21_eula=1000000139522_02_Ora_Decompression_SW_EULA.pdf
    
      22_relnotes=200057653_00_DRAGEN_ORA_Decompression_v2.7.0_Customer_Release_Notes.pdf
    
      23
    
      24# The Linux installer is served, without a login gate, from Illumina's public S3
    
      25# bucket (verified by the sha256 below). The EULA / release-notes / readme PDFs
    
      26# live on the support.illumina.com CDN. The readme's upstream filename contains
    
      27# spaces, so it is fetched under a clean local name via makepkg's rename syntax.
    
      28source=(
    
      29  "https://s3.amazonaws.com/webdata.illumina.com/downloads/software/dragen-decompression/orad.${_pkg_ver}.linux.tar.gz"
    
      30  "https://support.illumina.com/content/dam/illumina-support/documents/downloads/software/dragen-decompression/${_eula}"
    
      31  "https://support.illumina.com/content/dam/illumina-support/documents/downloads/software/dragen-decompression/${_relnotes}"
    
      32  "orad-readme-v${_pkg_ver}.pdf::https://support.illumina.com/content/dam/illumina-support/documents/downloads/software/dragen-decompression/200057807_00-%20ORA%20decompression%20v2.7.0%20linux%20and%20mac%20Readme.pdf"
    
      33)
    
      34sha256sums=(
    
      35  '7a20c3cc1329598194bba032131de65aedadbde4e0f639f0d5f550e9459ff933'
    
      36  'dfebcd553b19b5c889a802f08c3bd7b727c25fb59617c7406a5abff99eb38675'
    
      37  'd12122eb455abd4e48c7214bb67219f053f83d7de3d94b7cfe5ba774e0edab50'
    
      38  '91392da7e084ed92f1cb4cf06cfdd0fb268ceefb0f9b6e85cfd985280165a1cd'
    
      39)
    
      40
    
      41package() {
    
      42  cd "${srcdir}/orad.${_pkg_ver}.linux"
    
      43
    
      44  # Self-contained vendor tree under /opt. orad locates its reference genome by
    
      45  # reading /proc/self/exe and searching that *real* directory for a "refbin"
    
      46  # file -- it does NOT descend into an oradata/ subdirectory for the exec-dir
    
      47  # lookup (that path is only auto-appended for $HOME). So the bundled default
    
      48  # human reference must sit directly beside the binary, not in oradata/.
    
      49  install -Dm755 orad "${pkgdir}/opt/orad/orad"
    
      50  install -Dm644 oradata/refbin "${pkgdir}/opt/orad/refbin"
    
      51
    
      52  # Expose orad on PATH. /proc/self/exe resolves through this symlink to the
    
      53  # real /opt/orad/orad, so the bundled reference is still found with zero
    
      54  # configuration (no ORA_REF_PATH needed for the default human reference).
    
      55  install -d "${pkgdir}/usr/bin"
    
      56  ln -s /opt/orad/orad "${pkgdir}/usr/bin/orad"
    
      57
    
      58  # License (custom:illumina requires shipping it) + upstream documentation.
    
      59  install -Dm644 "${srcdir}/${_eula}" \
    
      60    "${pkgdir}/usr/share/licenses/${pkgname}/${_eula}"
    
      61  install -Dm644 "${srcdir}/${_relnotes}" \
    
      62    "${pkgdir}/usr/share/doc/${pkgname}/${_relnotes}"
    
      63  install -Dm644 "${srcdir}/orad-readme-v${_pkg_ver}.pdf" \
    
      64    "${pkgdir}/usr/share/doc/${pkgname}/orad-readme-v${_pkg_ver}.pdf"
    
      65  # tiny upstream note describing the bundled reference (species + xxhash)
    
      66  install -Dm644 oradata/README \
    
      67    "${pkgdir}/usr/share/doc/${pkgname}/refbin.README"
    
      68}
    
      69

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2