ucsc-bigwig-bin

maintainer imjiaoyuan · 0 votes · scanned 2026-08-18 00:03:42.021799

MEDIUM

Why flagged Prebuilt binaries downloaded directly from UCSC's official download server (hgdownload.soe.ucsc.edu) with sha256 checksums provided; the host is the project's own official infrastructure, but these are unversioned prebuilt executables that can be silently replaced upstream at any time — checksums mitigate but don't eliminate the risk of a swapped binary since upstream updates without version bumps.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("https://hgdownload.soe.ucsc.edu/admin/exe/linux.x86_64/bedGraphToBigWig"

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Prebuilt binaries downloaded directly from UCSC's official download server (hgdownload.soe.ucsc.edu) with sha256 checksums provided; the host is the project's own official infrastructure, but these are unversioned prebuilt executables that can be silently replaced upstream at any time — checksums mitigate but don't eliminate the risk of a swapped binary since upstream updates without version bumps.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: imjiaoyuan <imjiaoyuan@gmail.com>
    
      2
    
      3# Prebuilt UCSC Genome Browser binaries. Upstream files are unversioned, so
    
      4# pkgver is the newest HTTP Last-Modified date (YYYYMMDD) across the group.
    
      5
    
      6pkgname=ucsc-bigwig-bin
    
      7pkgver=20260407
    
      8pkgrel=1
    
      9pkgdesc="UCSC bigWig format utilities: wigToBigWig, bedGraphToBigWig, bigWigToBedGraph, bigWigInfo, bigWigAverageOverBed, bigWigSummary, fetchChromSizes"
    
      10arch=('x86_64')
    
      11url="https://hgdownload.soe.ucsc.edu/admin/exe/linux.x86_64/"
    
      12license=('MIT')
    
      13# curl is needed by the fetchChromSizes helper script, not the binaries.
    
      14depends=('glibc' 'curl')
    
      15options=('!strip' '!debug')
    
      16source=("https://hgdownload.soe.ucsc.edu/admin/exe/linux.x86_64/bedGraphToBigWig"
    
      17        "https://hgdownload.soe.ucsc.edu/admin/exe/linux.x86_64/wigToBigWig"
    
      18        "https://hgdownload.soe.ucsc.edu/admin/exe/linux.x86_64/bigWigToBedGraph"
    
      19        "https://hgdownload.soe.ucsc.edu/admin/exe/linux.x86_64/bigWigInfo"
    
      20        "https://hgdownload.soe.ucsc.edu/admin/exe/linux.x86_64/bigWigAverageOverBed"
    
      21        "https://hgdownload.soe.ucsc.edu/admin/exe/linux.x86_64/bigWigSummary"
    
      22        "https://hgdownload.soe.ucsc.edu/admin/exe/linux.x86_64/fetchChromSizes"
    
      23        "LICENSE::https://raw.githubusercontent.com/ucscGenomeBrowser/kent/master/LICENSE")
    
      24sha256sums=('1a1527cf364e1e572a81c7284fc9ccd2b3690b5896baa5b57399864f85ad7771'
    
      25            'ff5fe900999fb55a0316466363637c6f2f492187543222e679b985ba5db3507f'
    
      26            '22f22e03e6c91561e2bdfa7f967e6e8a60ba7a9b3a7b09ef051162e7bcb90bed'
    
      27            '1fb4e7edbfbcfe79edd8b27af0c1ac29277b1f65f28a88f57558bf903da5b8b0'
    
      28            '77176ee93c01512f75c4a0b998ac39c35de8c694760dfab95e015ed871f32836'
    
      29            '4e05a2eb93165dff250a44b5fd89b4ac2460cfb2dc5a170f7ab8c668542c9867'
    
      30            '2fb9a503bb119e6c19ac874f9923c6fb7d7aeea8a099afa94b794704383d1a21'
    
      31            '793d774ec3941d88d5f93611639230030ea3e167282be144b6e5604bc5ad29a4')
    
      32
    
      33package() {
    
      34    install -Dm755 "$srcdir/bedGraphToBigWig"    "$pkgdir/usr/bin/bedGraphToBigWig"
    
      35    install -Dm755 "$srcdir/wigToBigWig"         "$pkgdir/usr/bin/wigToBigWig"
    
      36    install -Dm755 "$srcdir/bigWigToBedGraph"    "$pkgdir/usr/bin/bigWigToBedGraph"
    
      37    install -Dm755 "$srcdir/bigWigInfo"          "$pkgdir/usr/bin/bigWigInfo"
    
      38    install -Dm755 "$srcdir/bigWigAverageOverBed" "$pkgdir/usr/bin/bigWigAverageOverBed"
    
      39    install -Dm755 "$srcdir/bigWigSummary"       "$pkgdir/usr/bin/bigWigSummary"
    
      40    install -Dm755 "$srcdir/fetchChromSizes"     "$pkgdir/usr/bin/fetchChromSizes"
    
      41    install -Dm644 "$srcdir/LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      42}
    
      43

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	MEDIUM	3
2026-08-17 00:18:29	MEDIUM	3
2026-08-16 17:37:55	MEDIUM	3
2026-08-16 17:33:23	MEDIUM	2