Download to the Rocket cluster¶

User manual to download data from FEGA to the UTHPC cluster.

Data download consists of two separate tasks:

Apply for data access.
File download.

Apply for data access¶

Login into REMS .
Browse Catalogue for different datasets.
If you find the desired dataset, press the Add to cart button at the end of the dataset. If you wish, you can add several datasets and request access to several datasets at the same time.
The cart is shown in top part of webpage.
When you have finished adding datasets, press the Apply button in bottom of the cart.
The data request form will open, which you can review and if everything seems correct, click Send application.
Contact Vlad or Tommy, who can review application and approve data access.

Generate a C4GH key pair¶

Log into UTHPC cluster with your account.
All terminal commands must be run in the terminal window of the UTHPC cluster.
To activate the crypt4gh command-line tool type in terminal window:
```
module load crypt4gh/1.8.5
```
Run command to generate the key pair. It's highly recommended to insert a passphrase and safe it for later use:
```
crypt4gh generate -n <c4gh_name>
```
Where:
- <c4gh_name> is the name of your crypt4gh key file.
You will be asked to insert a passphrase, it's highly recommended to do so and save the passphrase for later use.
The output of the above mentioned command is comprised of two files <c4gh_name>.sec.pem and <c4gh_name>.pub.pem the crypt4gh private and public key accordingly.

File download¶

Download is possible only, when you have access to at least one dataset, that contains also at least one file.

Get Elixir AAI token¶

Go to https://fega.etais.ee/login to get Elixir AAI token.

You should see the access token with the Copy to clipboard button below (click it).

Make the environment token¶

Copy the token and make the environment token. On the terminal run command:

export token=<access token>

Where:

<access token> is Elixir AAI token from the previous step.

Datasets¶

Check for the datasets made available to you. On the terminal run command:

curl -H "Authorization: Bearer $token" https://download.fega.etais.ee/metadata/datasets

The list of datasets available to you will be displayed.

Example output

[
    "EGAD50000000191",
    "EGAD50000000199"
]

Important

Access token is valid for 1 hour only. To continue after 1 hour you have to retrieve and re-export a new token by repeating steps 1&2. If you are granted access to new datasets and you don't see them, then please clear your browser cache and start again from step 1.

Files in the dataset¶

Check the files in the dataset.

In order to make your browsing experience more human eye friendly run command:

module load jp

or

module load jq/1.6

Check the files in the dataset. On the terminal run command:

curl -H "Authorization: Bearer $token" https://download.fega.etais.ee/metadata/datasets/<datasetID>/files | jq

Where:

<datasetID> is dataset ID from step 3 (EGAD50000000199 in our example).

Example output

[
    {
        "fileId":"EGAF50000105398",
        "datasetId":"EGAD50000000199",
        "displayFileName":"2023-10-24 sample 1.vcf.c4gh",
        "filePath":"tommy.tomson_ut.ee/2023-10-24 sample 1.vcf.c4gh",
        "fileName":"ef8bf4a3-0cb6-4c96-8083-c3112ee5b994",
        "fileSize":18708836,
        "decryptedFileSize":18700828,
        "decryptedFileChecksum":"37176ae411436fcd6ecb29b35c7070ce073947faaca7a9725a271908dd2f7f78",
        "decryptedFileChecksumType":"SHA256",
        "fileStatus":"verified",
        "createdAt":"2023-10-24T07:17:54.696721Z",
        "lastModified":"2023-10-24T07:22:00.811049Z"
    },
    {
        "fileId":"EGAF50000105399",
        "datasetId":"EGAD50000000199",
        "displayFileName":"2023-10-24 sample 2.vcf.c4gh",
        "filePath":"tommy.tomson_ut.ee/2023-10-24 sample 2.vcf.c4gh",
        "fileName":"424982b8-ae47-4c20-a667-df760b8613a1",
        "fileSize":29248578,
        "decryptedFileSize":29236062,
        "decryptedFileChecksum":"ee58889e66fa3034f7612d970daae7ac9bc669c97e3d45a0617e54fd63e22cba",
        "decryptedFileChecksumType":"SHA256",
        "fileStatus":"verified",
        "createdAt":"2023-10-24T07:18:57.010961Z",
        "lastModified":"2023-10-24T07:22:00.830143Z"
    }
]

Encryption¶

For data protection purposes all files are downloaded in encrypted form and can be decrypted later by you only. Therefore first create the crypt4gh public key (<c4gh public key>) from Generate a c4gh key pair into an environment variable.

Encode crypt4gh public key into base64 format and transform it into an environment variable. On the terminal run command:

export c4ghpubkey=$(cat <c4gh_name>.pub.pem| base64 |tr -d '\n')

Where:

<c4gh_name> is the name of your crypt4gh key file.

Download¶

Download the selected file. On the terminal run command:

curl -H "Authorization: Bearer $token" -H "C4GH-PublicKey: $c4ghpubkey" https://download.fega.etais.ee/files/<fileID> --output <destinationFileName>.c4gh

Where:

<fileID> is file ID from step 4 (EGAF50000105398 in our example).
<destinationFileName> is a filename you want to save the file you download under on your local system. NB! the downloaded file is encrypted, so it is highly recommended to retain the .c4gh extension for clarity when you assign a new name to the file.

The downloaded file will be saved into the current active directory of your local system.

Decrypt the downloaded file¶

Storing sensitive data files in decrypted form is not recommended.

Should decryption be ultimately necessary, activate the required software module in your UTHPC cluster terminal window:

module load crypt4gh/1.8.5

To decrypt the downloaded file in the respective directory run command:

crypt4gh decrypt --file=<my_data_file> -s <c4gh_name>.sec.pem

Where:

<my_data_file> is the name of your file that you want to decrypt,
<c4gh_name>.sec.pem is the crypt4gh private key file name.
You will be requested to enter the passphrase for your encryption key, if you added one upon its creation. You should have a new file without the ending .c4gh - this is your decrypted file.

Using downloaded data files directly without decryption¶

All genomic data formats accepted by FEGA metadata portal are supported by HTSlib and can be opened and used as inputs by HTSlib integrated software (https://www.htslib.org/doc/ ) without prior decryption. For this you need to load the latest version of respective software tool package (e.g samtools/1.19, bcftools/1.19 or just htslib/1.19) and supplement it with the cryp4gh-agent in order to create an environment, which contains your activated decryption (private) key.

Type in the terminal window:

module load htslib-crypt4gh/1.19

In order to activate the environment containing your private decryption key run the following command:

crypt4gh-agent -k < c4gh.sec.pem>

Where:

<c4gh.sec.pem> is the private key from the key pair from the Generate a C4GH key pair step described above.

While remaining in the environment you have just created, you can identify what kind of high-throughput sequencing data files the specified files are (or view compressed FASTA, FASTQ files) with the help of HTSlib htsfile command (https://www.htslib.org/doc/htsfile.html ), open/view/stream/process sequence alignment files (samtools) or variant call files (BCFtools) with no need for prior decryption. In fact storing sensitive data files in decrypted manner should be discouraged.

To determine the file type (for example the filename contains no or insufficient information on the file type, since you forgot to add the type specific extension when you renamed it) on the rocket cluster:

Activate (the latest encryption aware & plugin compatible) HTSlib module:

module load htslib/1.19

Syntax:

htsfile [-chHv] FILE...

Examples

htsfile mydata.R1.fastq.gz
mydata.R1.fastq.gz: FASTQ sequence text

htsfile unknownfile.BBB
unknownfile.BBB:    CRAM version 3.0 compressed sequence data

htsfile unknownfile.XXX
unknownfile.XXX     crypt4gh data

To determine the file type an crypt4gh data file on the Rocket you should prefer the crypt4gh plug-in enabled HTSlib module instead:

module load htslib/1.19
module load htslib-crypt4gh/1.19
crypt4gh-agent -k mykey.sec  -- htsfile unknownfile.BBB
Passphrase?
unknownfile.BBB:    CRAM version 3.0 compressed sequence data

To view the contents of the encrypted genomic data file you should prefer the crypt4gh plug-in enabled HTSlib module instead:

module load htslib/1.19
module load htslib-crypt4gh/1.19

For a one off view of the contents of the file use the following sequence of commands and expect to be asked for the passphrase:

crypt4gh-agent -k mykey.sec  -- htsfile –view <my_data_file>.c4gh
Passphrase?

Examples

[user@login2 c4ghtest]$ crypt4gh-agent -k MyCryptKey.sec.pem -- htsfile --view vN4YMN_mini.R1.fastq.gz.c4gh
Passphrase?

Will print to your screen:

HeilsaFAKE:519:YMNvN4:1:1:0:0   4   *   0   0   *   *   0   0   TCTGCTTATAGGTTACCCATTGCCTAATTATACCCTCTTTAATTTTAGTGAGTTCAAGCTTCTCCTTTTGTTGCTCAAGGGGGTTATTGAGAGTGTGTTAACACAGAAACTGTTGCACAGTATTTT  BBBBBFFFFFFFFFFFF<FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF<FFFFFFFFFFFF/F/FFFFFFFFFFFFFFFFFFFFFF/FFFFFFFFFFFBBFFFBFFFFFF/FFFFFBBBFFBB
HeilsaFAKE:519:YMNvN4:1:1:1:0   4   *   0   0   *   *   0   0   TCAGCTTGCAATACCCCTTTTTTAGACTTTCCAAACAGGCACTTCTGGCCTTGTTCTTTGTGTAGGCAGACAGTATTGGTTGCCTATCTTAGGAGTACTAGACTGGGTTTGAATCCTGAACCCACC  BBBBBF/F<FFFFFFBFFFFFFFBFFFB/FFF//F<F/<<<BFF<FFBF<F/FBBFF/FFFF/FF<FFF/B/<F/FB/F/7<F<F/F//B<F/<7//</FFFBF<</<7</B/B//////B<7//F
HeilsaFAKE:519:YMNvN4:1:1:2:0   4   *   0   0   *   *   0   0   GCACAGCAGTTCCTCCTCTCTTGCCCCAGACCCTTGCCTGCTCCTGTGGTCAGTGAAGCCTTGGGCTCTGGTCTGAGCTGGGACTGAATGGCTGTCTAAATCCATTCAGGCTGCTGTAACAAATTA  BBBBBFFFBFFFFFFFFFFFFBFFFFFFFBFFFFBFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFBFFF<FBFFFFFFFBFFF<FFFFFFFFFFF/F/FFFFFF<FFFBFBF<F<FFBFFF<FFF<
HeilsaFAKE:519:YMNvN4:1:1:3:0   4   *   0   0   *   *   0   0   TTACATCAATACTGGATACATTTTAACTTTAAGAATGAGCATAGAGGACAAGTTGTATAACGCTTAATGCAAATGATTAGGGAAATAATAAATCACTTTATATAAAAATTGATTTAATGATTCTAA  BBBBBFFFFFFFFFBFFFFFFFFFFFFFFBFFF/FFFFFFFB<FFFFFF<FFBFFFFFFBFFFFFFBFFBFFFFFFFF<FFFFFFFBFFFFFFFFFFFFFFBFF<FFF<BFFFFFFFFFFFFFBBF
HeilsaFAKE:519:YMNvN4:1:1:4:0   4   *   0   0   *   *   0   0   CCAGCATTCAGCATACAGAGGATCCACACTGGCACCGGCCTCTGAGTTCCCTTAGTATTTATTGATCATTATCGAGCATGGCAGGATAATAGAATAATAGTGGAGAGAAGGTCAGAAGGTAAACAC  BBBBBFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFBFFFFFFFFFFFF/FF/FFFFFFFFFFFBFFFFFFFFF/FFFFFFFFFFFFFFFFFB/FFF/F/FFFF<FF<FFFF/FFF<FFFFFFFFF<
HeilsaFAKE:519:YMNvN4:1:1:5:0   4   *   0   0   *   *   0   0   TCAAGAGAAATTTGTAATCAAAAAATGAAAGTAAGACGAATGGCCCAGAAACCCGCATTTTATTGACAGTCATTTTCCCACAGAGAATCTTAGAAAGATGTCGCGTTTTCTTTTAATGAATGAGAG  BBBB<FFFFFFFFFFFFFFBFFFFFFFFFFFFFFFFFFFBFFFFFFFFFFFFFFFFFFFFFB/FF<FFFFFFFFBFFBBFFFFFFFFFFBBFFFFFF<FFFFFFFF/FFFFFFFFFBF7FFFFFFF
HeilsaFAKE:519:YMNvN4:1:1:6:0   4   *   0   0   *   *   0   0   GTTTATGGGAAGAGGCTTCTGAAATCAGACAAAGCCTTTCAAACCCTTAGACCAACCTTCAGAGTTAGGCGACATGGCTTCTCCCCTTTCTAGGTCCTGTGACAGCCATCTTGCTATTACTCGCCT  BBBBBFFFFF/FF/FFFFF/FFFFFFFFFFF/FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFBFBFFFBFFFFFFFFFFFFFFFFFFFF<FFFFFBBFFFFFF<FBFFF/FFFFF
HeilsaFAKE:519:YMNvN4:1:1:7:0   4   *   0   0   *   *   0   0   ATATACAGATGCTCCTCAATTTATGATGGGGTTACATCTGGATAAACTTATTGCACTTTGAAAATATTGTAAGTCAAAAATGTATTTTTAACTTAGAGTATTTTCAACTTATAATGGGTTTATCTG  BBBBBFFBFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF<FFFFFFFF/FFFFFFFBFFFBFFFFFFFFFFFFFFBBFBFFF<FFF7FFFFFFFFFFB/
HeilsaFAKE:519:YMNvN4:1:1:8:0   4   *   0   0   *   *   0   0   TATCAGGTGATGCACCATTATTTCTGCCATATTCTATTCTTTAGAAGTCTAGTTCACCATCAAGAAGAGAATTAAGCTCCACTTTTTAAAGGGAAAAGTAGACAATAATTTGTGGAGATAGTTTTA  BBBBBFFFFFFFFBFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFBFFFFFFFFFFFF<FFBFFFFFF/FFFFFFFFFFFFBFFFFFFFFFFFFFFF/FFFFFFFBF/FF<FFBFBFFFFFF7FF
HeilsaFAKE:519:YMNvN4:1:1:9:0   4   *   0   0   *   *   0   0   ATGATTCTCAGAAACTCCTTTGTGATGTGTGCGTTCAACTCACAGAGTTTAACCTTTCTTTTCATAGAGCAGGTAGGAAACACTCTGTTTGTAAAGTCTGCAAGTGGATATTCAGACCTCCTTGAG  BB/BBFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFBFFFFFFFFFFFBFFFFFFFFFFFFFBFFFFFFF7FFFFBFFFFFFFBFFFFBFFF<FBFB/FFFFBFFFBF/FFFFFFBFFFF/
HeilsaFAKE:519:YMNvN4:1:1:10:0  4   *   0   0   *   *   0   0   ACCCTTCTGTCTTAAACCCAAGGGGCCCAGCTGAGCTTGTCACCCAACCTGCTTGTGTCACCTAGCCTGCAGCATGCCCCACCTACTGCCCCAACCTGTTTCCTCCCATTCATTCCACCCGCAGCT  BBBBBFFFFFFFF<FFFFBFFFFFFFFFFFFBFFFFFFFFBFFFFFFFFFF/FFFFFFFFFFFBFFFFFFFFFFFFFFFFFFBFFFBF/FFFFFFFFFFFFFFF<FFFFFFFFFFFFFFFFF/FFB
HeilsaFAKE:519:YMNvN4:1:1:11:0  4   *   0   0   *   *   0   0   GGGTATAGGGGACTTGGTCCCTAGCAGGCTCAGTAGACTTGTGAGTGGTTGCATTGAATGCCGGCCATCAGGCACCTTTGCGTAAATGTGGGCAAACCTGGTCAAGCAGAGTAATTGGGAAATGGA  BBBBBFFF<FFFFFFFFFFFFFFFFFFFFFFFBFFF/FFFFFFF<FFFFFFFFFBFFFFF/FFFFFFBFFFFFFFF<FFFFF/FFFFFFBFFFFFFFBFFFFF<FBFFFF7FFBFFFFFBFFFFFF

The following command starts the agent in a longer lasting environment with your secret decryption key remaining uploaded and active until you exit the environment via simple exit command:

[username@login2]$ crypt4gh-agent -k mykey.sec
Passphrase?

Now view contents of the simple FASTQ file:

htsfile --view myfile.R1.fastq.gz.c4gh | more

Will give:

HeilsaFAKE:733:BBBvBB:1:1:0:0   4   *   0   0   *   *   0   0   CCAAAGGCCGTGGACGACGGGATTGTGAGCGACTTTTCTCTAGTGTTTTCTATTTGAGATTTGAAATACCCATGCTTTTCATCTGGTCCAAGGAGGCTCAGGTTTCCTTGGCTGTGCGCAACTATA  BB/BBFFFFFFFFFFFFFFFFFFF/FF<FFFFBFFBFFFFF<FFFFFFFFFFFFFFBFFFFFFFFFFFFFFFFFFFBFFBFFFFFFFFFFBFFFFFFFFFFFFFFFFF/BFFFFFFFFFFF/FFFB
HeilsaFAKE:733:BBBvBB:1:1:1:0   4   *   0   0   *   *   0   0   TGGAACCAATTCCTCATGGATATGGAGGGACGAGGAACCACTGTAGTTAAACAAATAATCACTTTAAAACTTAAAACCTTTTGCATGGTGAATACAGTCGTGCACCGCATATATGATGGTGGTCCA  BBBBBFFFFFFFFFFFFFFFFFFFFFBFFFFFF<FFFFFFFFB/FFFFFFFF/BFFFFFFFFFBFFFFFBFFFFFFFBFFFFFFFFFFFFFFFFF</BFFFFFBFFFFFFFF<FFFFFFBFB/FF/
HeilsaFAKE:733:BBBvBB:1:1:2:0   4   *   0   0   *   *   0   0   GTATAAACTTTACCTACCAATTGCAATACCTTGGGAAGGAGTCTTAGCACTTCTTCCTGCCTCCTCAGTTGAGAATCACTGATTTACAGTGATCTGGTCAAGACTTTTTGCTGGCAATCCAAAAAG  BBBBBFFFFFFFFFFFFFF/FFFFFFFFFFBFFFFFFFFFFFFFFFBFFFF<FF<FF/FFFFFFFFFFFFFFFFFFFFBFFFF<FFFFFFFFFFFFBFFFFFFFFFFFFFFF<FFFFFFBFFFFFF
HeilsaFAKE:733:BBBvBB:1:1:3:0   4   *   0   0   *   *   0   0   TCTCATCTGCCCTTTCTTTTTTTCCTCCTACCCTCCTCCTTTCGGGTTAATTGTGTATTGGCTTCTAAGCATAACTTTTTTTTTGTTTTTGCTCTAGGATTAACTTTTTATTTATTTTTATTTTAT  BBBBBFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFBFFFFFFFFFFFFFFFFFBFFFFFFFFFFFFBFFFFFFFF<FFF//FFBFFFFFFBFFFFFFFFFFFF<FFFFFFFBFFFFFBFFFFFF
HeilsaFAKE:733:BBBvBB:1:1:4:0   4   *   0   0   *   *   0   0   AAGATTTAGACACCGGCTTCTCTGTCCCAAGAATCTTCTGTGTACTGCATTTTCCCTAATTAAAAATGAGGGTATTTCAACCTTCCAAAATATTGTTGAGTCCCACAGATTATTGAACACCTTGAG  BBBBBFBFBFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF<FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFBFFFFFFFFFFFFFF<FFFFFFFFFFFBBFFFFFBFFF/FFFFFFFF
HeilsaFAKE:733:BBBvBB:1:1:5:0   4   *   0   0   *   *   0   0   ATTTAATTGTACCTTTTAAAATAACTTAAAGAGTATAATTGGATTGTTTGTAACACAAAGGATAAATACTTGAGGAGATGGATAACCTATTTTCCATGACATGATTATTACGCATTGCATGCCTGT  BBBBBFFFFFFFFFFFFFFFFFFFFFFFFFFFBFFFFFFFFFFFFFFFFFFFFFFFFF<FFBFBFF<FFFFFFBBFFFFFFFFFFF/FF/FFFFFF<FFFBFBFFFF<BFFBBFFFBF<FFFFFFF
HeilsaFAKE:733:BBBvBB:1:1:6:0   4   *   0   0   *   *   0   0   CAGAAAGAGACAGGAGATAAGCATGACAAAATATAGGGAAGAAATGACTTTTGCCTAAACTTCCAAACTGTGTACAATTGAAGCCTCTGCTTTATAGCTCTTAGCACACCTCTCAAATAAGAAGGC  <B<BB</B/F<FFFFFB</<FFBFBF<</FF/FFBFFF//FFF/FBFFFF//FFBFB<F<FB<F/<<F/<F<//F<B<F/</F<//7/F///F<//F7<FB/B//<///F/<<//<<B/BF/F<7B
HeilsaFAKE:733:BBBvBB:1:1:7:0   4   *   0   0   *   *   0   0   TTATAAAGCAAGGGGCTAGACTCTAGATATGCACTTTTTATTAAATAGTACAGCAGCCTGTAGCCACATGTGGCTATTAATCTTTGAAATGTGGGTAGTCTGAATTGTGATGTTCTGCAAACATAA  BBBBBFFFFFFFFFFFFFF<FFFFFFFFFF<FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFBFFFFFFFFFFFFFFFFBFFFF<FFBFBFFFFFFFFFFFFBFF/FFFFFFFFFFFF7BFF<FFF
HeilsaFAKE:733:BBBvBB:1:1:8:0   4   *   0   0   *   *   0   0   TTTCCAACTTACTTTGGAAGAGGGCATAGCCCCACCTTGTAGCAAAGGAATTAATGAGCTAAATTCCCAACAGCAGTAAATATTGTAAGATGAAAATATACGTAAGTACTTAAATTTCAAGTCATG  BBBBBFF/FFF<FFFFFF/FBFFFFF<FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFBFFBFFFFFF<FF/FFFF<FFFFF<

Following the previous example to open/view/stream/process sam/bam/cram files in the crypt4gh-agent key activated environment load the encryption aware samtools module:

module load samtools/1.19
samtools <command> <argument> myfile.cram.c4gh

e.g.

samtools view -h myfile.cram.c4gh

or

samtools tview [-p chr:pos] myfile.sorted.bam my_mapping_ref.fasta

For full overview of <command> <argument> options for samtools see: https://www.htslib.org/doc/samtools.html .

Likewise to open/view/stream/process variant call (vcf/bcf) files in the crypt4gh-agent key activated environment load the encryption aware BCFtools module :

module load bcftools/1.19
bcftools <command> <argument> myfile.vcf.gz.c4gh

For full overview of <command> <argument> options for BCFtools see: https://www.htslib.org/doc/1.0/bcftools.html .

To convert between formats SAM/BAM/CRAM file to FASTA or FASTQ see: https://www.htslib.org/doc/samtools-fasta.html .

To leave the crypt4gh-agent enabled environment and deactivate the decryption key use the simple exit command.

Download only selected regions of the genomic data¶

Retrieval of selected regions requires the source file to be indexed. Download the respective index file for the data file of your interest from the secure data repository. For instructions see the download step.

Load the required software module (samtools or BCFtools) to read or manipulate the data file of your interest.

Activate the environment containing decryption key:

module load htslib-crypt4gh/1.19
crypt4gh-agent -k < c4gh.sec.pem>

Where:

<c4gh.sec.pem> is the private key from the KeyPair from the Generate a C4GH key pair step.

If you do not need to use the full length data files in your planned downstream bioinformatics analysis, it is highly recommended to save storage space and download only the required regions.

In the secret decryption key activated environment to extract and save only the region 10135-11000 from Chr1 to the local storage disk pipe the curl download through genomic region filtering with samtools using the following command line:

module load samtools/1.19

curl --silent -H "Authorization: Bearer $token" -H "C4GH-PublicKey: $c4ghpubkey" https://download.fega.etais.ee/files/<fileID> | samtools view -h -X crypt4gh:- crypt4gh:<my.downloaded.indexfile.c4gh> chr1:10135-11000 > <destination.regions.FileName>

Where:

<fileID> is file ID from datasets step (EGAF50000105398 in our example).
<destination.regions.FileName> is the downloaded file name in your system. NB! the filtered download output file is decrypted, but it is possible to extend the piped command with re-encryption on the fly. In the latter case the environment requires both the download privte/secret key and the chosen re-encryption public key <my_key.pub> to be handed to the crypt4gh-agent in the preparatory step:
```
module load htslib-crypt4gh/1.19
crypt4gh-agent -k < c4gh.sec.pem> -k <my_key.pub>
```
The downloaded index file <my.downloaded.indexfile.c4gh> must be in the current active directory of your terminal or the filename extended with the full path to the file location.