From guerda at freenet.de  Thu Oct 15 09:11:07 2015
From: guerda at freenet.de (=?UTF-8?B?UGhpbGlwIEdpbGxpw59lbg==?=)
Date: Thu, 15 Oct 2015 09:11:07 +0200
Subject: [Rd] Package integrity check via SHA256 or OpenPGP possible?
Message-ID: <44205912eaf5b26a3fee5eed9616f8e7@email.freenet.de>

Dear list,

I'm using R in a corporate environment and was interested how R checks integrity of packages during an installation.
I saw (and verified my suspicion in the code[1]) that the verification purely relies on MD5.
>From an IT security perspective, this can be improved.

My question is: Is is possible to force R to verify integrity via SHA256 or even OpenPGP signatures?
If not are there any plans to support better hashes than MD5?
As the source code looks, an extension to support other (optional) hash values would be quite easy.

Thanks in advance!

Kind regards,
Philip

[1] see from line 594 on in src/library/tools/R/install.R in R-latest.tar.gz






---
Alle Postf?cher an einem Ort. Jetzt wechseln und E-Mail-Adresse mitnehmen! http://email.freenet.de/basic/Informationen





[Rd] Package integrity check via SHA256 or OpenPGP possible?
=?UTF-8?B?UGhpbGlwIEdpbGxpw59lbg==?=