From ripley at stats.ox.ac.uk  Thu Oct 15 16:13:06 2015
From: ripley at stats.ox.ac.uk (Brian Ripley)
Date: Thu, 15 Oct 2015 15:13:06 +0100
Subject: [Rd] Package integrity check via SHA256 or OpenPGP possible?
In-Reply-To: <44205912eaf5b26a3fee5eed9616f8e7@email.freenet.de>
References: <44205912eaf5b26a3fee5eed9616f8e7@email.freenet.de>
Message-ID: <26EF9147-ACE6-4503-9999-F10E415B4DB8@stats.ox.ac.uk>



> On 15 Oct 2015, at 08:11, Philip Gilli?en <guerda at freenet.de> wrote:
> 
> Dear list,
> 
> I'm using R in a corporate environment and was interested how R checks integrity of packages during an installation.
> I saw (and verified my suspicion in the code[1]) that the verification purely relies on MD5.
>> From an IT security perspective, this can be improved.

Maybe, but 'IT security' was not the point.  MD5 sums were added first as a way to check for corrupted downloads/unpacking (which used to be common on Windows), and second to reinforce the version number of a package as sometimes the source package is altered without changing the version, and less rarely binary packages are re-built.


> 
> My question is: Is is possible to force R to verify integrity via SHA256 or even OpenPGP signatures?
> If not are there any plans to support better hashes than MD5?
> As the source code looks, an extension to support other (optional) hash values would be quite easy.
> 
> Thanks in advance!
> 
> Kind regards,
> Philip
> 
> [1] see from line 594 on in src/library/tools/R/install.R in R-latest.tar.gz
> 
> 
> 
> 
> 
> 
> ---
> Alle Postf?cher an einem Ort. Jetzt wechseln und E-Mail-Adresse mitnehmen! http://email.freenet.de/basic/Informationen
> 
> 
> 
> ______________________________________________
> R-devel at r-project.org mailing list
> https://stat.ethz.ch/mailman/listinfo/r-devel



[Rd] Package integrity check via SHA256 or OpenPGP possible?
Brian Ripley