Re: [R-pkg-devel] Ensuring permanence and SHA consistency of released CRAN packages for validated software

2022-03-16 Thread Dirk Eddelbuettel
On 16 March 2022 at 14:01, Henrik Bengtsson wrote: | Related to this, there's also been discussion (here or on R-devel), of | having `R CMD build` produce identical tarballs when the input doesn't | change, but the injection of `Packaged: ; ` to the | `DESCRIPTION` file prevents this. If I

Re: [R-pkg-devel] Ensuring permanence and SHA consistency of released CRAN packages for validated software

2022-03-16 Thread Duncan Murdoch
On 16/03/2022 5:01 p.m., Henrik Bengtsson wrote: Hi, I think this is a valid concern and feature request, and I believe it has been raised by others previously on one of our mailing lists. And what solution or resources for producing one did they offer? Here's a trivial solution that could

[R-pkg-devel] Ensuring permanence and SHA consistency of released CRAN packages for validated software

2022-03-16 Thread Borini, Stefano
Hello, Validated software needs to ensure consistency and reproducibility of its environment, potentially in years' time, when the audit comes. For this reason, we identify all SHA of the packages we download from CRAN to ensure that the package has not changed after the fact, something that