R devel - Nov 2019 - Patch idea: an environment variable for setting the user ID

Thanks, Kurt.

I think I now have enough time to write a patch. What are the steps? I have
read https://www.r-project.org/bugs.html#how-to-submit-patches but I do not
seem to have permission to create a Bugzilla account at
https://bugs.r-project.org/bugzilla/.

Will


On Mon, Nov 12, 2018 at 2:46 AM Kurt Hornik <Kurt.Hornik at wu.ac.at>
wrote:
> >>>>> Will L writes:
>
> > To R-devel,
> > In `R CMD build`, the ID of the user is automatically inserted into
the
> > DESCRIPTION file, e.g.
>
> > Packaged: 2018-11-06 14:01:50 UTC; <MY USER ID>
>
>
> > This is problematic for those of us who work in corporate settings. We
> must
> > not divulge our user IDs in the packages we develop and release.
>
> > Jim Hester pointed out that these two lines in
> > `add_build_stamp_to_description_file()`
> > <
>
https://github.com/wch/r-source/blob/521c90a175d67475b9f1b43d7ae68bc48062d8e6/src/library/tools/R/build.R#L170-L171
> >
> > are responsible. Could we consider his suggestion of using an optional
> > environment variable to overwrite the default behavior?
>
> > user <- Sys.getenv("R_BUILD_USERNAME")
> > if (!nzchar(user)) user <- Sys.info()["user"]
> > if(user == "unknown") user <-
Sys.getenv("LOGNAME")
>
> Yep, something along these lines should be possible.
> R_BUILD_USER or R_BUILD_LOGNAME may seem more natural though ...
>
> Best
> -k
>
>
>
> > Will Landau
> > --
> > wlandau.github.io
> > linkedin.com/in/wlandau
> > github.com/wlandau
>
> >       [[alternative HTML version deleted]]
>
> > ______________________________________________
> > R-devel at r-project.org mailing list
> > https://stat.ethz.ch/mailman/listinfo/r-devel
>

-- 
wlandau.github.io
linkedin.com/in/wlandau
github.com/wlandau

	[[alternative HTML version deleted]]

Another thing to consider if one wants to anonymize the build is the
UID/GID of the files in the tarball.  So there might be a need for a
R_BUILD_UID and R_BUILD_GID, e.g. by setting those to 32767
("nobody").

/Henrik

On Fri, Jan 25, 2019 at 9:25 AM Will L <will.landau at gmail.com>
wrote:
>
> Thanks, Kurt.
>
> I think I now have enough time to write a patch. What are the steps? I have
> read https://www.r-project.org/bugs.html#how-to-submit-patches but I do not
> seem to have permission to create a Bugzilla account at
> https://bugs.r-project.org/bugzilla/.
>
> Will
>
>
> On Mon, Nov 12, 2018 at 2:46 AM Kurt Hornik <Kurt.Hornik at wu.ac.at>
wrote:
>
> > >>>>> Will L writes:
> >
> > > To R-devel,
> > > In `R CMD build`, the ID of the user is automatically inserted
into the
> > > DESCRIPTION file, e.g.
> >
> > > Packaged: 2018-11-06 14:01:50 UTC; <MY USER ID>
> >
> >
> > > This is problematic for those of us who work in corporate
settings. We
> > must
> > > not divulge our user IDs in the packages we develop and release.
> >
> > > Jim Hester pointed out that these two lines in
> > > `add_build_stamp_to_description_file()`
> > > <
> >
https://github.com/wch/r-source/blob/521c90a175d67475b9f1b43d7ae68bc48062d8e6/src/library/tools/R/build.R#L170-L171
> > >
> > > are responsible. Could we consider his suggestion of using an
optional
> > > environment variable to overwrite the default behavior?
> >
> > > user <- Sys.getenv("R_BUILD_USERNAME")
> > > if (!nzchar(user)) user <- Sys.info()["user"]
> > > if(user == "unknown") user <-
Sys.getenv("LOGNAME")
> >
> > Yep, something along these lines should be possible.
> > R_BUILD_USER or R_BUILD_LOGNAME may seem more natural though ...
> >
> > Best
> > -k
> >
> >
> >
> > > Will Landau
> > > --
> > > wlandau.github.io
> > > linkedin.com/in/wlandau
> > > github.com/wlandau
> >
> > >       [[alternative HTML version deleted]]
> >
> > > ______________________________________________
> > > R-devel at r-project.org mailing list
> > > https://stat.ethz.ch/mailman/listinfo/r-devel
> >
>
>
> --
> wlandau.github.io
> linkedin.com/in/wlandau
> github.com/wlandau
>
>         [[alternative HTML version deleted]]
>
> ______________________________________________
> R-devel at r-project.org mailing list
> https://stat.ethz.ch/mailman/listinfo/r-devel

Maybe a further thing to consider is to introduce an environment 
variable by which one can avoid `add_build_stamp_to_description_file()` 
and any other calls altogether which affect bitwise reproducibility 
during the build process. If two users build the same package on exactly 
the same hardware and in the same software environment, the tarballs are 
expected to be identical. This is not the case now.

Denes

On 11/22/19 9:25 PM, Henrik Bengtsson wrote:
> Another thing to consider if one wants to anonymize the build is the
> UID/GID of the files in the tarball.  So there might be a need for a
> R_BUILD_UID and R_BUILD_GID, e.g. by setting those to 32767
> ("nobody").
> 
> /Henrik
> 
> On Fri, Jan 25, 2019 at 9:25 AM Will L <will.landau at gmail.com>
wrote:
>>
>> Thanks, Kurt.
>>
>> I think I now have enough time to write a patch. What are the steps? I
have
>> read https://www.r-project.org/bugs.html#how-to-submit-patches but I do
not
>> seem to have permission to create a Bugzilla account at
>> https://bugs.r-project.org/bugzilla/.
>>
>> Will
>>
>>
>> On Mon, Nov 12, 2018 at 2:46 AM Kurt Hornik <Kurt.Hornik at
wu.ac.at> wrote:
>>
>>>>>>>> Will L writes:
>>>
>>>> To R-devel,
>>>> In `R CMD build`, the ID of the user is automatically inserted
into the
>>>> DESCRIPTION file, e.g.
>>>
>>>> Packaged: 2018-11-06 14:01:50 UTC; <MY USER ID>
>>>
>>>
>>>> This is problematic for those of us who work in corporate
settings. We
>>> must
>>>> not divulge our user IDs in the packages we develop and
release.
>>>
>>>> Jim Hester pointed out that these two lines in
>>>> `add_build_stamp_to_description_file()`
>>>> <
>>>
https://github.com/wch/r-source/blob/521c90a175d67475b9f1b43d7ae68bc48062d8e6/src/library/tools/R/build.R#L170-L171
>>>>
>>>> are responsible. Could we consider his suggestion of using an
optional
>>>> environment variable to overwrite the default behavior?
>>>
>>>> user <- Sys.getenv("R_BUILD_USERNAME")
>>>> if (!nzchar(user)) user <- Sys.info()["user"]
>>>> if(user == "unknown") user <-
Sys.getenv("LOGNAME")
>>>
>>> Yep, something along these lines should be possible.
>>> R_BUILD_USER or R_BUILD_LOGNAME may seem more natural though ...
>>>
>>> Best
>>> -k
>>>
>>>
>>>
>>>> Will Landau
>>>> --
>>>> wlandau.github.io
>>>> linkedin.com/in/wlandau
>>>> github.com/wlandau
>>>
>>>>        [[alternative HTML version deleted]]
>>>
>>>> ______________________________________________
>>>> R-devel at r-project.org mailing list
>>>> https://stat.ethz.ch/mailman/listinfo/r-devel
>>>
>>
>>
>> --
>> wlandau.github.io
>> linkedin.com/in/wlandau
>> github.com/wlandau
>>
>>          [[alternative HTML version deleted]]
>>
>> ______________________________________________
>> R-devel at r-project.org mailing list
>> https://stat.ethz.ch/mailman/listinfo/r-devel
> 
> ______________________________________________
> R-devel at r-project.org mailing list
> https://stat.ethz.ch/mailman/listinfo/r-devel
>