R devel - Dec 2025 - Remove http parameters from filename in download.packages()

Currently `download.packages()` copies the full `File` field from the
URL in PACKAGES, including http parameters, as the local filename on
disk. So for example, if the `PACKAGES` file contains

   Package: jsonlite
   Version: 2.0.0
   File:
jsonlite_2.0.0.tar.gz?auth=blabla123&hash=79fad1b6092c1d1cc71e096d02cbc7618837fda1f90b61443f09adc25caab095

Then the file is saved on disk not as  `jsonlite_2.0.0.tar.gz` but as
the full url including `?` and `=` and `&` characters which are not
supported and create corrupt files on some platforms.

To reproduce this I created a testing repo:

    available.packages(repos = 'https://jeroen.github.io/testrepo/')
    download.packages('jsonlite', '.', repos
'https://jeroen.github.io/testrepo/')

The patch below makes the download behavior of R correspond to
browsers, which is to remove the http-query part from `destfile` when
downloading the package to disk.

  https://github.com/r-devel/r-svn/pull/215.diff

Thank you for considering.

>>>>> Jeroen Ooms 
>>>>>     on Tue, 2 Dec 2025 22:33:05 +0100 writes:
    > Currently `download.packages()` copies the full `File`
    > field from the URL in PACKAGES, including http parameters,
    > as the local filename on disk. So for example, if the
    > `PACKAGES` file contains

    >    Package: jsonlite Version: 2.0.0 File:
    >
jsonlite_2.0.0.tar.gz?auth=blabla123&hash=79fad1b6092c1d1cc71e096d02cbc7618837fda1f90b61443f09adc25caab095

    > Then the file is saved on disk not as
    > `jsonlite_2.0.0.tar.gz` but as the full url including `?`
    > and `=` and `&` characters which are not supported and
    > create corrupt files on some platforms.

Yes... but why should a "CRAN-like repository" use such file names ?

The help(download.packages)   *title*  is

   Download Packages from CRAN-like Repositories
   ============================================


    > To reproduce this I created a testing repo:

    >     available.packages(repos     >
'https://jeroen.github.io/testrepo/')
    > download.packages('jsonlite', '.', repos     >
'https://jeroen.github.io/testrepo/')

    > The patch below makes the download behavior of R
    > correspond to browsers, which is to remove the http-query
    > part from `destfile` when downloading the package to disk.

    >   https://github.com/r-devel/r-svn/pull/215.diff

    > Thank you for considering.

I am considering, but still not convinced why it is needed (see above).
Maybe I'm overlooking something ?
Also, I'd have it as a switch (argument) of download.packages() in
order to provide back compatibility [no need for a new patch, though !]

Martin