R devel - Dec 2025 - Remove http parameters from filename in download.packages()

>>>>> Jeroen Ooms 
>>>>>     on Tue, 2 Dec 2025 22:33:05 +0100 writes:
    > Currently `download.packages()` copies the full `File`
    > field from the URL in PACKAGES, including http parameters,
    > as the local filename on disk. So for example, if the
    > `PACKAGES` file contains

    >    Package: jsonlite Version: 2.0.0 File:
    >
jsonlite_2.0.0.tar.gz?auth=blabla123&hash=79fad1b6092c1d1cc71e096d02cbc7618837fda1f90b61443f09adc25caab095

    > Then the file is saved on disk not as
    > `jsonlite_2.0.0.tar.gz` but as the full url including `?`
    > and `=` and `&` characters which are not supported and
    > create corrupt files on some platforms.

Yes... but why should a "CRAN-like repository" use such file names ?

The help(download.packages)   *title*  is

   Download Packages from CRAN-like Repositories
   ============================================


    > To reproduce this I created a testing repo:

    >     available.packages(repos     >
'https://jeroen.github.io/testrepo/')
    > download.packages('jsonlite', '.', repos     >
'https://jeroen.github.io/testrepo/')

    > The patch below makes the download behavior of R
    > correspond to browsers, which is to remove the http-query
    > part from `destfile` when downloading the package to disk.

    >   https://github.com/r-devel/r-svn/pull/215.diff

    > Thank you for considering.

I am considering, but still not convinced why it is needed (see above).
Maybe I'm overlooking something ?
Also, I'd have it as a switch (argument) of download.packages() in
order to provide back compatibility [no need for a new patch, though !]

Martin

On Wed, Dec 3, 2025 at 11:55?AM Martin Maechler
<maechler at stat.math.ethz.ch> wrote:
>
> >>>>> Jeroen Ooms
> >>>>>     on Tue, 2 Dec 2025 22:33:05 +0100 writes:
>
>     > Currently `download.packages()` copies the full `File`
>     > field from the URL in PACKAGES, including http parameters,
>     > as the local filename on disk. So for example, if the
>     > `PACKAGES` file contains
>
>     >    Package: jsonlite Version: 2.0.0 File:
>     >
jsonlite_2.0.0.tar.gz?auth=blabla123&hash=79fad1b6092c1d1cc71e096d02cbc7618837fda1f90b61443f09adc25caab095
>
>     > Then the file is saved on disk not as
>     > `jsonlite_2.0.0.tar.gz` but as the full url including `?`
>     > and `=` and `&` characters which are not supported and
>     > create corrupt files on some platforms.
>
> Yes... but why should a "CRAN-like repository" use such file
names ?
Such that we can host a "CRAN-like repository" on modern
infrastructure that may use this sort of URLs.
> I am considering, but still not convinced why it is needed (see above).
> Maybe I'm overlooking something ?
> Also, I'd have it as a switch (argument) of download.packages() in
> order to provide back compatibility [no need for a new patch, though !]
The patch should not break functionality; it only fixes an edge case
where R would otherwise write to an illegal filename on disk. I am
guessing nobody has used this yet so I am not sure what would be the
value of back compatibility to ensure R keeps doing this.

In either case the fix would only be useful if install.packages()
makes use of it.