search for: sig_sign

Dear list, I'm using R in a corporate environment and was interested how R checks integrity of packages during an installation. I saw (and verified my suspicion in the code[1]) that the verification purely relies on MD5. >From an IT security perspective, this can be improved. My question is: Is is possible to force R to verify integrity via SHA256 or even OpenPGP signatures? If not are

...lternatives that are more portable. The PKI package uses openssl to do RSA signatures, which could work. The new 'sodium' package is probably the most advanced thing currently available. It uses the ed25519 public-key signature system with a very simple API. See the manual page for the 'sig_sign' and 'sig_verify' functions. Either way, all this would require a substantial amount of work and additional ongoing maintenance in both R and CRAN, which is unlikely to happen given the limited resources. [1] http://http.us.debian.org/debian/dists/jessie/Release [2] http://http.us.de...

...ls is actually namespace, via -n */ if (cert_principals == NULL || @@ -3645,6 +3693,10 @@ main(int argc, char **argv) "missing key"); exit(1); } + if (nidentity_files > 1) { + error("Too many keys specified for sign"); + exit(1); + } return sig_sign(identity_file, cert_principals, prefer_agent, argc, argv, opts, nopts); } else if (strncmp(sign_op, "check-novalidate", 16) == 0) { @@ -3660,8 +3712,13 @@ main(int argc, char **argv) "missing signature file"); exit(1); } + if (nidentity_files >...

Hello, I'm currently evaluating using `ssh-keygen -Y verify` to check OS artifacts (e.g. packages) and I noticed that the `-f allowed_signers_file` option can be passed only once. A side remark: technically it can be passed multiple times without a warning but the last invocation overrides all previous ones. Tested using: $ ssh-keygen -Y verify -f allowed_signers -f /dev/null -n file -s