Displaying 2 results from an estimated 2 matches for "sig_sign".
Did you mean:
sig_ign
2015 Oct 15
3
Package integrity check via SHA256 or OpenPGP possible?
Dear list,
I'm using R in a corporate environment and was interested how R checks integrity of packages during an installation.
I saw (and verified my suspicion in the code[1]) that the verification purely relies on MD5.
>From an IT security perspective, this can be improved.
My question is: Is is possible to force R to verify integrity via SHA256 or even OpenPGP signatures?
If not are
2015 Oct 15
0
Package integrity check via SHA256 or OpenPGP possible?
...lternatives that are more portable. The PKI package
uses openssl to do RSA signatures, which could work. The new 'sodium'
package is probably the most advanced thing currently available. It
uses the ed25519 public-key signature system with a very simple API.
See the manual page for the 'sig_sign' and 'sig_verify' functions.
Either way, all this would require a substantial amount of work and
additional ongoing maintenance in both R and CRAN, which is unlikely
to happen given the limited resources.
[1] http://http.us.debian.org/debian/dists/jessie/Release
[2] http://http.us.de...