ropensci-archive/notary

:no_entry: ARCHIVED :no_entry: Signing and Verification of R Packages

notary

This repository has been archived. The former README is now in README-NOT.md.

notary's Issues

Keep track of packages that were verified on installation?

Given that install.packages will still exist, do we need something to audit a library and see which packages were signed on install?

Pls review!

@richfitz @Ironholds @stephlocke @jeroen pls review: https://github.com/hrbrmstr/roweb/blob/master/_drafts/2017-07-25-notary.md

CRAN mirror MD5s validation check

Verify a CRAN mirror's package MD5 matches the canonical source's MD5 to ensure the integrity of a download from a specific mirror

Add pgp key to DESCRIPTION post install

Wrapper for gpg key gen

Allow users to create a gpg key via R

Verification function for `source()`

Allow for comparison between some hash/signature thing on a script and only run source() if it matches

RStudio dark theme: How to get it?

I realize this has nothing to do with the package itself but I saw the cool gif showing what appears to be a consistent dark theme applied to the RStudio IDE which is something I've wanted for years! Could you share how you achieved this? I'm hoping this is possible for both the server and desktop editions but I'll take what I can get. In any event notary is a hugely important package and I can't wait to try it out on my systems!

Archiving this package

@richfitz @hrbrmstr @stephlocke

We are in the process of cleaning up stale/unconf projects from ropenscilabs. We plan to archive this repo, unless anyone is interested in adopting it and transferring it to their personal user account.

Please let me know if you are interested, otherwise we will proceed with transferring it to https://github.com/ropensci-archive. We can always unarchive it if you change your mind later on.

Package signatures

Add a way for people to add a signature that can be verified into packages

Github installs with signed releases

A function to allow installation of releases that are signed

How do we handle unsigned dependencies?

Maybe from CRAN is OK but what about Remotes?

A git2r action: Check/add the ability to gpg sign activities

To facilitate R users seamlessly working with signed commits, we need might need to functionality in common git interfaces like git2r to facilitate signing. We should check and add things in if required.