| checkSHA256sums {tools} | R Documentation |
Check and Create ‘SHA256’ Checksum Files
Description
checkSHA256sums checks the files against a file ‘SHA256’.
verifySHA256signature implies checkSHA256sums but also
verifies GnuPG detached signature in file ‘SHA256.sig’.
Usage
checkSHA256sums(package, dir)
verifySHA256signature(package, dir)
Arguments
package |
the name of an installed package |
dir |
the path to the top-level directory of an installed package. |
Details
The file ‘SHA256’ which is a text file with the following entries separated by a single space each: hash (64-digit hexadecimal representation of the SHA-256 hash), size of the file in bytes and the file path.
If dir is missing, an installed package of name package
is searched for.
The private function tools:::.installSHA256sums is used to create
‘SHA256’ files.
verifySHA256signature relies on the GnuPG (GPG) tool
to perform the verification. The environment variable GPG can
override the default command gpg.
In order to ascertain the validity of a signature, it is necessary to
obtain the public key of the signer and add it to a keyring for
trust. verifySHA256signature will first look for any files in
the file.path(R.home("etc"), "keyrings") directory with
‘.gpg’ extensions (if they exist) and any keyrings in
the ‘~/.R/keyrings’ user directory. If this yields no success
then the user's default GnuPG keyring is consulted, including any
local user settings.
Value
checkSHA256sums returns a logical, NA if there is no
‘SHA256’ file to be checked.
verifySHA256signature returns a logical, NA if there is
no ‘SHA256.sig’ file to be checked or if GnuPG is not available
for checking. If TRUE or FALSE then additional
information is supplied as a list in the "result"
attribute. The attribute as well as its entries are considered
optional, but most commonly populated values are:
fingerprint |
string, hexadecimal representation of the fingerprint of the public key that signed the signature |
keyid |
string, hexadecimal key id |
userid |
string, user id (typically name and e-mail address of the signer) |
ts |
|
missing.pubkey |
logical, |
OpenPGP does not mandate the presence of any other fields in
signatures other than ts and keyid, but most modern
signatures include the fingerprint and userid.