Checksums of packages change on CRAN without change in version number

classic Classic list List threaded Threaded
1 message Options
Reply | Threaded
Open this post in threaded view

Checksums of packages change on CRAN without change in version number

Joris FA Meys
Dear all,

I report the same problem again, as one of our sysadmins at the university
ran into the same issue again. Every so often they find an in-place update
of an R package which almost always amounts to a small change in the
DESCRIPTION file. This does cause the checksums to change, and we end up
with two packages with the exact same version number but different

To date there hasn't been any satisfactory answer on how to avoid having to
update our own configuration builds a week after the initial update due to
these stealthy checksum changes.

It's also an increasing safety concern for our IT department, as they
seriously frown upon software that makes in-place changes. According to
them, there's no way they can know whether it is a legitimate change to the
package, or the result of some kind of hack. They have to rely on trust,
which is a dangerous thing to do in an IT context and which they like to

github report on the issue (this time it's mgcv) :


Joris Meys
Statistical consultant

Department of Data Analysis and Mathematical Modelling
Ghent University
Coupure Links 653, B-9000 Gent (Belgium)

Biowiskundedagen 2017-2018

Disclaimer :

        [[alternative HTML version deleted]]

[hidden email] mailing list