Patch idea: an environment variable for setting the user ID

classic Classic list List threaded Threaded
5 messages Options
Reply | Threaded
Open this post in threaded view
|

Patch idea: an environment variable for setting the user ID

landau
To R-devel,


In `R CMD build`, the ID of the user is automatically inserted into the
DESCRIPTION file, e.g.

Packaged: 2018-11-06 14:01:50 UTC; <MY USER ID>


This is problematic for those of us who work in corporate settings. We must
not divulge our user IDs in the packages we develop and release.

Jim Hester pointed out that these two lines in
`add_build_stamp_to_description_file()`
<https://github.com/wch/r-source/blob/521c90a175d67475b9f1b43d7ae68bc48062d8e6/src/library/tools/R/build.R#L170-L171>
are responsible. Could we consider his suggestion of using an optional
environment variable to overwrite the default behavior?

user <- Sys.getenv("R_BUILD_USERNAME")
if (!nzchar(user)) user <- Sys.info()["user"]
if(user == "unknown") user <- Sys.getenv("LOGNAME")

Will Landau
--
wlandau.github.io
linkedin.com/in/wlandau
github.com/wlandau

        [[alternative HTML version deleted]]

______________________________________________
[hidden email] mailing list
https://stat.ethz.ch/mailman/listinfo/r-devel
Reply | Threaded
Open this post in threaded view
|

Re: Patch idea: an environment variable for setting the user ID

Kurt Hornik-5
>>>>> Will L writes:

> To R-devel,
> In `R CMD build`, the ID of the user is automatically inserted into the
> DESCRIPTION file, e.g.

> Packaged: 2018-11-06 14:01:50 UTC; <MY USER ID>


> This is problematic for those of us who work in corporate settings. We must
> not divulge our user IDs in the packages we develop and release.

> Jim Hester pointed out that these two lines in
> `add_build_stamp_to_description_file()`
> <https://github.com/wch/r-source/blob/521c90a175d67475b9f1b43d7ae68bc48062d8e6/src/library/tools/R/build.R#L170-L171>
> are responsible. Could we consider his suggestion of using an optional
> environment variable to overwrite the default behavior?

> user <- Sys.getenv("R_BUILD_USERNAME")
> if (!nzchar(user)) user <- Sys.info()["user"]
> if(user == "unknown") user <- Sys.getenv("LOGNAME")

Yep, something along these lines should be possible.
R_BUILD_USER or R_BUILD_LOGNAME may seem more natural though ...

Best
-k



> Will Landau
> --
> wlandau.github.io
> linkedin.com/in/wlandau
> github.com/wlandau

> [[alternative HTML version deleted]]

> ______________________________________________
> [hidden email] mailing list
> https://stat.ethz.ch/mailman/listinfo/r-devel

______________________________________________
[hidden email] mailing list
https://stat.ethz.ch/mailman/listinfo/r-devel
Reply | Threaded
Open this post in threaded view
|

Re: Patch idea: an environment variable for setting the user ID

landau
Thanks, Kurt.

I think I now have enough time to write a patch. What are the steps? I have
read https://www.r-project.org/bugs.html#how-to-submit-patches but I do not
seem to have permission to create a Bugzilla account at
https://bugs.r-project.org/bugzilla/.

Will


On Mon, Nov 12, 2018 at 2:46 AM Kurt Hornik <[hidden email]> wrote:

> >>>>> Will L writes:
>
> > To R-devel,
> > In `R CMD build`, the ID of the user is automatically inserted into the
> > DESCRIPTION file, e.g.
>
> > Packaged: 2018-11-06 14:01:50 UTC; <MY USER ID>
>
>
> > This is problematic for those of us who work in corporate settings. We
> must
> > not divulge our user IDs in the packages we develop and release.
>
> > Jim Hester pointed out that these two lines in
> > `add_build_stamp_to_description_file()`
> > <
> https://github.com/wch/r-source/blob/521c90a175d67475b9f1b43d7ae68bc48062d8e6/src/library/tools/R/build.R#L170-L171
> >
> > are responsible. Could we consider his suggestion of using an optional
> > environment variable to overwrite the default behavior?
>
> > user <- Sys.getenv("R_BUILD_USERNAME")
> > if (!nzchar(user)) user <- Sys.info()["user"]
> > if(user == "unknown") user <- Sys.getenv("LOGNAME")
>
> Yep, something along these lines should be possible.
> R_BUILD_USER or R_BUILD_LOGNAME may seem more natural though ...
>
> Best
> -k
>
>
>
> > Will Landau
> > --
> > wlandau.github.io
> > linkedin.com/in/wlandau
> > github.com/wlandau
>
> >       [[alternative HTML version deleted]]
>
> > ______________________________________________
> > [hidden email] mailing list
> > https://stat.ethz.ch/mailman/listinfo/r-devel
>


--
wlandau.github.io
linkedin.com/in/wlandau
github.com/wlandau

        [[alternative HTML version deleted]]

______________________________________________
[hidden email] mailing list
https://stat.ethz.ch/mailman/listinfo/r-devel
Reply | Threaded
Open this post in threaded view
|

Re: Patch idea: an environment variable for setting the user ID

Henrik Bengtsson-5
Another thing to consider if one wants to anonymize the build is the
UID/GID of the files in the tarball.  So there might be a need for a
R_BUILD_UID and R_BUILD_GID, e.g. by setting those to 32767
("nobody").

/Henrik

On Fri, Jan 25, 2019 at 9:25 AM Will L <[hidden email]> wrote:

>
> Thanks, Kurt.
>
> I think I now have enough time to write a patch. What are the steps? I have
> read https://www.r-project.org/bugs.html#how-to-submit-patches but I do not
> seem to have permission to create a Bugzilla account at
> https://bugs.r-project.org/bugzilla/.
>
> Will
>
>
> On Mon, Nov 12, 2018 at 2:46 AM Kurt Hornik <[hidden email]> wrote:
>
> > >>>>> Will L writes:
> >
> > > To R-devel,
> > > In `R CMD build`, the ID of the user is automatically inserted into the
> > > DESCRIPTION file, e.g.
> >
> > > Packaged: 2018-11-06 14:01:50 UTC; <MY USER ID>
> >
> >
> > > This is problematic for those of us who work in corporate settings. We
> > must
> > > not divulge our user IDs in the packages we develop and release.
> >
> > > Jim Hester pointed out that these two lines in
> > > `add_build_stamp_to_description_file()`
> > > <
> > https://github.com/wch/r-source/blob/521c90a175d67475b9f1b43d7ae68bc48062d8e6/src/library/tools/R/build.R#L170-L171
> > >
> > > are responsible. Could we consider his suggestion of using an optional
> > > environment variable to overwrite the default behavior?
> >
> > > user <- Sys.getenv("R_BUILD_USERNAME")
> > > if (!nzchar(user)) user <- Sys.info()["user"]
> > > if(user == "unknown") user <- Sys.getenv("LOGNAME")
> >
> > Yep, something along these lines should be possible.
> > R_BUILD_USER or R_BUILD_LOGNAME may seem more natural though ...
> >
> > Best
> > -k
> >
> >
> >
> > > Will Landau
> > > --
> > > wlandau.github.io
> > > linkedin.com/in/wlandau
> > > github.com/wlandau
> >
> > >       [[alternative HTML version deleted]]
> >
> > > ______________________________________________
> > > [hidden email] mailing list
> > > https://stat.ethz.ch/mailman/listinfo/r-devel
> >
>
>
> --
> wlandau.github.io
> linkedin.com/in/wlandau
> github.com/wlandau
>
>         [[alternative HTML version deleted]]
>
> ______________________________________________
> [hidden email] mailing list
> https://stat.ethz.ch/mailman/listinfo/r-devel

______________________________________________
[hidden email] mailing list
https://stat.ethz.ch/mailman/listinfo/r-devel
Reply | Threaded
Open this post in threaded view
|

Re: Patch idea: an environment variable for setting the user ID

Dénes Tóth-2
Maybe a further thing to consider is to introduce an environment
variable by which one can avoid `add_build_stamp_to_description_file()`
and any other calls altogether which affect bitwise reproducibility
during the build process. If two users build the same package on exactly
the same hardware and in the same software environment, the tarballs are
expected to be identical. This is not the case now.

Denes

On 11/22/19 9:25 PM, Henrik Bengtsson wrote:

> Another thing to consider if one wants to anonymize the build is the
> UID/GID of the files in the tarball.  So there might be a need for a
> R_BUILD_UID and R_BUILD_GID, e.g. by setting those to 32767
> ("nobody").
>
> /Henrik
>
> On Fri, Jan 25, 2019 at 9:25 AM Will L <[hidden email]> wrote:
>>
>> Thanks, Kurt.
>>
>> I think I now have enough time to write a patch. What are the steps? I have
>> read https://www.r-project.org/bugs.html#how-to-submit-patches but I do not
>> seem to have permission to create a Bugzilla account at
>> https://bugs.r-project.org/bugzilla/.
>>
>> Will
>>
>>
>> On Mon, Nov 12, 2018 at 2:46 AM Kurt Hornik <[hidden email]> wrote:
>>
>>>>>>>> Will L writes:
>>>
>>>> To R-devel,
>>>> In `R CMD build`, the ID of the user is automatically inserted into the
>>>> DESCRIPTION file, e.g.
>>>
>>>> Packaged: 2018-11-06 14:01:50 UTC; <MY USER ID>
>>>
>>>
>>>> This is problematic for those of us who work in corporate settings. We
>>> must
>>>> not divulge our user IDs in the packages we develop and release.
>>>
>>>> Jim Hester pointed out that these two lines in
>>>> `add_build_stamp_to_description_file()`
>>>> <
>>> https://github.com/wch/r-source/blob/521c90a175d67475b9f1b43d7ae68bc48062d8e6/src/library/tools/R/build.R#L170-L171
>>>>
>>>> are responsible. Could we consider his suggestion of using an optional
>>>> environment variable to overwrite the default behavior?
>>>
>>>> user <- Sys.getenv("R_BUILD_USERNAME")
>>>> if (!nzchar(user)) user <- Sys.info()["user"]
>>>> if(user == "unknown") user <- Sys.getenv("LOGNAME")
>>>
>>> Yep, something along these lines should be possible.
>>> R_BUILD_USER or R_BUILD_LOGNAME may seem more natural though ...
>>>
>>> Best
>>> -k
>>>
>>>
>>>
>>>> Will Landau
>>>> --
>>>> wlandau.github.io
>>>> linkedin.com/in/wlandau
>>>> github.com/wlandau
>>>
>>>>        [[alternative HTML version deleted]]
>>>
>>>> ______________________________________________
>>>> [hidden email] mailing list
>>>> https://stat.ethz.ch/mailman/listinfo/r-devel
>>>
>>
>>
>> --
>> wlandau.github.io
>> linkedin.com/in/wlandau
>> github.com/wlandau
>>
>>          [[alternative HTML version deleted]]
>>
>> ______________________________________________
>> [hidden email] mailing list
>> https://stat.ethz.ch/mailman/listinfo/r-devel
>
> ______________________________________________
> [hidden email] mailing list
> https://stat.ethz.ch/mailman/listinfo/r-devel
>

______________________________________________
[hidden email] mailing list
https://stat.ethz.ch/mailman/listinfo/r-devel