[Rd] R 3.0.1: wrong MD5 checksums for Windows?

[Duncan Murdoch]

On 13-05-18 5:37 PM, Duncan Murdoch wrote:
> On 13-05-17 2:01 PM, Tal Galili wrote:
>> Hello dear R-devel,
>>
>> I am not sure if this issue is tracked or not, but in case it isn't:
>> It appears that R 3.0.1 reproduces the error reported for R 3.0.0 here:
>> http://r.789695.n4.nabble.com/R-3-0-0-wrong-MD5-checksums-for-Windows-td4663348.html
>>
>> That is, that when installing R 3.0.1 on Windows 7, and then running:
>>
>> require(tools)
>> checkMD5sums(dir=R.home())
>>
>> It produces the error:
>> files ‘etc/Rconsole’, ‘etc/Rprofile.site’ have the wrong MD5 checksums
>> [1] FALSE
>>
>
> Technically speaking, that's just a message, not an error.  Those files
> were changed by the installer, so the information is correct.
>
>   From a user point of view, it does look like an error.  We could avoid
> the message in several ways:  don't bother checking those files, or
> compute the MD5 checksums on default installed versions of those files,
> or recompute the checksums after installation.
>
> I think the third choice is too hard, so it's not something I'd do.
>
> I don't know which of the other two is better.  A malicious attacker
> could do a lot of damage by messing with the Rprofile.site file; maybe a
> user would want to know if that had happened.  So that suggests the
> second choice.  But then users who don't choose whatever default the
> installer picks will always get the message.
>

I think the problem of a malicious attacker is pretty far-fetched, but 
an accidental change might be worth noting, so I've put the second 
choice in place in R-devel and R-patched.

Duncan Murdoch