ARROW-4995: [R] Support for winbuilder for CRAN checks #4011
Conversation
javierluraschi
force-pushed
the
bugfix/rwinbuilder
branch
from
76eaf9f to
0f36cb5
Compare
Codecov Report
@@ Coverage Diff @@
## master #4011 +/- ##
==========================================
+ Coverage 87.83% 87.85% +0.02%
==========================================
Files 734 736 +2
Lines 90433 90595 +162
Branches 1252 1252
==========================================
+ Hits 79431 79593 +162
Misses 10885 10885
Partials 117 117
Continue to review full report at Codecov.
|
javierluraschi
force-pushed
the
bugfix/rwinbuilder
branch
from
d0a7d2c to
7a9e816
Compare
|
@wesm mentioned in the dev mailing list he would want to see the R bindings build in Windows without rwinlibs, the previous commit adds support for setting |
|
Investigated further the I also added an error for the function using compress under windows and scoped the Hopefully this wraps up this PR. Thanks! |
| #' @param codec a codec | ||
| #' @export | ||
| CompressedOutputStream <- function(stream, codec = compression_codec("GZIP")){ | ||
| if (.Platform$OS.type == "windows") stop("'CompressedOutputStream' is unsupported in Windows.") |
There was a problem hiding this comment.
Is this because of missing compression libraries?
There was a problem hiding this comment.
That is correct. We can probably solve this by figuring out which are the missing dependencies and adding support to compile them in Mingw, but I much rather suggest we disable this functionality in the 0.13 in Windows.
| dir.create("../windows", showWarnings = FALSE) | ||
| unzip("lib.zip", exdir = "../windows") | ||
| unlink("lib.zip") | ||
| } |
There was a problem hiding this comment.
This is definitely scary-looking and appears to introduce a dependency on binaries in a foreign repository, which is an attack vector. For example, a malicious actor could inject Arrow libraries into this repository with malicious code in them that sends them files from your %HOME% directory (this is what already happened to the NPM community). I don't know who has access to this repository and if anyone who does has their keys stolen or their GitHub account compromised (maybe they don't have 2FA enabled) then we are in trouble
If we're going to have dependencies on libraries such as these, at minimum we should have a SHA256/SHA512 hash for what we expect their contents to be to prevent malicious code from getting shipped.
Of course, a preferable solution is to build libraries locally based on the source code in the archive
Can you open some follow up JIRA issues about this?
There was a problem hiding this comment.
|
@wesm can we reopen this PR? Not sure why it got closed, thanks! |
4 participants
Fix for https://issues.apache.org/jira/browse/ARROW-4995. winbuilder provides a test environment similar to the CRAN build infrastructure to validate packages before submitting to CRAN. This PR fixes the remaining warnings flagged by this sytem.