In pkgaudit v0.4.0, pattern and match rules describe what code does;
phases resolved from file-context and code-context rules describe when
it runs. All rules are defined in YAML files under inst/rules/
and compiled into the SQLite database at inst/db/rules.db.
This vignette is generated from that database, at rules v0.4.0; the Rule
columns below link to the defining YAML.
Patterns
Patterns are security-relevant function calls, such as
system(). Qualified (pkg::fn()) and
unqualified (fn()) call forms are both detected. A rule
that declares its function names also flags calls made through a name –
do.call("system", ...), match.fun("system"),
and getFunction("system"). Pattern rules carry MITRE ATT&CK technique
labels.
Pattern findings are returned in the $patterns data
frame of a pkgaudit object. Its indirect column marks a
call made through a function’s name; its guarded column
marks code that ships but the lifecycle does not run – a
\dontrun{} block, or a vignette chunk suppressed by
eval=FALSE or #| eval: false. Note: A
\donttest{} block is not guarded: a plain
R CMD check skips it, but --as-cran runs
it.
| Rule | Pattern | Description |
|---|---|---|
| chmod |
Sys.chmod(), Sys.umask()
|
Sys.chmod() sets a file’s permission bits from R, and Sys.umask() sets the mask applied to everything created afterwards. Making a file executable, or setting its setuid or setgid bit, turns something the package shipped as data into something that can be run – in the setuid case, with the privileges of whoever owns it rather than whoever runs it. Every call is matched, whatever mode it sets. |
| credentials | a path or environment variable that only holds a secret:
~/.ssh/, ~/.aws/, .netrc,
id_rsa, ~/.gnupg/, and
Sys.getenv() of a name containing TOKEN,
SECRET, PASSWORD or API_KEY
|
A path or environment variable that only exists to hold a secret. Nothing a package needs in order to install or load lives in these, and package code runs with the full privileges of whoever installed it. The literal has to look like a path or a short command rather than a sentence, since prose that merely mentions ~/.ssh is not a package reading it – but naming one is still not proof it is read, so read the line. |
| curl |
curl(), curl_fetch_memory(),
curl_fetch_disk(), curl_fetch_stream(),
curl_fetch_multi(), curl_download(),
curl_upload(), multi_download(),
multi_run(), send_mail()
|
A curl network call sends an outbound HTTP request or opens a connection to a remote host. A request may be used to exfiltrate credentials or other data, or to fetch a remote payload. |
| decoding |
base64decode(), base64_dec(),
base64_decode(), memDecompress(),
rawToChar(as.raw())
|
These functions decode or decompress data. Payloads may be encoded (e.g., as base64) to evade static detection and decoded at runtime. |
| deserialization |
readRDS(), load(),
unserialize(), dget()
|
readRDS(), load(), unserialize(), and dget() deserialize R objects or code, which can enable arbitrary code execution (CVE-2024-27322 for RDS). |
| download_file |
download.file(), url()
|
download.file() and url() retrieve or open a connection to a remote resource. This can stage a payload for execution via source() or system() in a two-stage attack. |
| dynload |
dyn.load(), library.dynam()
|
dyn.load() and library.dynam() load compiled code from a shared object, which executes outside the visible R source. |
| eval_parse |
eval()/evalq() over parse(),
str2lang() or str2expression(), when the text
came from a fetch, a decode, a deserialization, a subprocess or a file
read – most functions the rules for those already cover, plus
readLines(), scan(), readBin()
and rawToChar(); callr’s and processx’s generically named
entry points are not matched |
Text that came from somewhere pkgaudit cannot read, parsed and then evaluated. Any one of these calls is ordinary on its own; together in one expression they are a payload being assembled and run. The inner set is every function the rules for fetching, decoding, deserializing, running a subprocess and running Python already cover, plus the file reads no rule covers on its own. |
| fs |
file_chmod(), file_chown()
|
fs::file_chmod() sets a file’s permission bits, and fs::file_chown() changes its owner. Making a file executable, or setting its setuid or setgid bit, turns something the package shipped as data into something that can be run – in the setuid case, with the privileges of whoever owns it rather than whoever runs it. Every call is matched, whatever mode or owner it sets. |
| httr |
GET(), POST(), PUT(),
PATCH(), DELETE(), HEAD(),
VERB()
|
An httr HTTP call sends an outbound request. A request may be used to exfiltrate credentials or other data, or to fetch a remote payload. |
| httr2 |
req_perform(), req_perform_iterative(),
req_perform_parallel(),
req_perform_sequential(),
req_perform_stream(),
req_perform_connection(),
req_perform_promise()
|
An httr2 HTTP call sends an outbound request. A request may be used to exfiltrate credentials or other data. |
| install |
install.packages(), install_github(),
install_gitlab(), install_bitbucket(),
install_git(), install_url(),
install_version(), install_local(),
install_bioc(), install_dev(),
install_cran(), pak(),
pkg_install(), local_install(),
lockfile_install(), BiocManager::install(),
renv::install(), devtools::install(),
py_install(), virtualenv_install(),
conda_install(), virtualenv_create(),
conda_create()
|
These functions install packages, optionally from a specified or remote source. A non-default source can introduce attacker-controlled code. |
| namespace |
getFromNamespace(), getExportedValue(),
getAnywhere(), assignInNamespace(),
assignInMyNamespace(), unlockBinding()
|
These functions reach past a package namespace. getFromNamespace(), getExportedValue() and getAnywhere() read objects a package does not export; assignInNamespace(), assignInMyNamespace() and unlockBinding() replace or unseal bindings in a namespace already loaded, so an ordinary call made later can run something else. The ::: operator is not matched here, since R CMD check already reports it. |
| options_repos | options(repos = ) |
options(repos = …) replaces the CRAN mirror for the R session. Subsequent install.packages() calls will fetch packages from the configured repository. If set to an attacker-controlled server, this poisons the installation source. |
| persistence | a startup file or scheduler: ~/.bashrc,
~/.zshrc, ~/.profile,
~/.Rprofile, ~/.Renviron,
crontab, LaunchAgents,
/etc/systemd
|
A shell startup file, an R startup file, or a scheduler. Code written into one of these runs again on every login or on a timer, outside the install that put it there, and removing the package does not undo it. .Rprofile and .Renviron are the same idea one level in: R reads them at every session. The literal has to look like a path or a short command rather than a sentence, since prose that merely mentions ~/.bashrc is not a package writing to it. |
| python |
py_run_string(), py_run_file(),
py_eval(), source_python(),
py_call(), import_builtins()
|
These functions run Python from R through reticulate. pkgaudit does not read Python, so what they run is outside this scan entirely – and code passed as a string is not even a file the coverage frame can account for. import_builtins() is listed with them because it returns Python’s own eval, exec and import. |
| rcurl |
getURL(), getURI(),
getForm(), postForm(),
curlPerform()
|
An RCurl network call sends an outbound HTTP request. A request may be used to exfiltrate credentials or other data, or to fetch a remote payload. |
| socket |
socketConnection(), make.socket(),
serverSocket(), socketAccept()
|
These functions open a raw network socket, which may be used to exfiltrate data or receive a remote payload outside the usual HTTP clients. |
| source | source() |
source() can fetch and execute local and remote R scripts. |
| system |
system(), system2(), shell(),
pipe()
|
system(), system2(), shell() (on Windows), and pipe() execute arbitrary shell commands. |
| system_callr |
callr::r(), r_bg(), r_safe(),
r_copycat(), r_vanilla(),
callr::rcmd(), rcmd_bg(),
rcmd_safe(), rcmd_copycat(),
rscript(), r_session$new(),
r_process$new(), rcmd_process$new(),
rscript_process$new()
|
These callr functions start a separate R session or run an R CMD command, which may be used to execute arbitrary R code or shell commands outside the visible R source. |
| system_processx |
processx::run(), processx::pipeline(),
process$new()
|
These processx functions run an external process, which may be used to execute arbitrary shell commands outside the visible R source. |
| system_sys |
exec_wait(), exec_background(),
exec_internal(), eval_safe(),
eval_fork(), r_background(),
r_internal(), r_wait()
|
These sys functions run an external process or fork the R session, which may be used to execute arbitrary shell commands or a second R session outside the visible R source. |
Matches
Matches are regular-expression matches in shell code: the shell
scripts and Make-like files among the file
contexts below, and the bash, sh, and
zsh chunks a vignette yields. Regular expressions are
matched with gregexpr(perl = TRUE) and are case-sensitive.
Match rules carry MITRE
ATT&CK technique labels.
Note: Matching text is less precise than matching a parse tree. A match has no syntax behind it, so a match inside a comment, a quoted string, or a branch that never runs is reported the same as one in a live command.
| Rule | Description |
|---|---|
| chmod | Making a file executable, or setting its setuid or setgid bit, during a build turns something the package shipped as data into something that can be run – in the setuid case, with the privileges of whoever owns it rather than whoever runs it. A fully permissive umask is matched too: it withholds nothing, so everything the build creates afterwards is world-writable. |
| credentials | A build script naming a credential store is reading, or preparing to read, something that only exists to authenticate its owner. Nothing a package needs in order to build lives in these files, and a build runs with the full privileges of whoever installs the package. |
| curl | curl fetches a remote resource or sends data to a remote host. In a shell script or Make-like file it runs when the package is built, checked, or installed, and may be used to fetch a remote payload or to exfiltrate credentials or other data. |
| decoding | A decoding command turns bytes that are not readable as text back into something that is. In a build script it is most often seen immediately before the result is run or written to disk, which is how a payload is carried past a reader who only skims the source. |
| install | Installing software during a package build reaches outside the package for code and runs it. What arrives is chosen by a remote index rather than by the package under audit, and is not covered by this scan or by the R dependency graph. |
| interpreter | A build script that calls another language’s interpreter runs code pkgaudit does not read. The script it runs may live in the package, be written by an earlier step, or be fetched; either way its contents are not part of this scan. |
| persistence | A build script touching a startup file or a scheduler is arranging to run again later, outside the install that put it there. Removing the package does not undo it. .Rprofile and .Renviron are the same idea one level in: R reads them at the start of every session. |
| rscript | Rscript runs R code from a shell script or Make-like file, either from a file it is given or inline with -e. That code executes when the package is built, checked, or installed, and pkgaudit does not parse it: code inside an -e string, or in a script under tools/, is reached only through this invocation. The invocation is reported so a reviewer can follow it. |
| socket | Opening a socket from a build script moves data to or from a remote host without an HTTP client, which is both a way to fetch a payload and a way to send one out. A shell redirection to /dev/tcp does it with no external program at all. |
| transfer | A file-transfer command moves a file between the build machine and a remote host. Unlike an HTTP fetch it often carries credentials of its own, and it runs in whichever direction the script asks for, so it is a way to send data out as well as to bring code in. |
| wget | wget fetches a remote resource or sends data to a remote host. In a shell script or Make-like file it runs when the package is built, checked, or installed, and may be used to fetch a remote payload or to exfiltrate credentials or other data. |
Phases and Contexts
Lifecycle Phases
Phases describe when code executes. Each pattern and match finding
carries one logical column per phase, so findings can be filtered by
when they execute, e.g.,
subset(result$patterns, at_install_src).
| Phase | Code runs when |
|---|---|
at_autoconf |
Autoconf is run to generate configure from its
input |
at_build |
R CMD build |
at_check |
R CMD check |
at_install_src |
R CMD INSTALL from source |
at_install_bin |
a prebuilt binary package is installed |
at_load |
the namespace is loaded |
at_attach |
the package is attached to the search path |
at_unload |
the namespace is unloaded |
at_detach |
the package is detached from the search path |
Pattern phases are resolved from code and file contexts, in that
order. A pattern in a code context defined by a rule, such as
.onLoad, takes that context’s phases. A pattern in
top-level code takes its file context’s phases. A pattern in a regular
function definition depends on the assume_called field of
the file-context rule: if TRUE, it takes the phases of
whatever encloses it; if FALSE, as under R/,
it receives no phase. A helper defined under R/ may still
be called from a lifecycle hook, so human review of hooks should verify
whether that occurs. Matches take their file context’s phases.
Every phase value below was established by running instrumented
packages through R CMD build, R CMD check and
R CMD INSTALL and recording which sites fired, rather than
read from documentation. A rule can belong to several phases, and a
Phases column reads none for code that runs at no phase at
all.
File Contexts
File contexts are files that may contain code. All are scanned, and
some are reported as findings in their own right: in general, those that
execute at build, check, or install time, including shell and Make-like
scripts and src/install.libs.R.
| Rule | Type | Report | Phases | Description |
|---|---|---|---|---|
| R_scripts | R |
no |
at_build, at_check,
at_install_src
|
R source files in R are evaluated when the package is installed from source, when the lazy-load database is built. They are scanned for code contexts and patterns; the files themselves are not a finding, which is why this rule does not report. |
| R_scripts_unix | R |
no |
at_build, at_check,
at_install_src
|
R source files in R/unix are evaluated when the package is installed from source, when the lazy-load database is built. They are scanned for code contexts and patterns; the files themselves are not a finding, which is why this rule does not report. |
| R_scripts_windows | R |
no |
at_build, at_check,
at_install_src
|
R source files in R/windows are evaluated when the package is installed from source, when the lazy-load database is built. They are scanned for code contexts and patterns; the files themselves are not a finding, which is why this rule does not report. |
| cleanup | shell |
yes | at_build |
cleanup is a shell script run on Unix-like systems at the end of R CMD build, and during installation from source only under R CMD INSTALL –clean or –preclean. It can execute arbitrary shell commands. |
| cleanup_ucrt | shell |
yes | at_build |
cleanup.ucrt is a shell script run on the Windows UCRT toolchain at the end of R CMD build, and during installation from source only under R CMD INSTALL –clean or –preclean; it takes precedence over cleanup.win when present. It can execute arbitrary shell commands. |
| cleanup_win | shell |
yes | at_build |
cleanup.win is a shell script run on Windows at the end of R CMD build, and during installation from source only under R CMD INSTALL –clean or –preclean. It can execute arbitrary shell commands. |
| configure | shell |
yes |
at_build, at_check,
at_install_src
|
configure is a shell script used for system-dependent configuration when a package is installed from source, including the installs performed by R CMD check and by R CMD build when a package has vignettes. It can execute arbitrary shell commands. |
| configure_ac | shell |
yes | at_autoconf |
configure.ac is an Autoconf input file that does not itself execute; it is processed by Autoconf to generate the configure script, which executes shell commands when a package is installed from source. |
| configure_in | shell |
yes | at_autoconf |
configure.in is a legacy-named Autoconf input file that does not itself execute; it is processed by Autoconf to generate the configure script, which executes shell commands when a package is installed from source. |
| configure_ucrt | shell |
yes |
at_build, at_check,
at_install_src
|
configure.ucrt is a shell script for system-dependent configuration on the Windows UCRT toolchain, executed when a package is installed from source, including the installs performed by R CMD check and by R CMD build when a package has vignettes; it takes precedence over configure.win when present. It can execute arbitrary shell commands. |
| configure_win | shell |
yes |
at_build, at_check,
at_install_src
|
configure.win is a shell script for system-dependent configuration on Windows, executed when a package is installed from source, including the installs performed by R CMD check and by R CMD build when a package has vignettes. It can execute arbitrary shell commands. |
| data_scripts | R |
no |
at_build, at_install_src
|
A .R file under data/ is R code that runs when the package’s data is prepared. R CMD build evaluates it to produce the .rda it ships, and installation from a source directory evaluates it too, so it executes arbitrary R before the package is ever loaded. It does not survive into a source tarball: build replaces it with its own output. |
| data_serialized | other |
no |
at_check, at_install_src,
at_load
|
A serialized R object under data/. With LazyData it is deserialized at installation and restored when the namespace loads; R CMD check deserializes it either way. Deserializing an .rda or .rds can execute arbitrary code, and pkgaudit cannot inspect one, so it is recorded rather than passed over as inert data. |
| demo_scripts | R |
no | none | A demo runs when a user calls demo(), and R CMD check runs it under –run-demo. It ships in the installed package and runs with the user’s privileges when invoked. |
| description | other |
no | none | DESCRIPTION is not inert. Its Authors@R field is R code. R CMD build, check and INSTALL refuse to evaluate anything outside person, as.person, c, list, paste and paste0, so they are not the exposure. Developer tooling pointed at an unpacked source tree is: desc evaluates the field with no allowlist, so reading the authors – or printing a desc object – runs whatever it holds. That is not a lifecycle phase, so this rule declares none. pkgaudit does not read the file, so the row records that it can execute and was not examined. |
| exec_other | other |
no | none | A script under exec/ in a language pkgaudit does not read ships in the installed package and is marked executable. A lifecycle command does not necessarily run it, but it executes with the user’s privileges when invoked. Only certain file extensions are covered by this rule. |
| exec_scripts_R | R |
no | none | R scripts under exec/ ship in the installed package and are marked executable. A lifecycle command does not necessarily run them, but they execute with the user’s privileges when invoked. |
| exec_scripts_shell | shell |
no | none | Shell scripts under exec/ ship in the installed package and are marked executable. A lifecycle command does not necessarily run them, but they execute arbitrary shell with the user’s privileges when invoked. Only sh-family extensions are covered by this rule. |
| inst_citation | R |
no | at_check |
inst/CITATION is R code that utils::readCitationFile() evaluates. R CMD check reads it, and so does any user who calls citation() on the installed package. |
| inst_tests | R |
no | at_check |
Older versions of testthat kept tests under inst/tests/, which R CMD check runs through a runner in tests/. Unlike tests/, inst/ is copied into the installed package, so this code also ships to the user. |
| inst_tinytest | R |
no | at_check |
tinytest keeps its tests under inst/tinytest/, which R CMD check runs through a runner in tests/. Unlike tests/, inst/ is copied into the installed package, so this code also ships to the user and can be run again after installation. |
| inst_unittests | R |
no | at_check |
RUnit keeps its tests under inst/unitTests/, which R CMD check runs through a runner in tests/. Unlike tests/, inst/ is copied into the installed package, so this code also ships to the user. |
| inst_web | other |
no | none | JavaScript shipped under inst/ runs in a browser when a user renders the widget or app it belongs to, not at any package lifecycle phase. It is still code the package ships and pkgaudit does not read, so it is recorded and can be exported. |
| man_pages | Rd |
no |
at_build, at_check,
at_install_src
|
Help files in man carry R code in two places: , which R CMD check runs, and , which is evaluated when the help page is rendered during R CMD build and installation from source. They are scanned for patterns; the files themselves are not a finding, which is why this rule does not report. |
| man_pages_unix | Rd |
no |
at_build, at_check,
at_install_src
|
Help files in man/unix carry R code in two places: , which R CMD check runs, and , which is evaluated when the help page is rendered during R CMD build and installation from source. They are scanned for patterns; the files themselves are not a finding, which is why this rule does not report. |
| man_pages_windows | Rd |
no |
at_build, at_check,
at_install_src
|
Help files in man/windows carry R code in two places: , which R CMD check runs, and , which is evaluated when the help page is rendered during R CMD build and installation from source. They are scanned for patterns; the files themselves are not a finding, which is why this rule does not report. |
| r_sysdata | other |
no |
at_check, at_install_src,
at_load
|
R/sysdata.rda holds a package’s internal objects and is restored into the namespace when the package loads. Deserializing it can execute arbitrary code, and pkgaudit cannot inspect it. |
| rprofile | R |
no |
at_build, at_install_src
|
R evaluates a .Rprofile found in the working directory when it starts, so a .Rprofile at the package root runs before any package is loaded, earlier than any other R in the package. It does not survive into a source tarball: R CMD build excludes it, so a check of a built package never sees it. |
| src_compiled | other |
no |
at_check, at_install_src,
at_load
|
Compiled source is built into a package’s shared object by R CMD INSTALL and loaded with the namespace. pkgaudit does not read it; the row exists so the file is accounted for, and export_unscanned() can hand it to a tool that does. The extensions are listed rather than left to the directory, so that compiled source shipped anywhere else – a header library under inst/include/, say – is accounted for too. |
| src_install_libs_R | R |
yes |
at_build, at_check,
at_install_src
|
src/install.libs.R is an R script used in some packages to install executable programs and other binaries during installation from source, including the installs performed by R CMD check and by R CMD build when a package has vignettes. It can run arbitrary R code. |
| src_makefile | make |
yes |
at_build, at_check,
at_install_src
|
src/Makefile is a makefile used to compile code in src/ when a package is installed from source, replacing R’s default make rules; the installs performed by R CMD check and by R CMD build also use it, and R CMD build runs its clean target. It is read by make and its recipes execute arbitrary shell commands. |
| src_makefile_ucrt | make |
yes |
at_build, at_check,
at_install_src
|
src/Makefile.ucrt is a makefile used to compile code in src/ on the Windows UCRT toolchain when a package is installed from source, replacing R’s default make rules; it takes precedence over Makefile.win when present, the installs performed by R CMD check and by R CMD build also use it, and R CMD build runs its clean target. It is read by make and its recipes execute arbitrary shell commands. |
| src_makefile_win | make |
yes |
at_build, at_check,
at_install_src
|
src/Makefile.win is a makefile used to compile code in src/ on Windows when a package is installed from source, replacing R’s default make rules; the installs performed by R CMD check and by R CMD build also use it, and R CMD build runs its clean target. It is read by make and its recipes execute arbitrary shell commands. |
| src_makevars | make |
yes |
at_build, at_check,
at_install_src
|
src/Makevars sets make variables used to compile code in src/ when a package is installed from source, including the installs performed by R CMD check and by R CMD build; R CMD build also reads it when cleaning src/. It is read by make and can execute shell via make constructs such as $(shell …). |
| src_makevars_in | make |
yes |
at_build, at_check,
at_install_src
|
src/Makevars.in is a template that does not itself execute; it is processed by the configure script to generate src/Makevars, whose contents are then read by make to compile code in src/ when a package is installed from source, including the installs performed by R CMD check and by R CMD build. |
| src_makevars_ucrt | make |
yes |
at_build, at_check,
at_install_src
|
src/Makevars.ucrt sets make variables used to compile code in src/ on the Windows UCRT toolchain when a package is installed from source, including the installs performed by R CMD check and by R CMD build; it takes precedence over Makevars.win, and R CMD build also reads it when cleaning src/. It is read by make and can execute shell via make constructs such as $(shell …). |
| src_makevars_win | make |
yes |
at_build, at_check,
at_install_src
|
src/Makevars.win sets make variables used to compile code in src/ on Windows when a package is installed from source, including the installs performed by R CMD check and by R CMD build; R CMD build also reads it when cleaning src/. It is read by make and can execute shell via make constructs such as $(shell …). |
| src_other | other |
no |
at_check, at_install_src,
at_load
|
A file under src/. Everything there is part of what gets built, so this rule claims every extension – alongside any other rule that matches – and a file no language rule recognizes is accounted for rather than passed over. |
| tests_scripts | R |
no | at_check |
R CMD check runs every .R file directly under tests/. This is the entry point of whatever testing framework the package uses, and it executes arbitrary R during checking. |
| tests_testthat | R |
no | at_check |
testthat sources the files directly under tests/testthat/ when R CMD check runs the package’s tests. Subdirectories are not sourced – tests/testthat/ fixtures/ holds inert data – so only the top level is scanned. |
| tools_scripts | R |
no | none | tools/ holds helper scripts that nothing runs on its own. It is reached only if configure or a Makevars invokes it, in which case that invocation is reported where it appears and carries that file’s phases. The code is scanned here so a reviewer can read what would run. |
| vignettes_qmd | qmd |
no |
at_build, at_check
|
A Quarto vignette carries executable chunks, in the same fenced syntax as R Markdown. Vignette code runs when the vignette is rendered: during R CMD build, and again under R CMD check, which rebuilds it. It executes arbitrary R with the package loaded, before anyone reads the rendered document. |
| vignettes_rmd | Rmd |
no |
at_build, at_check
|
An R Markdown vignette carries executable chunks. Vignette code runs when the vignette is rendered: during R CMD build, and again under R CMD check, which rebuilds it. It executes arbitrary R with the package loaded, before anyone reads the rendered document. |
| vignettes_rnw | Rnw |
no |
at_build, at_check
|
A Sweave or knitr vignette carries executable chunks between <<>>= and @, and inline macros. Vignette code runs when the vignette is rendered: during R CMD build, and again under R CMD check, which rebuilds it. It executes arbitrary R with the package loaded, before anyone reads the rendered document. |
| vignettes_rsp | rsp |
no |
at_build, at_check
|
An R.rsp vignette is a template: everything is output except the R between <% and %>. R.rsp builds it during R CMD build, and again under R CMD check, so the code executes with the package loaded before anyone reads the rendered document. |
Code Contexts
A code context says where code sits within its file. It is either defined by a rule or computed.
Rules: a lifecycle hook like .onLoad()
is found by matching the parse tree; a part of a help
file like \examples or \Sexpr, by
matching a label the extractor stamped.
| Rule | Code Context | Matched by | Phases | Description |
|---|---|---|---|---|
| LastLib_base | .Last.lib() |
parse tree |
at_check, at_detach
|
.Last.lib() executes arbitrary code when a package is detached from the R search path, e.g., by calling detach(); it does not run on unloadNamespace(). It runs only if the package exports it and does not define .onDetach(), which supersedes it. R CMD check detaches the package while checking that it can be unloaded cleanly, so .Last.lib() runs during checking without any call from a user. |
| Rd_Sexpr_build | \Sexpr[stage=build] |
segment label |
at_build, at_check,
at_install_src
|
is evaluated when R CMD build renders the help page, and when the package is installed from a source directory or checked. It is not reached when a source tarball is installed: build already evaluated it and froze the result into the Rd that shipped. The install phase does not distinguish the two, so it is declared either way. |
| Rd_Sexpr_install | \Sexpr[stage=install] |
segment label |
at_build, at_check,
at_install_src
|
is evaluated whenever the help page is rendered from source: R CMD build, either kind of source install, and R CMD check. Not on installation from a binary, whose help ships pre-rendered. |
| Rd_Sexpr_render | \Sexpr[stage=render] |
segment label |
at_build, at_check
|
is evaluated when the page is rendered for display, not when it is installed. It fires during R CMD build and R CMD check, and when a user calls help(); it does not fire at either install. |
| Rd_examples | \examples{} |
segment label | at_check |
Code in an block of a help file is run by R CMD check, and by a user who calls example(). It is not run when the package is built or installed: R CMD build and R CMD INSTALL render the help page but never evaluate its examples. Code under is scanned but marked guarded: it ships in the package, but no example run reaches it. |
| onAttach_base | .onAttach() |
parse tree |
at_build, at_check,
at_install_src, at_attach
|
.onAttach() executes arbitrary code when a package is attached to the R search path, e.g., by calling library() or require(); attach() does not trigger it. R CMD INSTALL and R CMD check attach the package while testing that it loads, as does R CMD build when the package has vignettes, so .onAttach() runs during those phases without any call from a user. |
| onDetach_base | .onDetach() |
parse tree |
at_check, at_detach
|
.onDetach() executes arbitrary code when a package is detached from the R search path, e.g., by calling detach(); it takes precedence over .Last.lib() when both are defined. R CMD check detaches the package while checking that it can be unloaded cleanly, so .onDetach() runs during checking without any call from a user. |
| onLoad_base | .onLoad() |
parse tree |
at_build, at_check,
at_install_src, at_load
|
.onLoad() executes arbitrary code when a package namespace is loaded, e.g., by calling library(), require(), or loadNamespace(), or by accessing the namespace with ::. R CMD INSTALL and R CMD check load the package, as does R CMD build when the package has vignettes, so .onLoad() runs during those phases without any call from a user. |
| onUnload_base | .onUnload() |
parse tree |
at_check, at_unload
|
.onUnload() executes arbitrary code when a package namespace is unloaded, e.g., by calling unloadNamespace() or detach(unload=TRUE). R CMD check unloads the namespace while checking that it can be unloaded cleanly, so .onUnload() runs during checking without any call from a user. |
| on_load_rlang | rlang::on_load() |
parse tree |
at_build, at_check,
at_install_src, at_load
|
rlang::on_load() registers arbitrary code to execute when a package namespace is loaded, e.g., by calling library(), require(), or loadNamespace(), or by accessing the namespace with ::. R CMD INSTALL and R CMD check load the package, as does R CMD build when the package has vignettes, so the registered code runs during those phases without any call from a user. on_load() requires .onLoad() to contain rlang::run_on_load(). |
Computed: If no code-context rule matches a pattern’s site, its
context is computed from the parse tree: in_function inside
a function definition, and top_level otherwise.
| Context | Phases | Description |
|---|---|---|
top_level |
inherited | Code outside any function definition. It carries the phases of the file context it sits in, so the same call reads at_check under tests/ and at_build under data/. |
in_function |
inherited | Code inside a function definition. It inherits the phases of the code around it, except under R/, where the rules report it as running at no phase. |