Compute a manifest hash for a directory — hash

Hashes a package manifest, a canonically ordered list of every included file's relative path and SHA-256 content hash.

Usage

hash_manifest(path, exclude = c("^\\.git/", "^\\.Rproj\\.user/"))

Arguments

path: Path to the directory to hash.
exclude: Character vector of regular expressions matched against paths relative to path. Defaults exclude version-control and IDE scratch state, which are not part of the package and (for .git/) are large and volatile. Pass character(0) to hash everything present.

Value

A list with:

hash: SHA-256 of the manifest text (character scalar).
manifest: The manifest text (character scalar), one line per file, formatted as "<hash> <relative path>".
n_files: Number of files included (integer).
exclude: The exclusion patterns applied, for recording in metadata.
symlinks: Relative paths of symlinks and files under symlinked directories, excluded from the manifest (character).
unreadable: Relative paths that could not be hashed, excluded from the manifest (character).

Details

A directory, unlike a tarball, has no single canonical byte stream to hash. The manifest is returned alongside the hash so two disagreeing scans can be diffed to find which file differs.

A directory hash is a weaker provenance claim than a tarball hash: its scope depends on exclude, and empty directories and symlinks are not represented, so trees differing only in those hash identically. For vetting untrusted code, prefer hashing the tarball.

Examples

# untrustedpkg is a small package shipped with pkgaudit to be scanned.
tarball <- system.file(
  "extdata", "untrustedpkg", "untrustedpkg_0.1.0.tar.gz",
  package = "pkgaudit"
)
exdir <- file.path(tempdir(), "untrustedpkg-example")
utils::untar(tarball, exdir = exdir)

hash_manifest(file.path(exdir, "untrustedpkg"))$hash
#> [1] "50be0a4fe9997cb47764c1eb2026be864242314a4af6dfd634e60a358dec8171"