>>>>> Joshua Saxby <........>
>>>>> on Mon, 26 Mar 2018 15:18:25 +0100 writes:
> Dear Sir/Madam,
> While downloading the latest version of /R for Mac OS X/, I noticed that
> the SHA-1 checksum for the file as advertised on the page at
> http://cran.us.r-project.org/bin/macosx/ appears to be incorrect. I am
> quite certain that the checksum as displayed on the page is incorrect,
> because the MD5 hash on the page matches that which I can reproduce
> locally, and the Apple Developer certificates also validate successfully
> when pkgutil --check-signature R-3.4.4.pkg is run.
> To clarify, the SHA-hash (I assume it is SHA-1, no other SHA hash
> matches this length) as displayed on your page is:
> 566f8c7a85e9343d056c1b143ebf5ca6c101dec7
> The SHA-1 hash I get when I hash the file locally (on macOS with the
> command shasum R-3.4.4.pkg) is: 5fd44c8a6eb2e936614f844d00f29c1fc2f4a0f9
> I have encountered this scenario across two of the mirror sites, so my
> assumption would be that the wrong hash is displayed.
Thank you very much, Joshua!
The master site is (with 'https', not just 'http' !)
https://cran.r-project.org/bin/macosx/
and that does show the same hash (of course: the mirrors do not
recompute the hashes in the *text* of their pages).
So this must be an error somewhere.
I'm CC'ing the R-SIG-Mac mailing list,
where the R-on-Mac experts should be listening.
Can mac users confirm they do not get the indicated hash but a
different one?
-------
NOTE: The Webmasters of www.r-project.org cannot really
change contents of cran.r-project.org and its mirrors.
So we have to refer this to the CRAN maintainers ourselves.
For the webmasters of R-project.org,
Martin Maechler
ETH Zurich
> Best Regards,
> /J.S./
_______________________________________________
R-SIG-Mac mailing list
R-SIG-Mac@r-project.org
https://stat.ethz.ch/mailman/listinfo/r-sig-mac
