You're very welcome Martin!
/Aha, glad to see your master site is HTTPS, not HTTP. I was under
the false impression that the project's main site was only available
under the latter (which did seem strange)./
Sorry if you weren't the best person to contact, I couldn't work out who
was the best to contact from the information on the page.
Best Regards,
/J.S./
------------------------------------------------------------------------
*My PGP Public Key Identity*
pub 4096R/*DDD75C27* 2016-11-17 [expires: 2018-10-06]
Key fingerprint = *F9B1 BDAF 9A2A 7F9A 0712 DEEB 3B24 41F6 DDD7 5C27*
uid [ultimate] Joshua Saxby (Decoded Ltd) j...@decoded.com
<mailto:j...@decoded.com>
sub 4096R/8B35ECE4 2016-11-17 [expires: 2018-10-06]
------------------------------------------------------------------------
On 2018-03-26 16:24, Martin Maechler wrote:
>>>>>> Joshua Saxby <........>
>>>>>> on Mon, 26 Mar 2018 15:18:25 +0100 writes:
> > Dear Sir/Madam,
> > While downloading the latest version of /R for Mac OS X/, I noticed that
> > the SHA-1 checksum for the file as advertised on the page at
> > http://cran.us.r-project.org/bin/macosx/ appears to be incorrect. I am
> > quite certain that the checksum as displayed on the page is incorrect,
> > because the MD5 hash on the page matches that which I can reproduce
> > locally, and the Apple Developer certificates also validate successfully
> > when pkgutil --check-signature R-3.4.4.pkg is run.
>
> > To clarify, the SHA-hash (I assume it is SHA-1, no other SHA hash
> > matches this length) as displayed on your page is:
> > 566f8c7a85e9343d056c1b143ebf5ca6c101dec7
>
> > The SHA-1 hash I get when I hash the file locally (on macOS with the
> > command shasum R-3.4.4.pkg) is: 5fd44c8a6eb2e936614f844d00f29c1fc2f4a0f9
>
> > I have encountered this scenario across two of the mirror sites, so my
> > assumption would be that the wrong hash is displayed.
>
> Thank you very much, Joshua!
>
> The master site is (with 'https', not just 'http' !)
> https://cran.r-project.org/bin/macosx/
>
> and that does show the same hash (of course: the mirrors do not
> recompute the hashes in the *text* of their pages).
>
> So this must be an error somewhere.
>
> I'm CC'ing the R-SIG-Mac mailing list,
> where the R-on-Mac experts should be listening.
>
> Can mac users confirm they do not get the indicated hash but a
> different one?
>
> -------
>
> NOTE: The Webmasters of www.r-project.org cannot really
> change contents of cran.r-project.org and its mirrors.
>
> So we have to refer this to the CRAN maintainers ourselves.
>
> For the webmasters of R-project.org,
> Martin Maechler
>
> ETH Zurich
>
> > Best Regards,
> > /J.S./
>
signature.asc
Description: OpenPGP digital signature
_______________________________________________ R-SIG-Mac mailing list R-SIG-Mac@r-project.org https://stat.ethz.ch/mailman/listinfo/r-sig-mac
