{"action":"closed","issue":{"url":"https://api.github.com/repos/rstudio/shiny/issues/113","labels_url":"https://api.github.com/repos/rstudio/shiny/issues/113/labels{/name}","comments_url":"https://api.github.com/repos/rstudio/shiny/issues/113/comments","events_url":"https://api.github.com/repos/rstudio/shiny/issues/113/events","html_url":"https://github.com/rstudio/shiny/issues/113","id":11218687,"number":113,"title":"Add sha option to runGist, runGitHub, and runUrl","user":{"login":"wch","id":86978,"avatar_url":"https://avatars.githubusercontent.com/u/86978?v=3","gravatar_id":"","url":"https://api.github.com/users/wch","html_url":"https://github.com/wch","followers_url":"https://api.github.com/users/wch/followers","following_url":"https://api.github.com/users/wch/following{/other_user}","gists_url":"https://api.github.com/users/wch/gists{/gist_id}","starred_url":"https://api.github.com/users/wch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wch/subscriptions","organizations_url":"https://api.github.com/users/wch/orgs","repos_url":"https://api.github.com/users/wch/repos","events_url":"https://api.github.com/users/wch/events{/privacy}","received_events_url":"https://api.github.com/users/wch/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2013-02-20T22:31:56Z","updated_at":"2015-02-25T17:56:46Z","closed_at":"2015-02-25T17:56:46Z","body":"This would help to ensure that the code would not change (possibly maliciously) in the future. This is useful for when code is distributed on mailing lists.\r\n\r\nFrom the user's perspective, they can know that if they've run the code in the past and it worked fine, that they'll get the same code, and so there aren't any malicious changes. It also would be be useful for establishing \"social trust\" of a gist: in a public setting like a mailing list, if the remotely hosted code is vetted by users and there's no complaints, then others can trust that the code isn't malicious, because it's impossible to change the code without detection.\r\n\r\nFor example, if I'm a reader on the shiny-discuss mailing list, I might be apprehensive about simply blindly running `runGist()`, but if the code has a SHA, and people that I trust have been discussing the code, then I can feel safer about running it without examining the code.\r\n\r\nThe author would distribute this information, which the users would run:\r\n\r\n```r\r\nrunGist(12345678, sha='0123456789abcdef')\r\n````\r\n\r\nIf `runGist` were called without `sha`, it would prompt the user about the risks, and ask them if they're sure they want to continue. (The prompt could be disabled with `prompt=FALSE`.)\r\n\r\n\r\nFrom the author's perspective, they would first push changes to gist.github.com, then run the following to find the SHA:\r\n\r\n```\r\nshaGist(0123456789)\r\n# SHA: 0123456789abcdef\r\n# Command to run: runGist(12345678, sha='0123456789abcdef')\r\n```\r\n\r\nIf the author wants to change the gist, then they will have to distribute a new SHA (or the users can run with the prompt).\r\n\r\nIt would be nice to also be able to download and run a specific commit in a gist, so that if changes are made to the Gist, the user can still use `runGist` on the original commit.\r\n\r\nIf the author distributes the SHA, then they don't need to worry about securing the remote server that hosts the code.\r\n"}}