{"action":"created","issue":{"url":"https://api.github.com/repos/rstudio/packrat/issues/230","labels_url":"https://api.github.com/repos/rstudio/packrat/issues/230/labels{/name}","comments_url":"https://api.github.com/repos/rstudio/packrat/issues/230/comments","events_url":"https://api.github.com/repos/rstudio/packrat/issues/230/events","html_url":"https://github.com/rstudio/packrat/pull/230","id":93594095,"number":230,"title":"use secure download method for interactions with CRAN when required","user":{"login":"jjallaire","id":104391,"avatar_url":"https://avatars.githubusercontent.com/u/104391?v=3","gravatar_id":"","url":"https://api.github.com/users/jjallaire","html_url":"https://github.com/jjallaire","followers_url":"https://api.github.com/users/jjallaire/followers","following_url":"https://api.github.com/users/jjallaire/following{/other_user}","gists_url":"https://api.github.com/users/jjallaire/gists{/gist_id}","starred_url":"https://api.github.com/users/jjallaire/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jjallaire/subscriptions","organizations_url":"https://api.github.com/users/jjallaire/orgs","repos_url":"https://api.github.com/users/jjallaire/repos","events_url":"https://api.github.com/users/jjallaire/events{/privacy}","received_events_url":"https://api.github.com/users/jjallaire/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-07-07T18:13:48Z","updated_at":"2015-07-07T19:05:20Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/rstudio/packrat/pulls/230","html_url":"https://github.com/rstudio/packrat/pull/230","diff_url":"https://github.com/rstudio/packrat/pull/230.diff","patch_url":"https://github.com/rstudio/packrat/pull/230.patch"},"body":"Two changes here:\r\n\r\n1) Update the `download` method to take advantage of the new secure R 3.2 download methods (\"wininet\" and \"libcurl\") when available.\r\n\r\n2) Add a new `secureDownloadMethod` function which sets the default R download method to a secure one (if possible) when one of the repositories in `getOption(\"repos\")` uses https. This allows `available.packages` and `install.packages` to work correctly in the presence of https repository URLs.\r\n\r\n@jcheng5 @trestletech @wch\r\n\r\nWinston, I'll put in a similar PR into downloader soon (packrat includes a copy of the the downloader::download function so as not to take a dependency on any other packages).\r\n"},"comment":{"url":"https://api.github.com/repos/rstudio/packrat/issues/comments/119305516","html_url":"https://github.com/rstudio/packrat/pull/230#issuecomment-119305516","issue_url":"https://api.github.com/repos/rstudio/packrat/issues/230","id":119305516,"user":{"login":"jjallaire","id":104391,"avatar_url":"https://avatars.githubusercontent.com/u/104391?v=3","gravatar_id":"","url":"https://api.github.com/users/jjallaire","html_url":"https://github.com/jjallaire","followers_url":"https://api.github.com/users/jjallaire/followers","following_url":"https://api.github.com/users/jjallaire/following{/other_user}","gists_url":"https://api.github.com/users/jjallaire/gists{/gist_id}","starred_url":"https://api.github.com/users/jjallaire/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jjallaire/subscriptions","organizations_url":"https://api.github.com/users/jjallaire/orgs","repos_url":"https://api.github.com/users/jjallaire/repos","events_url":"https://api.github.com/users/jjallaire/events{/privacy}","received_events_url":"https://api.github.com/users/jjallaire/received_events","type":"User","site_admin":false},"created_at":"2015-07-07T19:05:20Z","updated_at":"2015-07-07T19:05:20Z","body":"It's arguably more complicated to refactor as the downloader method has a\nbunch of extra stuff it does:\n\n1. Actually forcing setInternet2 (just for the stack frame) if it's not set\n\n2. Suppressing warnings on Windows\n\n3. Temporarily overriding the download.extra.options to cause curl to\nfollow redirects\n\nThe resulting code is actually harder to understand because of the special\ncasing (i.e. for Windows, don't quite believe secureDownloadMethod when it\nsays it can't get a secure method, rather go ahead and force setInternet2,\netc.).\n\nPart of this results from the fact that they are different use cases (i.e.\nwrap download.file and do whatever you need to do for secure downloads vs.\ncreate a global side effect that can be relied on by install.packages and\navailable.packages).\n\nI think the refactor also carries more defect and regression risk as it's\nbrand new code.\n\n\nOn Tue, Jul 7, 2015 at 2:56 PM, JJ Allaire <jj.allaire@gmail.com> wrote:\n\n> Let me take a crack at refactoring to share the logic (there are some\n> differences but I think we can make them orthogonal to secureDownloadMethod)\n>\n> On Tue, Jul 7, 2015 at 2:38 PM, Joe Cheng <notifications@github.com>\n> wrote:\n>\n>> Is there a reason that the downloader code doesn't just use\n>> secureDownloadMethod as well? It's basically the same logic, right?\n>>\n>> —\n>> Reply to this email directly or view it on GitHub\n>> <https://github.com/rstudio/packrat/pull/230#issuecomment-119296645>.\n>>\n>\n>\n"}}