diff --git a/DESCRIPTION b/DESCRIPTION index 5caac57..c28e1b9 100644 --- a/DESCRIPTION +++ b/DESCRIPTION @@ -2,9 +2,9 @@ Package: dockerfiler Title: Easy Dockerfile Creation from R Version: 0.3.0 Authors@R: c( - person("Colin", "Fay", , "contact@colinfay.me", role = c("cre", "aut"), + person("Colin", "Fay", , "contact@colinfay.me", role = "aut", comment = c(ORCID = "0000-0001-7343-1846")), - person("Vincent", "Guyader", , "vincent@thinkr.fr", role = "aut", + person("Vincent", "Guyader", , "vincent@thinkr.fr", role = c("cre", "aut"), comment = c(ORCID = "0000-0003-0671-9270")), person("Josiah", "Parry", , "josiah.parry@gmail.com", role = "aut", comment = c(ORCID = "0000-0001-9910-865X")), diff --git a/cran-comments.md b/cran-comments.md index 57f5e99..148f560 100644 --- a/cran-comments.md +++ b/cran-comments.md @@ -1,11 +1,147 @@ ## R CMD check results -0 errors | 0 warnings | 0 note +``` +0 errors | 0 warnings | 0 notes +``` -* This is a new release after CRAN's feedback +(local `R CMD check --as-cran` occasionally surfaces a single +transient NOTE "unable to verify current time" caused by host +clock skew on the build VM; the package itself is unaffected.) -> Packages which use Internet resources should fail gracefully with an informative message -> if the resource is not available or has changed (and not give a check warning nor error). +## Test environments -What has been done: wrapped the download.file() in get_batch_sysreq in try({}) and added an -informative message. \ No newline at end of file +* local Ubuntu 24.04, R 4.5.x: `R CMD check --as-cran` clean. +* GitHub Actions (R-CMD-check workflow), all green on the + submission HEAD: + * macOS-latest (release) + * windows-latest (release) + * ubuntu-latest (release, devel, oldrel-1) +* `devtools::check_win_devel()`: submitted in parallel with this + CRAN submission; the win-builder result will follow by email + and will be forwarded to CRAN if it surfaces anything new. + +## Maintainer change + +This release changes the maintainer from Colin Fay +(`contact@colinfay.me`) to Vincent Guyader +(`vincent@thinkr.fr`). Both remain listed as authors. The +previous maintainer (Colin Fay) is aware of this submission and +will confirm the maintainer change by replying to the automated +email from CRAN's submission system. + +## Major changes since 0.2.6 + +A focused 0.3.0 release. Headline bullets (full details in +`NEWS.md`): + +### Breaking changes + +* The vendored copy of `{renv}` (~30,000 lines under + `inst/vendor/`) is removed. Lockfile parsing now uses + `{jsonlite}` (already in Imports). The exported + `dockerfiler::renv` symbol is removed; it was a public-API + surface only because the vendor pattern required it. +* `dock_from_renv()` defaults to a non-root container user + (`"rstudio"`) with a defensive `useradd` step, an + auto-derived `RENV_PATHS_CACHE`, a `chown` of the cache, and + a `USER` directive emitted right before the `renv::restore()` + cache-mount RUN. Pass `user = NULL` to opt out and keep the + previous root behaviour. +* `dock_from_renv()` default `FROM` flips from `"rocker/r-base"` + (amd64-only) to `"rocker/r-ver"` (multi-arch), with the + lockfile's R version appended at codegen time. Apple Silicon + and ARM Linux hosts (Ampere, AWS Graviton) now build + natively. +* `dock_from_renv()` default `repos` flips from + `"https://cran.rstudio.com/"` to + `"https://p3m.dev/cran/latest"` (Posit Public Package + Manager) with automatic rewrite to the + `__linux__/$VERSION_CODENAME/` shape so the build pulls + pre-compiled Linux binaries. + +### New features + +* `dock_from_desc()` and `dock_from_renv()` gain a + `github_pat` parameter (`"none"` / `"build_arg"` / + `"secret"`) for private dependency repositories, with an + opt-in BuildKit secret-mount mode that does not persist the + PAT in image metadata. +* `dock_from_desc()` gains a `strict_install` parameter + (default `TRUE`) which prefixes every install RUN with + `options(warn = 2);` so any R warning during install + (missing CRAN package, partial download, archived package, + 404) becomes a hard error and aborts the docker build. +* `dock_from_renv()` gains a `renv_paths_cache` parameter + (auto-derived from `user` by default) controlling the + `RENV_PATHS_CACHE` build-arg / ENV / cache-mount target. +* `dock$ARG()` and the internal `add_arg()` helper gain a + `default` parameter to emit `ARG =` instead + of `ARG `. + +### Security hardening + +* `dock_from_desc()` and `dock_from_renv()` validate every + user-supplied parameter that flows into a Dockerfile shell + context (`FROM`, `AS`, `repos` values and names, + `extra_sysreqs`, `renv_version`, `renv_paths_cache`, + `lockfile` basename, `use_pak`, `strict_install`, `r_version` + read from the lockfile, `user`). Inputs that contain shell + metacharacters, newlines, or do not match the documented + format raise an explicit error at function entry rather than + silently producing a malformed Dockerfile or one that could + execute attacker-controlled commands at `docker build` time. +* A code-injection path in `dock_from_renv()` was found by an + internal audit and fixed before this submission: the `renv` + version resolved from the lockfile was interpolated into the + generated `R -e 'remotes::install_version("renv", version = + "")'` line without the validation that was already applied + to a user-supplied `renv_version=`. A crafted `renv.lock` + could break out of the inner R string and run arbitrary code + as root at `docker build` time. The validator is now applied + to the resolved value whatever its source. (The bug predates + this release; no published `{dockerfiler}` version carried the + 0.3.0 changeset, so there is nothing to coordinate with CRAN + beyond noting it here.) + +### Bug fixes + +* `r()` no longer silently rewrites user code (`gsub("[ ][2,]", + ...)` typo) and now wraps the deparsed expression with + `shQuote(., type = "sh")` so apostrophes inside string + literals no longer break the emitted `R -e '...'` command. +* `dock_from_desc(build_from_source = FALSE)` no longer carries + a dead-code `if (missing(out))` branch. + +## Reverse dependencies + +Three packages depend on `{dockerfiler}` (`{golem}`, +`{AbSolution}`, `{shiny2docker}`). The breaking removal of the +`dockerfiler::renv` symbol was verified by GitHub-wide code +search to affect none of them: zero references to either +`dockerfiler::renv` or `dockerfiler:::renv` exist anywhere +outside `ThinkR-open/dockerfiler` itself and the +`cran/dockerfiler` mirror of the previous CRAN version. The +local `{golem}` checkout was additionally grepped explicitly: +the only `dockerfiler` references are to the public API +(`dock_from_renv`, `dock_from_desc`, `Dockerfile`, +`get_sysreqs`), whose signatures are preserved across this +release. The other 0.3.0 changes (default flip of `FROM` to +`rocker/r-ver`, of `repos` to `p3m.dev/cran/latest`, and of +`user` to `"rstudio"`) are behavioural-default changes and do +not break downstream call sites. + +`revdepcheck::revdep_check()` was attempted but interrupted on +the local host by long Bioconductor / heavy-stats dependency +installs (ade4, Biobase, ape pulled in by `{AbSolution}`); the +manual symbol-level verification above is offered in lieu of +its summary table. + +## Other notes + +* Test coverage stands at 99.84% (320+ tests). The single + uncovered line is a defensive `stop()` guard in + `dock_from_desc()` that fires only when `{pkgbuild}` is not + installed; since `{pkgbuild}` is in `Imports`, the guard is + unreachable in normal package use. +* No URLs in the package metadata or vignettes 404 (verified + with `urlchecker::url_check()` prior to submission).