Author	SHA1	Message	Date
Simon Chrzanowski	842fa21c0a	Fetch archived CRAN versions unchecked and drop the version dedup ... PACKAGES.rds comes from the same host as the tarball, so checking against it doesn't justify a decoder for R serialization. The duplicate archived versions are tracked in git-pkgs/registries#119.	2026-10-28 15:17:49 +00:00
Simon Chrzanowski	3fd79ccb36	Fuzz the PACKAGES.rds decoder ... It reads files from the network, so malformed input must fail with an error. Seeded with the real PACKAGES.rds; 3.7M executions found nothing.	2026-10-28 15:17:49 +00:00
Simon Chrzanowski	f5251d3834	Mirror CRAN source packages ... proxy mirror pkg:cran/<name>@<version> now fetches the source tarball from upstream.cran and caches it under the key the CRAN handler reads, ("cran", name, version, name_version.tar.gz), which serves both /src/contrib/{file} and /src/contrib/Archive/{name}/{file}. A current version comes from src/contrib and is checked against the MD5sum in src/contrib/PACKAGES.gz, read once per five minutes. Other versions come from src/contrib/Archive/{name}/, checked against the MD5sum in that directory's PACKAGES.rds, an R-serialized character matrix read by a small decoder. Without a PACKAGES.rds the archived tarball is fetched unchecked, as the handler fetches it. Listing versions dropped duplicates: the CRAN client lists each archived version twice.	2026-10-28 15:17:48 +00:00