tests/testthat/test-data-integrity.R

test_that("the signed manifest covers every shipped file and verifies", {
  v <- mdverify()
  expect_true(isTRUE(attr(v, "signature")))
  # an install from the source directory (not a built tarball) also carries the
  # .Rbuildignore-d legacy sqlite store, which verify rightly reports as unlisted
  v <- v[!grepl("[.]sqlite$", v$path), ]
  expect_true(all(v$ok))
  ed <- system.file("extdata", package = "rmoriedata")
  shipped <- list.files(ed, recursive = TRUE)
  shipped <- setdiff(shipped, c("_checksums.csv", "_checksums.sig",
                                "_signing_key.json"))
  shipped <- shipped[!startsWith(basename(shipped), ".")]
  # an install from the source directory (not a built tarball) also carries
  # the .Rbuildignore-d legacy sqlite store; it never ships
  shipped <- shipped[!grepl("[.]sqlite$", shipped)]
  expect_setequal(v$path, shipped)
  cat <- mdcat()
  expect_true(all(cat$source_path %in% v$path))
})

test_that("a modified file or manifest is refused", {
  ed <- system.file("extdata", package = "rmoriedata")
  tmp <- file.path(tempfile("store-"), "extdata")
  dir.create(tmp, recursive = TRUE)
  src <- list.files(ed, full.names = TRUE)
  file.copy(src[!grepl("[.]sqlite$", src)], tmp, recursive = TRUE)
  old <- options(rmoriedata.store = tmp)
  on.exit({
    options(old)
    rmoriedata:::.rmoriedata_reset_cache()
  })
  rmoriedata:::.rmoriedata_reset_cache()
  expect_true(all(mdverify()$ok))
  # tamper with one table: its load must fail, the others still pass
  tb <- mdcat()
  tb <- tb[tb$kind == "table" & !grepl("gz$", tb$source_path), ]
  f <- file.path(tmp, tb$source_path[1L])
  writeLines(c(readLines(f, warn = FALSE), "tampered,row"), f)
  rmoriedata:::.rmoriedata_reset_cache()
  slug <- tb$slug[1L]
  expect_error(mdload(slug, refresh = TRUE), "does not match")
  expect_false(all(mdverify()$ok))
  # tamper with the manifest itself: the signature no longer verifies
  mf <- file.path(tmp, "_checksums.csv")
  writeLines(sub("^\"?bytes", "bytes", readLines(mf, warn = FALSE))[-2], mf)
  rmoriedata:::.rmoriedata_reset_cache()
  expect_error(mdverify(), "does not verify")
})

test_that("a file added to the store is reported, not ignored", {
  ed <- system.file("extdata", package = "rmoriedata")
  tmp <- file.path(tempfile("store-"), "extdata")
  dir.create(tmp, recursive = TRUE)
  src <- list.files(ed, full.names = TRUE)
  file.copy(src[!grepl("[.]sqlite$", src)], tmp, recursive = TRUE)
  old <- options(rmoriedata.store = tmp)
  on.exit({
    options(old)
    rmoriedata:::.rmoriedata_reset_cache()
  })
  rmoriedata:::.rmoriedata_reset_cache()
  writeLines("x,y\n1,2", file.path(tmp, "planted.csv"))
  v <- mdverify()
  expect_true("planted.csv" %in% v$path)
  expect_false(v$listed[v$path == "planted.csv"])
  expect_false(v$ok[v$path == "planted.csv"])
  expect_true(all(v$ok[v$listed]))
  ck <- mdsums()
  expect_true(all(ck$in_manifest[ck$path %in% v$path[v$listed]]))
})

Try the rmoriedata package in your browser

Any scripts or data that you put into this service are public.

rmoriedata documentation built on Nov. 12, 2026, 9:06 a.m.