CRAN
Point R's repos option at the Package Firewall, which serves PACKAGES unchanged and gates source tarball downloads.
| Repository URL | https://packages.vulnetix.com/cran |
| Ecosystem ID | cran |
| Plan | Add-on |
| Mode | gate: src/contrib/PACKAGES is streamed unchanged; <name>_<version>.tar.gz downloads are checked |
| Cooldown | no |
| Default mirror | https://cran.r-project.org |
PACKAGES lists every package in CRAN (about 7 MB), which is too large to policy-check per request, so CRAN is gated at the tarball.
Automatic setup
vulnetix package-firewall cran~/.Rprofile gets a managed block:
options(repos = c(CRAN = "https://YOUR_ORG_UUID:YOUR_API_KEY@packages.vulnetix.com/cran"))
options(download.file.method = "libcurl")libcurl is set because it honours credentials in the URL.
Use and verify
getOption("repos")
install.packages("jsonlite")Notes
- A project
.Rprofilereplaces the user one. Add the two lines there too. renvandpakreadreposfrom the session, so they pick up the same option.