update NEWS with signing info

git-svn-id: https://svn.r-project.org/R/trunk@89690 00db46b3-68df-0310-9c12-caf00c1e9a41

Author: urbaneks

doc/NEWS.Rd

@@ -217,7 +217,7 @@
       \code{"<system>.binary.<build>"} where \code{<system>} is
       lower-case name (letters only) of the system and \code{<build>} is
       the name of the build (alphanumeric and dashes). The corresponding
-      paths returned by \code{contrib.url} (which govern repository
+      paths returned by \code{contrib.url} (which govern the repository
       layout) with the above \code{type=} have the form
       \code{bin/<system>/<build>/contrib/<x.y>} where \code{<x.y>}
       is the \R version without patch level. This is a generalisation of
@@ -233,6 +233,33 @@
       typically only done by the author of a binary \R distribution to
       define the type of binaries supported by that build of \R.
 
+      \item If \R uses custom binary type in its
+      \code{.Platform$pkgType} then \code{R CMD INSTALL --build} will
+      produce \code{<package>_<ver>_R_<system>-<build>.tar.zstd} binary
+      files if \R has \command{zstd} support, \code{.tar.xz} otherwise.
+
+      \item New facilities have been introduced for package integrity
+      verification and package signing. The optional file \file{SHA256}
+      in a package contains \abbr{SHA}-256 hashes, lengths and paths
+      of files provided in the package allowing for more reliable integrity
+      verification (relative to \file{MD5}). This file is now generated
+      by default in \code{R CMD INSTALL --build} and optionally via
+      \code{R CMD build --sha256}. A package can be signed by creating a
+      detached GnuPG signature file \file{SHA256.sig} signing the
+      entirety of the \file{SHA256} file. Upon installation, the
+      signature is verified using GnuPG, thus ensuring the integrity of
+      the \file{SHA256} file and by induction all files in the package.
+      Both source and binary packages can be signed. Currently, this only
+      applies to tar-based packages, and the command-line GnuPG
+      \command{gpg} tool (or equivalent tool named in the \code{GPG}
+      environment variable) has to be available for signing and
+      verification to work. \code{R CMD INSTALL --sign} can be used to
+      sign binary packages, including its use with \code{--build}.
+      System-wide GnuPG keyrings for the \R installation
+      can be placed in \code{\var{R_HOME}/etc/keyrings} as files with
+      \file{.gpg} extensions and will be checked first before consulting
+      user's GnuPG keyring (if present).
+
       \item Experimentally, several math library (\file{math.h}) functions,
       such as \code{exp(.)}, \code{log1p()}, \code{sin()}, \code{atanh()},
       when called from \R, are now ensured to give fully accurate results