bigbang

Turns a curated set of package archives (.tar.gz, .zip) into one meta-package in the style of the 'tidyverse', so that a group of interdependent packages can be distributed and installed as a single unit. The generated meta-package records the exact archive versions it was built from and installs its components in dependency order, so that whoever receives it does not have to work out which package to install first. The component archives are copied into the generated meta-package, so it is the only artifact that has to be distributed and no directory has to be agreed on between machines. Resolves dependencies by building a graph with topological ordering and cycle detection, classifies them as local or external, and detects implicit dependencies by scanning source code. Installation needs no repository access unless a component depends on a package that only exists in one, which suits teams working behind institutional firewalls. Generates the complete meta-package scaffold, including installation helpers, vignettes and documentation.

Releases

5

Needs compilation

No

Needs R

>= 4.1.0

Config/roxygen2/version

8.0.0

Config/testthat/edition

3

Language

en

• Package installation and loading

Since March 2026

• brio
• glue
• tools
• utils
• whisker

Installing it adds

3 packages, 168 KB of source

Of those, need compilation

2

• covr
• devtools
• knitr
• pkgbuild
• pkgload
• rmarkdown
• roxygen2
• testthat
• withr

Lines by kind (37,972)

Lines by language

Languages are counted from file extensions.

Files

103

R functions

344

Object systems

S3: 3 methods

Median

4

Mean

7.79

Highest

147

Median lines per function

17

R functions

344

Calls

882

Unconnected

7

Groups

1

Lines counted

12,508

Lines the tests ran

11,564

Tests passed

No

Measured with

covr 3.6.5 on R 4.6.1

Has tests

Yes

Test frameworks

testthat, tinytest

Test cases

430

Lines of tests

20,362

Test lines per line of code

1.24

• bigbang en español: guía completa
• Getting started with bigbang

README

Yes, 4,142 words

Release notes file

Yes

Help pages

7

Lines of documentation

822

• Sebastian Lucas

Commits

156

Open pull requests

0

Tagged releases

4

Latest tagged release

v0.6.0, 24 Oct 2026

In development

Default branch at 0.6.0.9000, ahead of CRAN 0.6.0 (checked 2026-10-25)

Issues closed in

–

Pull requests closed in

0 days (median)

Pull requests merged

100%

Created

22 Jul 2026

Licence file reads as

GPL-3.0

Method, repository practices

Across sebollin

Security

• bigbang now reads tar and ZIP archives with its own validating reader, and no longer calls utils::untar() or utils::unzip(). On R 4.1 to 4.5, a component archive containing a symbolic link, followed by an entry written through that link, could write outside the temporary extraction directory before bigbang rejected the archive, even with dry_run = TRUE. R 4.6.0 blocks this inside untar(), but earlier releases do not. The new reader:
• creates only regular files and directories inside the destination;
• treats Windows junctions and symbolic links as links, so it never extracts into them and its cleanup never deletes through them;
• rejects links, devices, other special entries, and malformed, overlapping or trailing archive data;
• by default rejects names that Windows cannot create, such as aux.R or a name containing : or ?, names ending in a dot or a space, and names that differ only in case. If every recipient uses Linux or macOS, options(bigbang.archive.portable_names = FALSE) accepts them wherever the file system can store them, which is never on Windows, and warns that the package will not install there. Links, absolute paths, .., names made only of dots and spaces, control characters and invalid UTF-8 are always rejected;
• verifies CRC-32 and sizes through zlib;
• stops at configurable limits: options(bigbang.archive.max_entries, bigbang.archive.max_total_bytes, bigbang.archive.max_metadata_bytes, bigbang.archive.max_path_bytes) (see ?scan_bigbang_artifact).

Generation, diagnose_dependencies(), install_local_pkg(),

scan_bigbang_artifact(), and the installers of generated meta-packages all

use the same reader. scan_bigbang_artifact() reports an archive with links

as vulnerable, and a damaged one as an archive error, instead of failing.

Dependencies

• bigbang now requires R >= 4.1.0. Its own code needs nothing newer than R 3.6.0. The imported glue, however, has required R 4.1 since glue 1.8.1, so installing on an older R already failed unless an older glue was installed by hand. CI now checks R 4.1. Generated meta-packages keep their R (>= 3.5.0) floor, which has been verified on R 3.5.3.

New features

• <meta>_deps(plan = TRUE) returns a read-only plan of what <meta>_install() will do. It reports, for each component, the archive and installed versions, the library, the action and the reason, and, for each external dependency, its version constraint and whether it is satisfied. The plan uses the installer's own upgrade default, only closure, and rules for libraries and version constraints. It loads no namespaces and installs nothing. <meta>_deps(only = ...) also lists the dependencies of that closure without a plan. Called with no arguments, <meta>_deps() returns what it did before.
• create_metapackage(governance = TRUE) adds a CONTRIBUTING.md, a code of conduct adapted from the Contributor Covenant 2.1, and a package-inclusion issue template to the generated meta-package. Updates track these files, and the built package excludes them. The default remains governance = FALSE.

Bug fixes

• Name collisions. A meta-package whose name matches one of its components, or another local package the installer can see, is rejected before anything is written, ignoring case. So are two components whose names differ only in case. The generated installer also rejects an archive whose Package: field changed after generation.
• Failure messages. When R CMD INSTALL fails, install_local_pkg() and generated installers now report the last real error, together with the lines around it, and give the path to the full log. Compiler errors are included, and logs that are not valid UTF-8 are read safely.
• External dependencies. Version constraints on external dependencies are checked for each component. With cran_deps = "install", an unsatisfied dependency is updated from the explicit repos. Nothing uses the network without an explicit, non-empty repos.
• Source-only repositories. On Windows and macOS, cran_deps = "install" installed nothing from a repository that only has source packages, such as an internal repository, and the reason was discarded. If the default attempt leaves a dependency unsatisfied, install_local_pkg() and generated installers now retry with type = "source", so binaries are still preferred where they exist. When both attempts fail, the result says why.
• Result categories. Every component ends in exactly one result category. Dependents of a failed or skipped component are skipped without being built, and a shared dependency is installed only once.
• Installed components. Without lib, a component installed in any library on .libPaths() counts as installed. With an explicit lib, only that library counts.
• Translations. Printed results, installation results and every message emitted by generated meta-packages are translated into Spanish. Tests now fail on any untranslated message, and the English output is unchanged.
• Smaller fixes.
• A meta-package generated with document = FALSE no longer declares a RoxygenNote for a roxygen run that never happened.
• Replacing a file through a Windows reparse point no longer warns.
• An invalid lib, such as an empty string, NA or several paths, gives the same classed error in install_local_pkg(), <meta>_deps(plan = TRUE) and generated installers. When the installers cannot create the library, they fail with that error too, with no dir.create() warning before it.
• 46 obsolete entries were removed from the Spanish catalog.
• The test suite no longer depends on what is installed in the user library.

Performance

• Archives are listed once per call: listing ten 1 MB archives went from 64 to 19 ms.
• install_local_pkg() no longer rebuilds shared dependencies.

Documentation

• The README citation section points to citation("bigbang") and explains the CRAN and Zenodo DOIs. It no longer pastes a BibTeX entry, which had been left at version 0.3.0.
• The README now explains that recipients keep a newer installed version by default (install_upgrade = "newer"), and that install_upgrade = "always" makes every installation match the archives.
• The vignettes use <meta>_reexport_verification() only with reexport = TRUE, and quote the path given to R CMD build.
• Smaller fixes:
• the README describes the self-contained meta-package, r-universe binaries and CI accurately;
• the Spanish README gains the sections it lacked;
• CONTRIBUTING.md documents the test and lint commands.