在WDAC环境中如何提前检测R包及其依赖是否使用DLL文件？

场景背景 #

企业环境启用Microsoft Windows Defender Application Control (WDAC)后，会阻止未签名的EXE/DLL文件安装，导致包含编译型代码（生成DLL）的R包无法正常安装。当前仅允许从批准的中央源获取预配置了tidyverse、data.table等包的R环境，用户仅能安装纯原生R编写的包，安装/更新含DLL的包或从源码构建包时会触发WDAC拦截。

解决方案：编写预检查函数 #

无需下载完整包文件，通过CRAN元数据和本地已安装包信息，即可判断目标包及其依赖是否包含DLL。以下是实现函数check_dll：

check_dll <- function(pkg_name) {
  # 标准化包名（大小写不敏感）
  pkg_name <- tolower(pkg_name)
  
  # 获取CRAN可用包的元数据，提取NeedsCompilation字段
  cran_pkgs <- available.packages()
  needs_compile <- cran_pkgs[, "NeedsCompilation"]
  names(needs_compile) <- tolower(rownames(cran_pkgs))
  
  # 获取目标包的所有依赖（包括Imports、Depends、LinkingTo，递归获取）
  deps <- tools::package_dependencies(
    pkg_name,
    db = cran_pkgs,
    which = c("Imports", "Depends", "LinkingTo"),
    recursive = TRUE
  )[[1]]
  deps <- tolower(deps) %||% character(0)
  
  # 检查目标包是否需要编译（含DLL）
  pkg_needs_compile <- if (pkg_name %in% names(needs_compile)) {
    needs_compile[pkg_name] == "yes"
  } else {
    stop("包", pkg_name, "未在CRAN源中找到")
  }
  
  if (pkg_needs_compile) {
    cat(sprintf('result: "%s has a DLL. Do not attempt to install %s".\n', pkg_name, pkg_name))
    return(invisible(FALSE))
  }
  
  # 检查依赖中是否有需要编译的包
  dep_compile <- deps[needs_compile[deps] == "yes"]
  if (length(dep_compile) == 0) {
    cat('result: "This package and its dependencies have no DLL files. You can install this package"\n')
    return(invisible(TRUE))
  }
  
  # 检查这些依赖是否已本地安装
  installed_deps <- dep_compile[sapply(dep_compile, requireNamespace, quietly = TRUE)]
  missing_deps <- setdiff(dep_compile, installed_deps)
  
  if (length(missing_deps) == 0) {
    dep_text <- if (length(dep_compile) > 1) {
      sprintf("%s dependencies: %s", length(dep_compile), paste(dep_compile, collapse = ", "))
    } else {
      sprintf("one dependency, %s", dep_compile)
    }
    msg <- sprintf('result: "%s does not have any DLL files, but %s uses DLL files. You already have versions of these installed so it should be safe to install %s"',
                   pkg_name, dep_text, pkg_name)
    cat(msg, "\n")
    return(invisible(TRUE))
  } else {
    msg <- sprintf('result: "%s does not have any DLL files, but one of its dependencies, %s, does have a DLL file. Do not attempt to install %s".',
                   pkg_name, paste(missing_deps, collapse = ", "), pkg_name)
    cat(msg, "\n")
    return(invisible(FALSE))
  }
}

# 辅助函数：处理NULL值
`%||%` <- function(x, y) if (is.null(x)) y else x

函数说明 #

1. 依赖获取：递归获取目标包的Imports/Depends/LinkingTo类型依赖，覆盖所有可能引入DLL的关联包
2. 编译判断：利用CRAN元数据的NeedsCompilation字段判断包是否含编译代码（即生成DLL），无需下载包文件
3. 本地检查：对含DLL的依赖，检查是否已在本地安装（已安装则无需重新下载/编译，不会触发WDAC拦截）
4. 多场景输出：匹配需求中的四种提示场景

示例测试 #

# 示例1：包及依赖均无DLL
check_dll("foo")
# result: "This package and its dependencies have no DLL files. You can install this package"

# 示例2：包无DLL，但依赖OOF已安装且含DLL
check_dll("bar")
# result: "bar does not have any DLL files, but one dependency, OOF uses DLL files. You already have versions of these installed so it should be safe to install bar"

# 示例3：包本身含DLL
check_dll("foobar")
# result: "foobar has a DLL. Do not attempt to install foobar".

# 示例4：包无DLL，但依赖foobar含DLL且未安装
check_dll("RABOOF")
# result: "RABOOF does not have any DLL files, but one of its dependencies, foobar, does have a DLL file. Do not attempt to install RABOOF".

内容的提问来源于stack exchange，提问作者TobyT