zucbor: Deterministic and Secure CBOR Encoding and Decoding

Encodes R values as Concise Binary Object Representation (CBOR, RFC 8949; Bormann and Hoffman (2020) <doi:10.17487/RFC8949>) and decodes CBOR into ordinary R vectors and lists. Decoding checks the whole input against configurable depth, size and item limits before any R object is built, so untrusted input from network peers and devices cannot drive large allocations. Encoding is deterministic: identical R objects always produce identical bytes. Uses a bundled copy of the 'TinyCBOR' library (<https://github.com/intel/tinycbor>), so no system library is required.

Version: 0.1.0
Depends: R (≥ 4.1)
Suggests: knitr, rmarkdown, testthat (≥ 3.0.0), withr
Published: 2026-10-21
DOI: 10.32614/CRAN.package.zucbor (may not be active yet)
Author: Pedro Baltazar [aut, cre, cph], Thiago Macieira [aut] (Author of the bundled TinyCBOR library), Intel Corporation [cph] (TinyCBOR, bundled in src/vendor/tinycbor)
Maintainer: Pedro Baltazar <pedrobtz at gmail.com>
BugReports: https://github.com/pedrobtz/zucbor/issues
License: MIT + file LICENSE
Copyright: See inst/COPYRIGHTS and src/vendor/PROVENANCE.
zucbor copyright details
URL: https://github.com/pedrobtz/zucbor, https://pedrobtz.github.io/zucbor/
NeedsCompilation: yes
Language: en-GB
Materials: README, NEWS
CRAN checks: zucbor results

Documentation:

Reference manual: zucbor.html , zucbor.pdf
Vignettes: COSE and WebAuthn (source, R code)
Decoding untrusted CBOR (source, R code)

Downloads:

Package source: zucbor_0.1.0.tar.gz
Windows binaries: r-devel: not available, r-release: not available, r-oldrel: not available
macOS binaries: r-release (arm64): zucbor_0.1.0.tgz, r-oldrel (arm64): zucbor_0.1.0.tgz, r-release (x86_64): zucbor_0.1.0.tgz, r-oldrel (x86_64): zucbor_0.1.0.tgz

Linking:

Please use the canonical form https://CRAN.R-project.org/package=zucbor to link to this page.