Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: WordPress/wordpress-develop
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: master
Choose a base ref
...
head repository: dd32/wordpress-develop
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: feature/39309-signed-updates
Choose a head ref
Checking mergeability… Don’t worry, you can still create the pull request.
  • 19 commits
  • 2 files changed
  • 1 contributor

Commits on Mar 19, 2019

  1. Initial implementation of package signature verification in WordPress. 

    This is written with some assumptions of the future work on WordPress.org and may change.
It also expects that PHP 5.4+ with ext/Sodium is in use, but won't fatal if not.

Signature Verification failures are reported back to WordPress.org for debugging purposes.

See https://core.trac.wordpress.org/ticket/39309
    @dd32
    dd32 committed Mar 19, 2019
    Configuration menu
    Copy the full SHA
    b0e656b View commit details
    Browse the repository at this point in the history

  2. Use a full version descriptor

    @dd32
    dd32 committed Mar 19, 2019
    Configuration menu
    Copy the full SHA
    e6e0903 View commit details
    Browse the repository at this point in the history

  3. Missing comma.. Not an immediate PHP7 parse error

    @dd32
    dd32 committed Mar 19, 2019
    Configuration menu
    Copy the full SHA
    0266e96 View commit details
    Browse the repository at this point in the history

  4. Coding Standards cleanup part 1

    @dd32
    dd32 committed Mar 19, 2019
    Configuration menu
    Copy the full SHA
    57a427c View commit details
    Browse the repository at this point in the history

  5. Coding Standards cleanup part 2

    @dd32
    dd32 committed Mar 19, 2019
    Configuration menu
    Copy the full SHA
    e964f5a View commit details
    Browse the repository at this point in the history

  6. Coding Standards part 3

    @dd32
    dd32 committed Mar 19, 2019
    Configuration menu
    Copy the full SHA
    6d08172 View commit details
    Browse the repository at this point in the history

  7. Switch from Hex encoding to Base64 encoding.

    @dd32
    dd32 committed Mar 19, 2019
    Configuration menu
    Copy the full SHA
    b635ba1 View commit details
    Browse the repository at this point in the history

  8. Switch to signing a SHA512 hash instead of signing the entire file co… 

    …ntents directly. This is being done as loading 10+MB files into memory is likely to run into limitations. In the case of it requires twice the memory of simply holding it within a string.
    @dd32
    dd32 committed Mar 19, 2019
    Configuration menu
    Copy the full SHA
    9c45386 View commit details
    Browse the repository at this point in the history

  9. Fix some documentation.

    @dd32
    dd32 committed Mar 19, 2019
    Configuration menu
    Copy the full SHA
    1454580 View commit details
    Browse the repository at this point in the history

  10. Remove reference to now-unused variable file_contents.

    @dd32
    dd32 committed Mar 19, 2019
    Configuration menu
    Copy the full SHA
    adda3ca View commit details
    Browse the repository at this point in the history

  11. Swap SHA512 for SHA384 to avoid length-extension collision attacks.

    @dd32
    dd32 committed Mar 19, 2019
    Configuration menu
    Copy the full SHA
    30520b2 View commit details
    Browse the repository at this point in the history

  12. Properly escape $filename_for_errors and correct a documentation typo. 

    Props vortfu
    @dd32
    dd32 committed Mar 19, 2019
    Configuration menu
    Copy the full SHA
    59994fd View commit details
    Browse the repository at this point in the history

  13. Move the Signature fetching from a URL from within the function to ou… 

    …tside of it.

This removes the reliance upon $url being passed to the verification function.
    @dd32
    dd32 committed Mar 19, 2019
    Configuration menu
    Copy the full SHA
    0dc5bea View commit details
    Browse the repository at this point in the history

  14. Use hex-encoding for hashes in debug data as it's more commonly recog… 

    …nised.
    @dd32
    dd32 committed Mar 19, 2019
    Configuration menu
    Copy the full SHA
    78e435f View commit details
    Browse the repository at this point in the history

  15. Add the Wordress.org Test Key #1. This key is being used during devel… 

    …opment and will be replaced at a later date.
    @dd32
    dd32 committed Mar 19, 2019
    Configuration menu
    Copy the full SHA
    a3c0a96 View commit details
    Browse the repository at this point in the history

  16. Add some documentation whitespace alignment

    @dd32
    dd32 committed Mar 19, 2019
    Configuration menu
    Copy the full SHA
    5cec775 View commit details
    Browse the repository at this point in the history

  17. Fix a variable typo.

    @dd32
    dd32 committed Mar 19, 2019
    Configuration menu
    Copy the full SHA
    ac1e0a6 View commit details
    Browse the repository at this point in the history

  18. Fix Coding standards violations.

    @dd32
    dd32 committed Mar 19, 2019
    Configuration menu
    Copy the full SHA
    fd18e2d View commit details
    Browse the repository at this point in the history

  19. WordPress.org Key #1 is only valid for two years, expire it after tha… 

    …t time.
    @dd32
    dd32 committed Mar 19, 2019
    Configuration menu
    Copy the full SHA
    1f1ff65 View commit details
    Browse the repository at this point in the history
Loading