Changeset 44954 for trunk/src/wp-admin/includes/class-wp-upgrader.php

Timestamp:

03/21/2019 05:48:46 AM (6 years ago)

Author:

tellyworth

Message:

Upgrade/Install: Add experimental package signing to some updates.

This adds code for soft verification of signatures for theme and plugin installs and updates, when provided by the update server. This experimental version does not reject unverified packages or failed signatures; it simply reports anonymous errors so we can evaluate its feasibility and detect incompatibilities.

This code relies on the new sodium_compat library for PHP versions prior to 7.2.

Props dd32, paragoninitiativeenterprises.
See #39309, #45806.

File:

• trunk/src/wp-admin/includes/class-wp-upgrader.php (modified) (2 diffs)

trunk/src/wp-admin/includes/class-wp-upgrader.php

@@ -276 +276 @@
         $this->skin->feedback( 'downloading_package', $package );
 
-        $download_file = download_url( $package );
-
-        if ( is_wp_error( $download_file ) ) {
+        $download_file = download_url( $package, 300, true );
+
+        if ( is_wp_error( $download_file ) && ! $download_file->get_error_data( 'softfail-filename' ) ) {
             return new WP_Error( 'download_failed', $this->strings['download_failed'], $download_file->get_error_message() );
         }
@@ -732 +732 @@
          */
         $download = $this->download_package( $options['package'] );
+
+        // Allow for signature soft-fail.
+        // WARNING: This may be removed in the future.
+        if ( is_wp_error( $download ) && $download->get_error_data( 'softfail-filename' ) ) {
+            // Outout the failure error as a normal feedback, and not as an error:
+            $this->skin->feedback( $download->get_error_message() );
+
+            // Report this failure back to WordPress.org for debugging purposes.
+            wp_version_check(
+                array(
+                    'signature_failure_code' => $download->get_error_code(),
+                    'signature_failure_data' => $download->get_error_data(),
+                )
+            );
+
+            // Pretend this error didn't happen.
+            $download = $download->get_error_data( 'softfail-filename' );
+        }
+
         if ( is_wp_error( $download ) ) {
             $this->skin->error( $download );