Weave Code
Checksum Command Laravel Package
wp-cli/checksum-command
WP-CLI command to verify WordPress core file integrity by comparing local files against published WordPress.org checksums. Supports version/locale selection, optional root checks, file exclusions, and multiple output formats.
Verifies file integrity by comparing to published checksums.
Frequently asked questions about Checksum Command
- Can I use wp-cli/checksum-command in a pure Laravel project without WordPress?
- No, this package is designed exclusively for WordPress environments. It relies on WordPress.org’s checksums and WP-CLI, which won’t work in a standalone Laravel app. For generic file integrity checks, consider Laravel’s built-in `hash_file()` or packages like `spatie/laravel-checksum`.
- How do I integrate this package into a Laravel project managing WordPress as a subdirectory?
- Use Laravel’s `Artisan::call()` to execute WP-CLI commands. For example, add a custom Artisan command in Laravel to run `wp core verify-checksums` with flags like `--version` or `--format=json`. Parse the JSON output in Laravel for further validation or logging.
- Does this package support Laravel 10+ and PHP 8.2+?
- The package supports PHP 7.0+, but Laravel 10 requires PHP 8.2+. While the package may work, test thoroughly for compatibility, especially with WP-CLI dependencies. The `--insecure` flag could also conflict with Laravel’s HTTPS enforcement, so avoid it in production.
- Can I exclude specific files or directories from checksum verification?
- Yes, use the `--exclude=<files>` flag to skip files or directories. For example, `wp core verify-checksums --exclude=wp-content/uploads,wp-content/cache` will exclude those paths. This is useful for ignoring large or dynamic files like uploads.
- How do I handle the JSON output in Laravel for automation (e.g., CI/CD)?
- Run the command with `--format=json` and capture the output using `exec()` or `Artisan::output()`. Parse the JSON in Laravel to extract verification results, such as mismatched files or success status. Example: `$output = shell_exec('wp core verify-checksums --format=json'); $data = json_decode($output, true);`.
- Is there a way to verify checksums for a specific WordPress version or locale?
- Yes, use the `--version=<version>` and `--locale=<locale>` flags. For example, `wp core verify-checksums --version=6.4 --locale=en_US` will verify against the specified version and locale. This is useful for testing updates or multilingual WordPress setups.
- Will this package work in a Dockerized Laravel-WordPress environment?
- Yes, but ensure WP-CLI is installed in the same container or accessible via Docker networking. Use `exec()` or `Artisan::call()` to run the command inside the container. For isolated testing, spin up a WordPress container with Laravel’s Docker setup and run the checksum command there.
- Are there security risks with the `--insecure` flag in Laravel production?
- Absolutely. The `--insecure` flag bypasses TLS validation, exposing your system to MITM attacks. Avoid using it in production. Instead, ensure your Laravel environment and WordPress.org’s checksum endpoints use valid TLS certificates, or disable the flag entirely in your CI/CD pipeline.
- Can I use this for verifying plugins or themes, not just WordPress core?
- No, this package is limited to WordPress core files. For plugins or themes, you’d need to manually compare checksums or use WordPress-specific tools like `wp plugin verify-checksums` (if available). For Laravel-managed plugins, consider generating and storing checksums separately.
- What’s the best way to test this package in a Laravel project?
- Set up a local WordPress instance (e.g., using Laravel Valet + WordPress or Docker) and install WP-CLI globally or via Composer. Write Laravel tests that execute the checksum command via `Artisan::call()` or `exec()`, then assert the output matches expected results. Mock external API calls if needed.
Weaver
How can I help you explore Laravel packages today?