Feature: Add checksum support

[Zodiac1978]

I was looking for a way to establish a checksum check like WordPress is providing for Core and Plugins/Themes and found this:
https://github.blog/changelog/2025-06-03-releases-now-expose-digests-for-release-assets/

It is not perfect, because it does not generate the SHA for automatic releases, only for uploaded release assets, but there are GitHub Actions which can provide a workflow for this.

We could check the API and if there is no checksum (null returned) we skip the check, otherwise we compare the checksums.

What do you think? Is this idea worth exploring?

[afragen]

Where does WordPress provide checksums for plugins and themes? Is this new?

[Zodiac1978]

Here are the specs for the endpoint:
https://docs.google.com/document/d/14-SMpaPtDGEBm8hE9ZwnA-vik5OvECDig32KqX8uFlg/mobilebasic

[afragen]

WordPress doesn't use checksums when updating. The code may be present in core but I think it's only used for core updates, not plugins and themes.

[afragen]

It sure sounds like you want FAIR. https://fair.pm

[Zodiac1978]

The code may be present in core but I think it's only used for core updates, not plugins and themes.

That's correct. But there are plugins using it for integrity tests.

[afragen]

So here's the problem.

1. Not all git hosts support this. I'm referring to Bitbucket, etc
2. Not all GitHub repositories use release assets

How would you account for the discrepancies?

[Zodiac1978]

As this is not part of what we can solve in the plugin itself we need to use progressive enhancement / graceful degradation here. If there is no checksum the API will return "null" and in that case we need to skip the check. If the API returns a checksum, we can calculate one locally and compare it with what the API returned.

This is not cryptographically safe, I know that - it would just be a simple, fast way to check the integrity of a plugin. I know that a compromised installation could modify the check, but the same argument could be made to the integrity check in the Health Check or security plugins ...

My use case is this: As a maintenance guy, I clean up hacked websites sometimes. Tools like "Ninjascanner" or "WP Cerber" allow me to check all themes, plugins from the official directories (and core files and folders) for integrity. All other folder/files from any paid plugin/theme need to be checked manually.

It would be helpful if I could also check those custom or paid plugins/themes, and therefore I looked at the infrastructure distributing those plugins/themes. This is what brings me to your plugin. I would also like to ask EDD, WooCommerce, Envato, Git Installer, etc. for the same. How can we add checksums in the process of delivering plugins/themes to installations and how could we check them, maybe in a standardized way.

Offering this for those who want to provide checksums could be one step in the right direction.

Hopefully this is now more clear, what I'm trying to achieve here. But I'm also fine, if you think this is out of scope for this plugin or to niche for those using this plugin to distribute their code.