Mô tả
DGXPCO (Digital Guarantees for eXplicitly Permitted Core Operations) is a proof-of-concept cryptographic signature verification utility for WordPress software updates. The plugin will source manual (offline) signatures for WordPress core updates and prevent the application from updating unless the contents of the update payload are verified with a remote signature.
This provides a second source of truth for the integrity of WordPress updates beyond the MD5 content hash supplied in the header from the WordPress update server. If that server were ever breached, it’s unlikely the server hosting the signatures of the files was also breached. If the signatures ever fail to validate, you can know your site was protected from an attack.
Cài đặt
Manual Installation
- Upload the entire
/dgxpcodirectory to the/wp-content/plugins/directory. - Activate DGXPCO through the ‘Plugins’ menu in WordPress.
Hỏi đáp
- Installation Instructions
-
Manual Installation
- Upload the entire
/dgxpcodirectory to the/wp-content/plugins/directory. - Activate DGXPCO through the ‘Plugins’ menu in WordPress.
- Upload the entire
- Who is responsible for the signatures
-
At the moment, Eric Mann will personally verify and sign every new update payload once it’s released by the core team. The signatures of each core file are hosted in a separate GitHub repository, with every commit signed by Eric’s GPG private key for redundant verification.
Đánh giá
There are no reviews for this plugin.
Người đóng góp & Lập trình viên
“DGXPCO” đã được dịch qua 1 ngôn ngữ. Cảm ơn những người tham gia dịch vì đóng góp của họ.
Dịch “DGXPCO” sang ngôn ngữ của bạn.
Muốn tham gia phát triển?
Duyệt code, check out SVN repository, hoặc theo dõi nhật ký phát triển qua RSS.
Nhật ký thay đổi
1.2.0
- Filter the upgrade cache to avoid prompting core upgrades with missing signatures.
1.1.0
- Introduce integration test for full core compatibility guarantees.
1.0.0
- First release