From c711f912d5c8eae190e778324a363f11c36e45b4 Mon Sep 17 00:00:00 2001
From: Immanuel Raj <iamimmanuelraj@gmail.com>
Date: Mon, 5 Oct 2026 11:24:50 +0530
Subject: [PATCH 1/2] fix: extract WordPress core without truncated file names

WordPress 7.x .tar.gz packages store paths longer than 100 bytes in PAX
headers. WP-CLI <= 2.12 extracts with PharData, which truncates them
(wp-cli/wp-cli#6320), so deployed sites fail `wp core verify-checksums`.

Let WP-CLI only download and md5-check the package (--no-extract), extract
it with tar/unzip, then gate on wp core verify-checksums. Mirrors
EasyEngine/site-command#504 and EasyEngine/site-type-wp#241.
---
 main.sh | 42 +++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 41 insertions(+), 1 deletion(-)

diff --git a/main.sh b/main.sh
index 7fcb471..4c16725 100755
--- a/main.sh
+++ b/main.sh
@@ -239,6 +239,46 @@ function maybe_run_php_build() {
 	update-alternatives --set php /usr/bin/php${DEFAULT_PHP_VERSION}
 }
 
+# WP-CLI <= 2.12 extracts .tar.gz packages with PharData, which truncates paths longer than
+# 100 bytes in WordPress 7.x packages (wp-cli/wp-cli#6320). So WP-CLI only downloads and
+# md5-checks the package here, tar/unzip extract it, and checksums must verify afterwards.
+# Same approach as EasyEngine/site-command#504. WP-CLI >= 3.0 saves a .zip instead.
+function download_wordpress_core() {
+
+	local version="$1" tmp pkg out
+
+	# Nightly builds use WP-CLI's own .zip extraction and have no published checksums.
+	if [[ "$version" == "nightly" || "$version" == "trunk" ]]; then
+		wp core download --version="$version" --allow-root
+		return
+	fi
+
+	tmp=$(mktemp -d)
+	wp core download --no-extract --version="$version" --path="$tmp" --allow-root
+	pkg=$(find "$tmp" -maxdepth 1 -type f \( -name '*.tar.gz' -o -name '*.tgz' -o -name '*.zip' \) | head -n 1)
+	if [[ -z "$pkg" ]]; then
+		echo "Error: WordPress package not found after download." >&2
+		exit 1
+	fi
+
+	if [[ "$pkg" == *.zip ]]; then
+		unzip -q "$pkg" -d "$tmp/x"
+		cp -R "$tmp/x/wordpress/." .
+	else
+		tar -xzf "$pkg" --no-same-owner --strip-components=1
+	fi
+	rm -rf "$tmp"
+
+	# Fail on missing or modified core files; only warn when WordPress.org checksums can't be fetched.
+	if ! out=$(wp core verify-checksums --allow-root 2>&1); then
+		if [[ "$out" == *"File doesn't exist:"* || "$out" == *"File doesn't verify against checksum:"* ]]; then
+			echo "$out" >&2
+			exit 1
+		fi
+		echo "Warning: Could not verify WordPress core checksums: $out" >&2
+	fi
+}
+
 function setup_wordpress_files() {
 
 	mkdir -p "$HTDOCS"
@@ -274,7 +314,7 @@ function setup_wordpress_files() {
 		fi
 	fi
 
-	wp core download --version="$WP_VERSION" --allow-root
+	download_wordpress_core "$WP_VERSION"
 
 	rm -r wp-content/
 

From 9bbd5d52b297ff939ef02a8635f0f76894ecef37 Mon Sep 17 00:00:00 2001
From: Immanuel Raj <iamimmanuelraj@gmail.com>
Date: Mon, 5 Oct 2026 11:30:25 +0530
Subject: [PATCH 2/2] fix: only downgrade checksum-fetch failures to a warning

Any other verify-checksums failure (PHP/WP-CLI runtime errors etc.) now
fails the deploy instead of continuing unverified. Matches the fetch-error
handling in EasyEngine/site-command#504.
---
 main.sh | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/main.sh b/main.sh
index 4c16725..11fc0e9 100755
--- a/main.sh
+++ b/main.sh
@@ -269,9 +269,10 @@ function download_wordpress_core() {
 	fi
 	rm -rf "$tmp"
 
-	# Fail on missing or modified core files; only warn when WordPress.org checksums can't be fetched.
+	# Only a failure to fetch the checksums from WordPress.org is downgraded to a warning; anything else is fatal.
 	if ! out=$(wp core verify-checksums --allow-root 2>&1); then
-		if [[ "$out" == *"File doesn't exist:"* || "$out" == *"File doesn't verify against checksum:"* ]]; then
+		if [[ "$out" == *"File doesn't exist:"* || "$out" == *"File doesn't verify against checksum:"* ]] ||
+			! [[ "$out" == *"Couldn't get checksums"* || "$out" == *"api.wordpress.org"* || "$out" == *"Failed to decode JSON"* ]]; then
 			echo "$out" >&2
 			exit 1
 		fi