Skip to content

fix: extract WordPress core without truncated file names #78

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mrrobot47 merged 2 commits into from
Oct 5, 2026
Merged

fix: extract WordPress core without truncated file names #78

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c711f91
fix: extract WordPress core without truncated file names
iamimmanuelraj Oct 5, 2026
9bbd5d5
fix: only downgrade checksum-fetch failures to a warning
iamimmanuelraj Oct 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 42 additions & 1 deletion main.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -239,6 +239,47 @@ function maybe_run_php_build() {
update-alternatives --set php /usr/bin/php${DEFAULT_PHP_VERSION}
}

# WP-CLI <= 2.12 extracts .tar.gz packages with PharData, which truncates paths longer than
# 100 bytes in WordPress 7.x packages (wp-cli/wp-cli#6320). So WP-CLI only downloads and
# md5-checks the package here, tar/unzip extract it, and checksums must verify afterwards.
# Same approach as EasyEngine/site-command#504. WP-CLI >= 3.0 saves a .zip instead.
function download_wordpress_core() {

local version="$1" tmp pkg out

# Nightly builds use WP-CLI's own .zip extraction and have no published checksums.
if [[ "$version" == "nightly" || "$version" == "trunk" ]]; then
wp core download --version="$version" --allow-root
return
fi

tmp=$(mktemp -d)
wp core download --no-extract --version="$version" --path="$tmp" --allow-root
pkg=$(find "$tmp" -maxdepth 1 -type f \( -name '*.tar.gz' -o -name '*.tgz' -o -name '*.zip' \) | head -n 1)
if [[ -z "$pkg" ]]; then
echo "Error: WordPress package not found after download." >&2
exit 1
fi

if [[ "$pkg" == *.zip ]]; then
unzip -q "$pkg" -d "$tmp/x"
cp -R "$tmp/x/wordpress/." .
else
tar -xzf "$pkg" --no-same-owner --strip-components=1
fi
rm -rf "$tmp"

# Only a failure to fetch the checksums from WordPress.org is downgraded to a warning; anything else is fatal.
if ! out=$(wp core verify-checksums --allow-root 2>&1); then
if [[ "$out" == *"File doesn't exist:"* || "$out" == *"File doesn't verify against checksum:"* ]] ||
! [[ "$out" == *"Couldn't get checksums"* || "$out" == *"api.wordpress.org"* || "$out" == *"Failed to decode JSON"* ]]; then
echo "$out" >&2
exit 1
fi
echo "Warning: Could not verify WordPress core checksums: $out" >&2
fi
}

function setup_wordpress_files() {

mkdir -p "$HTDOCS"
Expand Down Expand Up @@ -274,7 +315,7 @@ function setup_wordpress_files() {
fi
fi

wp core download --version="$WP_VERSION" --allow-root
download_wordpress_core "$WP_VERSION"

rm -r wp-content/

Expand Down