4 ms·

If WordPress users are going to start using mirrors then WordPress needs to add and support package signing. Otherwise we've added another way to backdoor WordP

• vbtechguy 2y ago
  +1 that would be very useful. This mirror implementation at least mirrors the official wordpress.org plugin json metadata and checksum files so you can verify as well https://github.com/centminmod/wordpress-plugin-mirror-poc#how-it-works https://github.com/centminmod/wordpress-plugin-mirror-poc#ho... Though still limiting as you can only checksum files after plugin installation. You probably need a staging WordPress install to verify mirror plugins before rolling out for production usage