API / Minn\Ops / EngineChecksums

EngineChecksums final readonly class

Minn\Ops\EngineChecksums · public/minn/src/Minn/Ops/EngineChecksums.php · 157 lines

Checks a Minn install's files against the release they claim to be, the way `wp core verify-checksums` checks WordPress's against wordpress.org: the update service describes the running version's release, its minn.zip is downloaded from the service alone and must match its published sha256 and carry a signature from a key this engine trusts (EngineUpdate), and then every file of the engine is compared with the archive's, as are the shape files at the webroot with the archive's layout templates. A file that differs, one the archive has and the install lacks, and one the install has beyond the archive are all named. The install record (.install.json) is the site's own and is not compared.

Uses 6

Http Http\Download Directory EngineUpdate Release Support\Files

Used by 1

Cli\CoreCommand

Constants and properties

const	`SOURCE` = `'https://updates.minn.run/v1/minn/releases/'`	Where a version's release record is asked for.
private	`MAX_DOWNLOAD` = `67108864`
private	`OWN` = `array ( 0 => '.install.json', )`
private	`readonly string $engineDir`	Promoted from the constructor.
private	`readonly array $keys`	Promoted from the constructor.
private	`readonly Minn\Http $http`	Promoted from the constructor.

Public

new

__construct(string $engineDir, array $keys = Minn\Ops\EngineUpdate::KEYS, Minn\Http $http = \Minn\Http::__set_state(array(    'within' =>    array (   ),    'fake' => NULL,    'refusal' => NULL, )))

$keys list<string> the release keys to trust (tests pass their own)

method

check(string $webroot): array#

The comparison: the version checked, and the paths (under minn/, or at the webroot for shape files) that differ, are missing, or are extra.

@return array{version: string, changed: list<string>, missing: list<string>, extra: list<string>}

Internals 6

Private and protected methods: how the class does its work. Not a contract; they change whenever the code is tidied.

private

release(string $version): Minn\Ops\Release#

The release the service describes for a version; it must be one Minn offers, of that version.

private

archiveHashes(string $zip): array#

The sha256 of every file in the archive's engine folder, by its path inside that folder.

@return array<string, string>

private

treeHashes(string $dir): array#

The sha256 of every file under the engine folder, by its path inside it; the install record left out.

@return array<string, string>

private

layoutOf(array $released): array#

The archive's layout templates by the webroot path each shapes.

$released array<string, string>

@return array<string, string>

private

shapeHashes(string $webroot, array $paths): array#

The sha256 of the webroot's shape files that exist.

$paths list<string>

@return array<string, string>

private

compare(array $expected, array $found, string $prefix): array#

Expected against found: the paths that differ, are missing, and are extra, prefixed.

`$expected`	`array<string, string>`
`$found`	`array<string, string>`

@return array{changed: list<string>, missing: list<string>, extra: list<string>}