DGXPCO is proof-of-concept signature utility for WordPress software updates.
The plugin will source manual signatures for WordPress core updates and prevent the application from updating unless the contents of the update payload are verified with remote signature..
This provides source of truth for the integrity of WordPress updates beyond MD5 content hash supplied in the header from WordPress update server.
If that server were ever breached, it's unlikely the server hosting the signatures of the files was also breached.
Upload the entire dgxpco directory to the wp-content plugins directory..
Activate DGXPCO through 'Plugins WordPress...
At the moment, Eric Mann will verify and sign every new update payload once it's released by the team.
The signatures of each core file are hosted in GitHub repository, with every commit signed by Eric's GPG private key for redundant verification...
Browse the code, check out SVN repository, or subscribe to the development log by RSS...
Filter the upgrade cache to avoid prompting core upgrades with missing signatures.. 1.1.0.
Read more
Related items:
