wp-update-server.md

WP Update Server Notes

See this guide for how to create a mirror of the WordPress.org SVN repositories.

WP.org API

WP.org hosts the API at api.wordpress.org (documented in the old wiki) which is accessed by WP installations via HTTP on older servers that can't do latest HTTPS crypto or upgraded to HTTPS requests on all other server.

Only some of the API source code is available at:

• GitHub https://github.com/WordPress/wordpress.org/tree/49f200e6a5e2ad97ca87213db239db5f7bea322d/api.wordpress.org
• SVN https://meta.svn.wordpress.org/sites/trunk/api.wordpress.org/

Note: I haven't been able to find the source code serving the core/version-check or [themes|plugins]/update-check endpoints!

WordPress Application

WP core checks for various updates to the following WP.org API endpoints:

Misc:

• https://api.wordpress.org/secret-key/1.1/salt/ (source and source) -- GET request with no payload.
• https://api.wordpress.org/events/1.0/ (source) -- GET request with WP version user-agent and location arguments.
• https://api.wordpress.org/core/handbook/1.0/ (source and source) front-end only (not called by the server)

Patterns:

• http://api.wordpress.org/patterns/1.0/ (source) GET request.

Core:

• http://api.wordpress.org/core/credits/1.1/ (source)
• http://api.wordpress.org/core/browse-happy/1.1/ (source)
• http://api.wordpress.org/core/serve-happy/1.0/ (source)
• http://api.wordpress.org/core/importers/1.1/ (source)
• http://api.wordpress.org/core/checksums/1.0/ (source)
• http://api.wordpress.org/core/version-check/1.7/ (source) POST request with wp_install (network site URL or home URL) and wp_blog (home URL) headers.

Plugins:

• http://api.wordpress.org/plugins/info/1.2/ (source)
• http://api.wordpress.org/plugins/update-check/1.1/ (source) POST request with the following body [ 'plugins' => [ ... ], 'translations' => [ ... ], 'locale' => '...', 'all' => true ].

Themes:

• http://api.wordpress.org/themes/info/1.2/ (source)
• http://api.wordpress.org/themes/update-check/1.1/ (source)

Translations:

• http://api.wordpress.org/translations/plugins/1.0/ (source)
• http://api.wordpress.org/translations/themes/1.0/ (source)
• http://api.wordpress.org/translations/core/1.0/ (source)

@devhaozi Thanks! It appears to be rewriting those requests to api.wpmirror.com/... which seems to be a simple reverse proxy to the WP.org origin (I'm not 100% sure).

Do you have any insight into the code that actually runs on the /core/version-check/1.7 endpoints? I haven't been able to find that anywhere in public.

Yes, for APIs that have not yet been implemented, they will simply be reverse proxied to w.org currently, it has a hash-based cache to prevent excessive requests to w.org.

For /core/version-check/1.7, it can use custom post type + postmeta to implement it if necessary, wenpai.org currently implements plugins, themes and translations, core is not in currently planned.

This project was originally intended to solve the problem of w.org blocking China IPs, but later it developed into a large platform.
We refactored the plugin/theme API to optimize the speed. They now use Elasticsearch as the backend, which is very fast. We also made many improvements to GlotPress, supporting Elasticsearch memory suggestion, fully automatic machine translation, etc.