{"repo":"johnbillion/rave-wordpress","free":true,"listed":false,"github":"https://github.com/johnbillion/rave-wordpress","clone":"git clone https://github.com/johnbillion/rave-wordpress.git","description":"Reproduces WordPress builds and verifies that the official and unofficial packages haven't been tampered with.","language":null,"stars":61,"topics":["supply-chain-security","wordpress"],"license":"MIT","category":"security-tools","readme_excerpt":"RAVE for WordPress RAVE for WordPress is a supply chain security tool which reproduces builds of WordPress from the source code and compares them to published packages of WordPress to verify that the packages have not been tampered with. The packages from wordpress.org are tested along with those from GitHub and various third parties. A CI system runs on GitHub Actions which reproduces the build from the canonical sources, fetches packages published at several official and unofficial locations, and compares them all against one another to verify their integrity and identify any anomalies. An in-toto release attestation is produced for packages which pass verification. RAVE stands for Reproduce And Verify. What's tested? Source code ✅ develop.svn.wordpress.org ✅ develop.git.wordpress.org ✅ github.com/wordpress/wordpress-develop ✅ core.trac.wordpress.org Temporarily disabled Official packages ✅ wordpress.org/latest.zip ✅ wordpress.org/wordpress-{tag}.zip ✅ downloads.wordpress.org/release/wordpress-{tag}.zip ✅ downloads.w.org/release/wordpress-{tag}.zip ✅ github.com/wordpress/wordpress ✅ build.trac.wordpress.org Temporarily disabled ✅ wp-core/wordpress Official builds ✅ core.git.wordpress.org ✅ core.svn.wordpress.org Unofficial packages ✅ core-updates.wpengine.com from WP Engine ✅ api.aspirecloud.net from AspireCloud ✅ roots/wordpress-full on Packagist ✅ johnpbloch/wordpress on Packagist Other verifications ✅ MD5 and SHA-1 hashes published on wordpress.org are verified against t","default_branch":null,"files":null,"tree":[],"storefront":"/r/johnbillion","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/johnbillion/rave-wordpress/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}