silentmode/sirius-press
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
sirius-press/tools/update-wordpress.sh

229 lines
8.4 KiB
Bash
Raw Normal View History

feat(sirius-press): a WordPress where the account is a key, not a mailbox WordPress makes two assumptions this project cannot accept: that identity comes from an email address, and that a site lives at one server. Both are things somebody else can take away — a mailbox is rented from a provider who can close it or be compelled to open it, and a server is one seizure from being gone. Sirius Press replaces the first and hedges the second. Signing in means signing a challenge with the key that controls a CashAddress. The address is recovered from the signature, so nothing is typed but the signature itself, and the result is an ordinary WordPress session cookie — roles, capabilities, nonces and the REST API never learn the login was different. Three ways to produce one: a wallet the browser already exposes, a phrase used once in the page and wiped, or a signature pasted in from any BIP-137 wallet, which needs no JavaScript and lets the key stay on a machine that never touches the web. There is no password reset, and the recovery page says so plainly rather than offering a form that cannot work. A reset mechanism is by construction a way to take an account from its owner, and it is always easier to attack than the cryptography it bypasses. Publishing a post also exports it as static HTML to the name's storage on Sia, signed by the key that owns the name, so the site keeps answering when the server does not. Email as a feature is untouched. wp_mail() still works, SMTP still sends, and contact forms still deliver to addresses real people typed. Only mail to the site's own unroutable placeholder addresses is diverted to an in-app inbox. The objection was to email as identity, not to email. Core is pinned and patched rather than vendored. WordPress 7.1.1 is 149 MB and 5,008 files; the fork's entire core diff is 75 lines in wp-admin/install.php. Carrying the former to express the latter would bury the patch where nobody reviews it and make every clone of the monorepo pay for it. Upstream releases still merge through tools/update-wordpress.sh, which reapplies the series and says exactly which hunk needs a human. The cryptography is implemented twice — PHP on the server, JavaScript in the page — because the server must verify and the browser must sign. Both are pinned against libauth, the library the Sirius portal wallet and the BNS gateway already use, so a disagreement of one byte fails the test suite rather than presenting as a rejected login at three in the morning. 132 checks, no framework, about a second.
2026-09-21 01:39:38 +02:00
#!/usr/bin/env bash
build(sirius-press): build from the vendored subtree instead of a download The subtree is in place, so everything that used to fetch and patch core at build time now just copies it. tools/build.sh copies wordpress/ — no download, no checksum step, because there is nothing to fetch and nothing to trust that is not already in the repository docker/Dockerfile COPY wordpress/ instead of curl + sha256 + patch; the build args and the `patch` package are gone docker-compose.yml no WP_VERSION / WP_URL / WP_SHA256 to keep in step tools/update-wordpress.sh is rewritten around what the subtree makes possible. It imports the pristine release onto sirius-press/wordpress-upstream and then `git subtree merge`s that branch, which three-way merges upstream against the fork's own commit. A patch either applies with fuzz and hopes or fails and leaves you re-deriving the change by hand; a merge conflict is resolved once, in the file, and the next release merges against the resolution. patches/ survives as documentation rather than mechanism, and is now generated: tools/refresh-patches.sh diffs the subtree against the pristine import and rewrites the directory, with --check for CI. It answers the question anyone auditing a fork asks first — what exactly did you change inside WordPress? — in a minute, which `git log wordpress/` cannot, because that log is mostly upstream imports. Generated documentation stays true; a hand-maintained record of a core diff drifts, and a stale one is worse than none because people trust it. One test change worth noting: the syntax sweep no longer walks all of wordpress/. It lints the fork's own PHP plus every core file patches/ says the fork touches, which keeps the suite at seven seconds instead of a minute while still covering the only core file that can break.
2026-09-21 03:19:28 +02:00
# update-wordpress.sh — bring a new WordPress release into the fork.
feat(sirius-press): a WordPress where the account is a key, not a mailbox WordPress makes two assumptions this project cannot accept: that identity comes from an email address, and that a site lives at one server. Both are things somebody else can take away — a mailbox is rented from a provider who can close it or be compelled to open it, and a server is one seizure from being gone. Sirius Press replaces the first and hedges the second. Signing in means signing a challenge with the key that controls a CashAddress. The address is recovered from the signature, so nothing is typed but the signature itself, and the result is an ordinary WordPress session cookie — roles, capabilities, nonces and the REST API never learn the login was different. Three ways to produce one: a wallet the browser already exposes, a phrase used once in the page and wiped, or a signature pasted in from any BIP-137 wallet, which needs no JavaScript and lets the key stay on a machine that never touches the web. There is no password reset, and the recovery page says so plainly rather than offering a form that cannot work. A reset mechanism is by construction a way to take an account from its owner, and it is always easier to attack than the cryptography it bypasses. Publishing a post also exports it as static HTML to the name's storage on Sia, signed by the key that owns the name, so the site keeps answering when the server does not. Email as a feature is untouched. wp_mail() still works, SMTP still sends, and contact forms still deliver to addresses real people typed. Only mail to the site's own unroutable placeholder addresses is diverted to an in-app inbox. The objection was to email as identity, not to email. Core is pinned and patched rather than vendored. WordPress 7.1.1 is 149 MB and 5,008 files; the fork's entire core diff is 75 lines in wp-admin/install.php. Carrying the former to express the latter would bury the patch where nobody reviews it and make every clone of the monorepo pay for it. Upstream releases still merge through tools/update-wordpress.sh, which reapplies the series and says exactly which hunk needs a human. The cryptography is implemented twice — PHP on the server, JavaScript in the page — because the server must verify and the browser must sign. Both are pinned against libauth, the library the Sirius portal wallet and the BNS gateway already use, so a disagreement of one byte fails the test suite rather than presenting as a rejected login at three in the morning. 132 checks, no framework, about a second.
2026-09-21 01:39:38 +02:00
#
# tools/update-wordpress.sh 7.1.2
#
build(sirius-press): build from the vendored subtree instead of a download The subtree is in place, so everything that used to fetch and patch core at build time now just copies it. tools/build.sh copies wordpress/ — no download, no checksum step, because there is nothing to fetch and nothing to trust that is not already in the repository docker/Dockerfile COPY wordpress/ instead of curl + sha256 + patch; the build args and the `patch` package are gone docker-compose.yml no WP_VERSION / WP_URL / WP_SHA256 to keep in step tools/update-wordpress.sh is rewritten around what the subtree makes possible. It imports the pristine release onto sirius-press/wordpress-upstream and then `git subtree merge`s that branch, which three-way merges upstream against the fork's own commit. A patch either applies with fuzz and hopes or fails and leaves you re-deriving the change by hand; a merge conflict is resolved once, in the file, and the next release merges against the resolution. patches/ survives as documentation rather than mechanism, and is now generated: tools/refresh-patches.sh diffs the subtree against the pristine import and rewrites the directory, with --check for CI. It answers the question anyone auditing a fork asks first — what exactly did you change inside WordPress? — in a minute, which `git log wordpress/` cannot, because that log is mostly upstream imports. Generated documentation stays true; a hand-maintained record of a core diff drifts, and a stale one is worse than none because people trust it. One test change worth noting: the syntax sweep no longer walks all of wordpress/. It lints the fork's own PHP plus every core file patches/ says the fork touches, which keeps the suite at seven seconds instead of a minute while still covering the only core file that can break.
2026-09-21 03:19:28 +02:00
# Two steps, and the second is the one that matters:
feat(sirius-press): a WordPress where the account is a key, not a mailbox WordPress makes two assumptions this project cannot accept: that identity comes from an email address, and that a site lives at one server. Both are things somebody else can take away — a mailbox is rented from a provider who can close it or be compelled to open it, and a server is one seizure from being gone. Sirius Press replaces the first and hedges the second. Signing in means signing a challenge with the key that controls a CashAddress. The address is recovered from the signature, so nothing is typed but the signature itself, and the result is an ordinary WordPress session cookie — roles, capabilities, nonces and the REST API never learn the login was different. Three ways to produce one: a wallet the browser already exposes, a phrase used once in the page and wiped, or a signature pasted in from any BIP-137 wallet, which needs no JavaScript and lets the key stay on a machine that never touches the web. There is no password reset, and the recovery page says so plainly rather than offering a form that cannot work. A reset mechanism is by construction a way to take an account from its owner, and it is always easier to attack than the cryptography it bypasses. Publishing a post also exports it as static HTML to the name's storage on Sia, signed by the key that owns the name, so the site keeps answering when the server does not. Email as a feature is untouched. wp_mail() still works, SMTP still sends, and contact forms still deliver to addresses real people typed. Only mail to the site's own unroutable placeholder addresses is diverted to an in-app inbox. The objection was to email as identity, not to email. Core is pinned and patched rather than vendored. WordPress 7.1.1 is 149 MB and 5,008 files; the fork's entire core diff is 75 lines in wp-admin/install.php. Carrying the former to express the latter would bury the patch where nobody reviews it and make every clone of the monorepo pay for it. Upstream releases still merge through tools/update-wordpress.sh, which reapplies the series and says exactly which hunk needs a human. The cryptography is implemented twice — PHP on the server, JavaScript in the page — because the server must verify and the browser must sign. Both are pinned against libauth, the library the Sirius portal wallet and the BNS gateway already use, so a disagreement of one byte fails the test suite rather than presenting as a rejected login at three in the morning. 132 checks, no framework, about a second.
2026-09-21 01:39:38 +02:00
#
build(sirius-press): build from the vendored subtree instead of a download The subtree is in place, so everything that used to fetch and patch core at build time now just copies it. tools/build.sh copies wordpress/ — no download, no checksum step, because there is nothing to fetch and nothing to trust that is not already in the repository docker/Dockerfile COPY wordpress/ instead of curl + sha256 + patch; the build args and the `patch` package are gone docker-compose.yml no WP_VERSION / WP_URL / WP_SHA256 to keep in step tools/update-wordpress.sh is rewritten around what the subtree makes possible. It imports the pristine release onto sirius-press/wordpress-upstream and then `git subtree merge`s that branch, which three-way merges upstream against the fork's own commit. A patch either applies with fuzz and hopes or fails and leaves you re-deriving the change by hand; a merge conflict is resolved once, in the file, and the next release merges against the resolution. patches/ survives as documentation rather than mechanism, and is now generated: tools/refresh-patches.sh diffs the subtree against the pristine import and rewrites the directory, with --check for CI. It answers the question anyone auditing a fork asks first — what exactly did you change inside WordPress? — in a minute, which `git log wordpress/` cannot, because that log is mostly upstream imports. Generated documentation stays true; a hand-maintained record of a core diff drifts, and a stale one is worse than none because people trust it. One test change worth noting: the syntax sweep no longer walks all of wordpress/. It lints the fork's own PHP plus every core file patches/ says the fork touches, which keeps the suite at seven seconds instead of a minute while still covering the only core file that can break.
2026-09-21 03:19:28 +02:00
# 1. Import the pristine release onto the `sirius-press/wordpress-upstream`
# branch — one commit per version, nothing but upstream, never edited.
# 2. `git subtree merge` that branch into wordpress/, which three-way merges
# it against the fork's own commits on top of the last import.
#
# That second step is why core is vendored rather than patched at build time.
# A three-way merge understands that upstream changed lines A and B while the
# fork changed line C, and only stops when they overlap. It also leaves a
# conflict you resolve once, in the file, instead of a patch you re-derive
# every release.
#
feat(sirius-press): take WordPress 7.1.2, and fix what that exposed The first real upstream release since the subtree landed, and the point of the whole arrangement. It merged cleanly: 7.1.2 changes about.php, template.php and version.php, none of which this fork touches, so the patched installer came through byte-identical and there was nothing to resolve. Getting there needed two fixes to the tool, both of which only a real release could have found — the earlier same-version run was a no-op that exercised none of this. **The prefix was an absolute path.** `${here#"$repo"/}` assumes the two strings share a spelling, and on Windows they do not: --show-toplevel answers "D:/Dev/…" while $PWD is "/d/Dev/…", so the subtraction left the path untouched and `git subtree merge --prefix` was handed something absolute. The same bug was fixed in refresh-patches.sh a few commits ago; this is the other copy of it. Both now ask git via `rev-parse --show-prefix`. **git-subtree refuses to run in a dirty repository** — any modification anywhere, not just under the subtree. In a monorepo shared with other work that is the normal state, so the tool was unusable exactly where it lives. The merge now happens in a scratch worktree, which is clean by construction, and comes back as one ordinary merge commit that touches only wordpress/ and so does not care what else is modified. Also: a failed run no longer refuses to retry. The import onto the upstream branch is idempotent now, and the failure message distinguishes "upstream and the fork changed the same lines" from "the merge could not start", instead of blaming a conflict for both.
2026-09-22 20:18:45 +02:00
# The merge happens in a temporary worktree, not in your checkout. git-subtree
# refuses to run at all when anything in the repository is modified, and in a
# monorepo shared with other work that is the normal state — the merge would
# be blocked by uncommitted files it does not touch. A worktree is clean by
# construction, and the result comes back as one ordinary merge commit.
#
# Nothing is pushed. Run it, look at the merge, run the tests, then push.
feat(sirius-press): a WordPress where the account is a key, not a mailbox WordPress makes two assumptions this project cannot accept: that identity comes from an email address, and that a site lives at one server. Both are things somebody else can take away — a mailbox is rented from a provider who can close it or be compelled to open it, and a server is one seizure from being gone. Sirius Press replaces the first and hedges the second. Signing in means signing a challenge with the key that controls a CashAddress. The address is recovered from the signature, so nothing is typed but the signature itself, and the result is an ordinary WordPress session cookie — roles, capabilities, nonces and the REST API never learn the login was different. Three ways to produce one: a wallet the browser already exposes, a phrase used once in the page and wiped, or a signature pasted in from any BIP-137 wallet, which needs no JavaScript and lets the key stay on a machine that never touches the web. There is no password reset, and the recovery page says so plainly rather than offering a form that cannot work. A reset mechanism is by construction a way to take an account from its owner, and it is always easier to attack than the cryptography it bypasses. Publishing a post also exports it as static HTML to the name's storage on Sia, signed by the key that owns the name, so the site keeps answering when the server does not. Email as a feature is untouched. wp_mail() still works, SMTP still sends, and contact forms still deliver to addresses real people typed. Only mail to the site's own unroutable placeholder addresses is diverted to an in-app inbox. The objection was to email as identity, not to email. Core is pinned and patched rather than vendored. WordPress 7.1.1 is 149 MB and 5,008 files; the fork's entire core diff is 75 lines in wp-admin/install.php. Carrying the former to express the latter would bury the patch where nobody reviews it and make every clone of the monorepo pay for it. Upstream releases still merge through tools/update-wordpress.sh, which reapplies the series and says exactly which hunk needs a human. The cryptography is implemented twice — PHP on the server, JavaScript in the page — because the server must verify and the browser must sign. Both are pinned against libauth, the library the Sirius portal wallet and the BNS gateway already use, so a disagreement of one byte fails the test suite rather than presenting as a rejected login at three in the morning. 132 checks, no framework, about a second.
2026-09-21 01:39:38 +02:00
set -euo pipefail
here="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
build(sirius-press): build from the vendored subtree instead of a download The subtree is in place, so everything that used to fetch and patch core at build time now just copies it. tools/build.sh copies wordpress/ — no download, no checksum step, because there is nothing to fetch and nothing to trust that is not already in the repository docker/Dockerfile COPY wordpress/ instead of curl + sha256 + patch; the build args and the `patch` package are gone docker-compose.yml no WP_VERSION / WP_URL / WP_SHA256 to keep in step tools/update-wordpress.sh is rewritten around what the subtree makes possible. It imports the pristine release onto sirius-press/wordpress-upstream and then `git subtree merge`s that branch, which three-way merges upstream against the fork's own commit. A patch either applies with fuzz and hopes or fails and leaves you re-deriving the change by hand; a merge conflict is resolved once, in the file, and the next release merges against the resolution. patches/ survives as documentation rather than mechanism, and is now generated: tools/refresh-patches.sh diffs the subtree against the pristine import and rewrites the directory, with --check for CI. It answers the question anyone auditing a fork asks first — what exactly did you change inside WordPress? — in a minute, which `git log wordpress/` cannot, because that log is mostly upstream imports. Generated documentation stays true; a hand-maintained record of a core diff drifts, and a stale one is worse than none because people trust it. One test change worth noting: the syntax sweep no longer walks all of wordpress/. It lints the fork's own PHP plus every core file patches/ says the fork touches, which keeps the suite at seven seconds instead of a minute while still covering the only core file that can break.
2026-09-21 03:19:28 +02:00
repo="$(git -C "$here" rev-parse --show-toplevel)"
feat(sirius-press): take WordPress 7.1.2, and fix what that exposed The first real upstream release since the subtree landed, and the point of the whole arrangement. It merged cleanly: 7.1.2 changes about.php, template.php and version.php, none of which this fork touches, so the patched installer came through byte-identical and there was nothing to resolve. Getting there needed two fixes to the tool, both of which only a real release could have found — the earlier same-version run was a no-op that exercised none of this. **The prefix was an absolute path.** `${here#"$repo"/}` assumes the two strings share a spelling, and on Windows they do not: --show-toplevel answers "D:/Dev/…" while $PWD is "/d/Dev/…", so the subtraction left the path untouched and `git subtree merge --prefix` was handed something absolute. The same bug was fixed in refresh-patches.sh a few commits ago; this is the other copy of it. Both now ask git via `rev-parse --show-prefix`. **git-subtree refuses to run in a dirty repository** — any modification anywhere, not just under the subtree. In a monorepo shared with other work that is the normal state, so the tool was unusable exactly where it lives. The merge now happens in a scratch worktree, which is clean by construction, and comes back as one ordinary merge commit that touches only wordpress/ and so does not care what else is modified. Also: a failed run no longer refuses to retry. The import onto the upstream branch is idempotent now, and the failure message distinguishes "upstream and the fork changed the same lines" from "the merge could not start", instead of blaming a conflict for both.
2026-09-22 20:18:45 +02:00
# Ask git for the path rather than subtracting strings: on Windows
# --show-toplevel answers "D:/…" while $PWD is "/d/…", and the subtraction
# silently leaves an absolute path, which --prefix then rejects.
prefix="$(cd "$here" && git rev-parse --show-prefix)wordpress"
feat(sirius-press): a WordPress where the account is a key, not a mailbox WordPress makes two assumptions this project cannot accept: that identity comes from an email address, and that a site lives at one server. Both are things somebody else can take away — a mailbox is rented from a provider who can close it or be compelled to open it, and a server is one seizure from being gone. Sirius Press replaces the first and hedges the second. Signing in means signing a challenge with the key that controls a CashAddress. The address is recovered from the signature, so nothing is typed but the signature itself, and the result is an ordinary WordPress session cookie — roles, capabilities, nonces and the REST API never learn the login was different. Three ways to produce one: a wallet the browser already exposes, a phrase used once in the page and wiped, or a signature pasted in from any BIP-137 wallet, which needs no JavaScript and lets the key stay on a machine that never touches the web. There is no password reset, and the recovery page says so plainly rather than offering a form that cannot work. A reset mechanism is by construction a way to take an account from its owner, and it is always easier to attack than the cryptography it bypasses. Publishing a post also exports it as static HTML to the name's storage on Sia, signed by the key that owns the name, so the site keeps answering when the server does not. Email as a feature is untouched. wp_mail() still works, SMTP still sends, and contact forms still deliver to addresses real people typed. Only mail to the site's own unroutable placeholder addresses is diverted to an in-app inbox. The objection was to email as identity, not to email. Core is pinned and patched rather than vendored. WordPress 7.1.1 is 149 MB and 5,008 files; the fork's entire core diff is 75 lines in wp-admin/install.php. Carrying the former to express the latter would bury the patch where nobody reviews it and make every clone of the monorepo pay for it. Upstream releases still merge through tools/update-wordpress.sh, which reapplies the series and says exactly which hunk needs a human. The cryptography is implemented twice — PHP on the server, JavaScript in the page — because the server must verify and the browser must sign. Both are pinned against libauth, the library the Sirius portal wallet and the BNS gateway already use, so a disagreement of one byte fails the test suite rather than presenting as a rejected login at three in the morning. 132 checks, no framework, about a second.
2026-09-21 01:39:38 +02:00
VERSION="${1:-}"
say() { printf '\033[1m→\033[0m %s\n' "$*"; }
warn() { printf '\033[33mwarning:\033[0m %s\n' "$*" >&2; }
die() { printf '\033[31merror:\033[0m %s\n' "$*" >&2; exit 1; }
build(sirius-press): build from the vendored subtree instead of a download The subtree is in place, so everything that used to fetch and patch core at build time now just copies it. tools/build.sh copies wordpress/ — no download, no checksum step, because there is nothing to fetch and nothing to trust that is not already in the repository docker/Dockerfile COPY wordpress/ instead of curl + sha256 + patch; the build args and the `patch` package are gone docker-compose.yml no WP_VERSION / WP_URL / WP_SHA256 to keep in step tools/update-wordpress.sh is rewritten around what the subtree makes possible. It imports the pristine release onto sirius-press/wordpress-upstream and then `git subtree merge`s that branch, which three-way merges upstream against the fork's own commit. A patch either applies with fuzz and hopes or fails and leaves you re-deriving the change by hand; a merge conflict is resolved once, in the file, and the next release merges against the resolution. patches/ survives as documentation rather than mechanism, and is now generated: tools/refresh-patches.sh diffs the subtree against the pristine import and rewrites the directory, with --check for CI. It answers the question anyone auditing a fork asks first — what exactly did you change inside WordPress? — in a minute, which `git log wordpress/` cannot, because that log is mostly upstream imports. Generated documentation stays true; a hand-maintained record of a core diff drifts, and a stale one is worse than none because people trust it. One test change worth noting: the syntax sweep no longer walks all of wordpress/. It lints the fork's own PHP plus every core file patches/ says the fork touches, which keeps the suite at seven seconds instead of a minute while still covering the only core file that can break.
2026-09-21 03:19:28 +02:00
[ -n "$VERSION" ] || die "usage: tools/update-wordpress.sh <version>"
feat(sirius-press): a WordPress where the account is a key, not a mailbox WordPress makes two assumptions this project cannot accept: that identity comes from an email address, and that a site lives at one server. Both are things somebody else can take away — a mailbox is rented from a provider who can close it or be compelled to open it, and a server is one seizure from being gone. Sirius Press replaces the first and hedges the second. Signing in means signing a challenge with the key that controls a CashAddress. The address is recovered from the signature, so nothing is typed but the signature itself, and the result is an ordinary WordPress session cookie — roles, capabilities, nonces and the REST API never learn the login was different. Three ways to produce one: a wallet the browser already exposes, a phrase used once in the page and wiped, or a signature pasted in from any BIP-137 wallet, which needs no JavaScript and lets the key stay on a machine that never touches the web. There is no password reset, and the recovery page says so plainly rather than offering a form that cannot work. A reset mechanism is by construction a way to take an account from its owner, and it is always easier to attack than the cryptography it bypasses. Publishing a post also exports it as static HTML to the name's storage on Sia, signed by the key that owns the name, so the site keeps answering when the server does not. Email as a feature is untouched. wp_mail() still works, SMTP still sends, and contact forms still deliver to addresses real people typed. Only mail to the site's own unroutable placeholder addresses is diverted to an in-app inbox. The objection was to email as identity, not to email. Core is pinned and patched rather than vendored. WordPress 7.1.1 is 149 MB and 5,008 files; the fork's entire core diff is 75 lines in wp-admin/install.php. Carrying the former to express the latter would bury the patch where nobody reviews it and make every clone of the monorepo pay for it. Upstream releases still merge through tools/update-wordpress.sh, which reapplies the series and says exactly which hunk needs a human. The cryptography is implemented twice — PHP on the server, JavaScript in the page — because the server must verify and the browser must sign. Both are pinned against libauth, the library the Sirius portal wallet and the BNS gateway already use, so a disagreement of one byte fails the test suite rather than presenting as a rejected login at three in the morning. 132 checks, no framework, about a second.
2026-09-21 01:39:38 +02:00
[[ "$VERSION" =~ ^[0-9]+\.[0-9]+(\.[0-9]+)?$ ]] || die "'$VERSION' does not look like a WordPress version"
# shellcheck source=wordpress.lock
build(sirius-press): build from the vendored subtree instead of a download The subtree is in place, so everything that used to fetch and patch core at build time now just copies it. tools/build.sh copies wordpress/ — no download, no checksum step, because there is nothing to fetch and nothing to trust that is not already in the repository docker/Dockerfile COPY wordpress/ instead of curl + sha256 + patch; the build args and the `patch` package are gone docker-compose.yml no WP_VERSION / WP_URL / WP_SHA256 to keep in step tools/update-wordpress.sh is rewritten around what the subtree makes possible. It imports the pristine release onto sirius-press/wordpress-upstream and then `git subtree merge`s that branch, which three-way merges upstream against the fork's own commit. A patch either applies with fuzz and hopes or fails and leaves you re-deriving the change by hand; a merge conflict is resolved once, in the file, and the next release merges against the resolution. patches/ survives as documentation rather than mechanism, and is now generated: tools/refresh-patches.sh diffs the subtree against the pristine import and rewrites the directory, with --check for CI. It answers the question anyone auditing a fork asks first — what exactly did you change inside WordPress? — in a minute, which `git log wordpress/` cannot, because that log is mostly upstream imports. Generated documentation stays true; a hand-maintained record of a core diff drifts, and a stale one is worse than none because people trust it. One test change worth noting: the syntax sweep no longer walks all of wordpress/. It lints the fork's own PHP plus every core file patches/ says the fork touches, which keeps the suite at seven seconds instead of a minute while still covering the only core file that can break.
2026-09-21 03:19:28 +02:00
source "$here/tools/wordpress.lock"
feat(sirius-press): a WordPress where the account is a key, not a mailbox WordPress makes two assumptions this project cannot accept: that identity comes from an email address, and that a site lives at one server. Both are things somebody else can take away — a mailbox is rented from a provider who can close it or be compelled to open it, and a server is one seizure from being gone. Sirius Press replaces the first and hedges the second. Signing in means signing a challenge with the key that controls a CashAddress. The address is recovered from the signature, so nothing is typed but the signature itself, and the result is an ordinary WordPress session cookie — roles, capabilities, nonces and the REST API never learn the login was different. Three ways to produce one: a wallet the browser already exposes, a phrase used once in the page and wiped, or a signature pasted in from any BIP-137 wallet, which needs no JavaScript and lets the key stay on a machine that never touches the web. There is no password reset, and the recovery page says so plainly rather than offering a form that cannot work. A reset mechanism is by construction a way to take an account from its owner, and it is always easier to attack than the cryptography it bypasses. Publishing a post also exports it as static HTML to the name's storage on Sia, signed by the key that owns the name, so the site keeps answering when the server does not. Email as a feature is untouched. wp_mail() still works, SMTP still sends, and contact forms still deliver to addresses real people typed. Only mail to the site's own unroutable placeholder addresses is diverted to an in-app inbox. The objection was to email as identity, not to email. Core is pinned and patched rather than vendored. WordPress 7.1.1 is 149 MB and 5,008 files; the fork's entire core diff is 75 lines in wp-admin/install.php. Carrying the former to express the latter would bury the patch where nobody reviews it and make every clone of the monorepo pay for it. Upstream releases still merge through tools/update-wordpress.sh, which reapplies the series and says exactly which hunk needs a human. The cryptography is implemented twice — PHP on the server, JavaScript in the page — because the server must verify and the browser must sign. Both are pinned against libauth, the library the Sirius portal wallet and the BNS gateway already use, so a disagreement of one byte fails the test suite rather than presenting as a rejected login at three in the morning. 132 checks, no framework, about a second.
2026-09-21 01:39:38 +02:00
CURRENT="$WP_VERSION"
build(sirius-press): build from the vendored subtree instead of a download The subtree is in place, so everything that used to fetch and patch core at build time now just copies it. tools/build.sh copies wordpress/ — no download, no checksum step, because there is nothing to fetch and nothing to trust that is not already in the repository docker/Dockerfile COPY wordpress/ instead of curl + sha256 + patch; the build args and the `patch` package are gone docker-compose.yml no WP_VERSION / WP_URL / WP_SHA256 to keep in step tools/update-wordpress.sh is rewritten around what the subtree makes possible. It imports the pristine release onto sirius-press/wordpress-upstream and then `git subtree merge`s that branch, which three-way merges upstream against the fork's own commit. A patch either applies with fuzz and hopes or fails and leaves you re-deriving the change by hand; a merge conflict is resolved once, in the file, and the next release merges against the resolution. patches/ survives as documentation rather than mechanism, and is now generated: tools/refresh-patches.sh diffs the subtree against the pristine import and rewrites the directory, with --check for CI. It answers the question anyone auditing a fork asks first — what exactly did you change inside WordPress? — in a minute, which `git log wordpress/` cannot, because that log is mostly upstream imports. Generated documentation stays true; a hand-maintained record of a core diff drifts, and a stale one is worse than none because people trust it. One test change worth noting: the syntax sweep no longer walks all of wordpress/. It lints the fork's own PHP plus every core file patches/ says the fork touches, which keeps the suite at seven seconds instead of a minute while still covering the only core file that can break.
2026-09-21 03:19:28 +02:00
[ "$VERSION" != "$CURRENT" ] || die "the fork is already on WordPress $VERSION"
UPSTREAM_BRANCH="sirius-press/wordpress-upstream"
git -C "$repo" rev-parse --verify --quiet "$UPSTREAM_BRANCH" >/dev/null \
|| die "the branch $UPSTREAM_BRANCH is missing. It holds the pristine upstream
imports that the subtree merges against; without it this fork cannot take an
upstream release. See docs/upstream-merges.md."
feat(sirius-press): take WordPress 7.1.2, and fix what that exposed The first real upstream release since the subtree landed, and the point of the whole arrangement. It merged cleanly: 7.1.2 changes about.php, template.php and version.php, none of which this fork touches, so the patched installer came through byte-identical and there was nothing to resolve. Getting there needed two fixes to the tool, both of which only a real release could have found — the earlier same-version run was a no-op that exercised none of this. **The prefix was an absolute path.** `${here#"$repo"/}` assumes the two strings share a spelling, and on Windows they do not: --show-toplevel answers "D:/Dev/…" while $PWD is "/d/Dev/…", so the subtraction left the path untouched and `git subtree merge --prefix` was handed something absolute. The same bug was fixed in refresh-patches.sh a few commits ago; this is the other copy of it. Both now ask git via `rev-parse --show-prefix`. **git-subtree refuses to run in a dirty repository** — any modification anywhere, not just under the subtree. In a monorepo shared with other work that is the normal state, so the tool was unusable exactly where it lives. The merge now happens in a scratch worktree, which is clean by construction, and comes back as one ordinary merge commit that touches only wordpress/ and so does not care what else is modified. Also: a failed run no longer refuses to retry. The import onto the upstream branch is idempotent now, and the failure message distinguishes "upstream and the fork changed the same lines" from "the merge could not start", instead of blaming a conflict for both.
2026-09-22 20:18:45 +02:00
# The merge lands on top of whatever is committed, so anything staged or
# modified under the subtree itself would be lost or fought over.
build(sirius-press): build from the vendored subtree instead of a download The subtree is in place, so everything that used to fetch and patch core at build time now just copies it. tools/build.sh copies wordpress/ — no download, no checksum step, because there is nothing to fetch and nothing to trust that is not already in the repository docker/Dockerfile COPY wordpress/ instead of curl + sha256 + patch; the build args and the `patch` package are gone docker-compose.yml no WP_VERSION / WP_URL / WP_SHA256 to keep in step tools/update-wordpress.sh is rewritten around what the subtree makes possible. It imports the pristine release onto sirius-press/wordpress-upstream and then `git subtree merge`s that branch, which three-way merges upstream against the fork's own commit. A patch either applies with fuzz and hopes or fails and leaves you re-deriving the change by hand; a merge conflict is resolved once, in the file, and the next release merges against the resolution. patches/ survives as documentation rather than mechanism, and is now generated: tools/refresh-patches.sh diffs the subtree against the pristine import and rewrites the directory, with --check for CI. It answers the question anyone auditing a fork asks first — what exactly did you change inside WordPress? — in a minute, which `git log wordpress/` cannot, because that log is mostly upstream imports. Generated documentation stays true; a hand-maintained record of a core diff drifts, and a stale one is worse than none because people trust it. One test change worth noting: the syntax sweep no longer walks all of wordpress/. It lints the fork's own PHP plus every core file patches/ says the fork touches, which keeps the suite at seven seconds instead of a minute while still covering the only core file that can break.
2026-09-21 03:19:28 +02:00
if ! git -C "$repo" diff --quiet -- "$prefix" 2>/dev/null; then
feat(sirius-press): take WordPress 7.1.2, and fix what that exposed The first real upstream release since the subtree landed, and the point of the whole arrangement. It merged cleanly: 7.1.2 changes about.php, template.php and version.php, none of which this fork touches, so the patched installer came through byte-identical and there was nothing to resolve. Getting there needed two fixes to the tool, both of which only a real release could have found — the earlier same-version run was a no-op that exercised none of this. **The prefix was an absolute path.** `${here#"$repo"/}` assumes the two strings share a spelling, and on Windows they do not: --show-toplevel answers "D:/Dev/…" while $PWD is "/d/Dev/…", so the subtraction left the path untouched and `git subtree merge --prefix` was handed something absolute. The same bug was fixed in refresh-patches.sh a few commits ago; this is the other copy of it. Both now ask git via `rev-parse --show-prefix`. **git-subtree refuses to run in a dirty repository** — any modification anywhere, not just under the subtree. In a monorepo shared with other work that is the normal state, so the tool was unusable exactly where it lives. The merge now happens in a scratch worktree, which is clean by construction, and comes back as one ordinary merge commit that touches only wordpress/ and so does not care what else is modified. Also: a failed run no longer refuses to retry. The import onto the upstream branch is idempotent now, and the failure message distinguishes "upstream and the fork changed the same lines" from "the merge could not start", instead of blaming a conflict for both.
2026-09-22 20:18:45 +02:00
die "${prefix}/ has uncommitted changes. Commit or stash them first."
build(sirius-press): build from the vendored subtree instead of a download The subtree is in place, so everything that used to fetch and patch core at build time now just copies it. tools/build.sh copies wordpress/ — no download, no checksum step, because there is nothing to fetch and nothing to trust that is not already in the repository docker/Dockerfile COPY wordpress/ instead of curl + sha256 + patch; the build args and the `patch` package are gone docker-compose.yml no WP_VERSION / WP_URL / WP_SHA256 to keep in step tools/update-wordpress.sh is rewritten around what the subtree makes possible. It imports the pristine release onto sirius-press/wordpress-upstream and then `git subtree merge`s that branch, which three-way merges upstream against the fork's own commit. A patch either applies with fuzz and hopes or fails and leaves you re-deriving the change by hand; a merge conflict is resolved once, in the file, and the next release merges against the resolution. patches/ survives as documentation rather than mechanism, and is now generated: tools/refresh-patches.sh diffs the subtree against the pristine import and rewrites the directory, with --check for CI. It answers the question anyone auditing a fork asks first — what exactly did you change inside WordPress? — in a minute, which `git log wordpress/` cannot, because that log is mostly upstream imports. Generated documentation stays true; a hand-maintained record of a core diff drifts, and a stale one is worse than none because people trust it. One test change worth noting: the syntax sweep no longer walks all of wordpress/. It lints the fork's own PHP plus every core file patches/ says the fork touches, which keeps the suite at seven seconds instead of a minute while still covering the only core file that can break.
2026-09-21 03:19:28 +02:00
fi
feat(sirius-press): a WordPress where the account is a key, not a mailbox WordPress makes two assumptions this project cannot accept: that identity comes from an email address, and that a site lives at one server. Both are things somebody else can take away — a mailbox is rented from a provider who can close it or be compelled to open it, and a server is one seizure from being gone. Sirius Press replaces the first and hedges the second. Signing in means signing a challenge with the key that controls a CashAddress. The address is recovered from the signature, so nothing is typed but the signature itself, and the result is an ordinary WordPress session cookie — roles, capabilities, nonces and the REST API never learn the login was different. Three ways to produce one: a wallet the browser already exposes, a phrase used once in the page and wiped, or a signature pasted in from any BIP-137 wallet, which needs no JavaScript and lets the key stay on a machine that never touches the web. There is no password reset, and the recovery page says so plainly rather than offering a form that cannot work. A reset mechanism is by construction a way to take an account from its owner, and it is always easier to attack than the cryptography it bypasses. Publishing a post also exports it as static HTML to the name's storage on Sia, signed by the key that owns the name, so the site keeps answering when the server does not. Email as a feature is untouched. wp_mail() still works, SMTP still sends, and contact forms still deliver to addresses real people typed. Only mail to the site's own unroutable placeholder addresses is diverted to an in-app inbox. The objection was to email as identity, not to email. Core is pinned and patched rather than vendored. WordPress 7.1.1 is 149 MB and 5,008 files; the fork's entire core diff is 75 lines in wp-admin/install.php. Carrying the former to express the latter would bury the patch where nobody reviews it and make every clone of the monorepo pay for it. Upstream releases still merge through tools/update-wordpress.sh, which reapplies the series and says exactly which hunk needs a human. The cryptography is implemented twice — PHP on the server, JavaScript in the page — because the server must verify and the browser must sign. Both are pinned against libauth, the library the Sirius portal wallet and the BNS gateway already use, so a disagreement of one byte fails the test suite rather than presenting as a rejected login at three in the morning. 132 checks, no framework, about a second.
2026-09-21 01:39:38 +02:00
CACHE="$here/dist/.cache"
build(sirius-press): build from the vendored subtree instead of a download The subtree is in place, so everything that used to fetch and patch core at build time now just copies it. tools/build.sh copies wordpress/ — no download, no checksum step, because there is nothing to fetch and nothing to trust that is not already in the repository docker/Dockerfile COPY wordpress/ instead of curl + sha256 + patch; the build args and the `patch` package are gone docker-compose.yml no WP_VERSION / WP_URL / WP_SHA256 to keep in step tools/update-wordpress.sh is rewritten around what the subtree makes possible. It imports the pristine release onto sirius-press/wordpress-upstream and then `git subtree merge`s that branch, which three-way merges upstream against the fork's own commit. A patch either applies with fuzz and hopes or fails and leaves you re-deriving the change by hand; a merge conflict is resolved once, in the file, and the next release merges against the resolution. patches/ survives as documentation rather than mechanism, and is now generated: tools/refresh-patches.sh diffs the subtree against the pristine import and rewrites the directory, with --check for CI. It answers the question anyone auditing a fork asks first — what exactly did you change inside WordPress? — in a minute, which `git log wordpress/` cannot, because that log is mostly upstream imports. Generated documentation stays true; a hand-maintained record of a core diff drifts, and a stale one is worse than none because people trust it. One test change worth noting: the syntax sweep no longer walks all of wordpress/. It lints the fork's own PHP plus every core file patches/ says the fork touches, which keeps the suite at seven seconds instead of a minute while still covering the only core file that can break.
2026-09-21 03:19:28 +02:00
mkdir -p "$CACHE"
feat(sirius-press): a WordPress where the account is a key, not a mailbox WordPress makes two assumptions this project cannot accept: that identity comes from an email address, and that a site lives at one server. Both are things somebody else can take away — a mailbox is rented from a provider who can close it or be compelled to open it, and a server is one seizure from being gone. Sirius Press replaces the first and hedges the second. Signing in means signing a challenge with the key that controls a CashAddress. The address is recovered from the signature, so nothing is typed but the signature itself, and the result is an ordinary WordPress session cookie — roles, capabilities, nonces and the REST API never learn the login was different. Three ways to produce one: a wallet the browser already exposes, a phrase used once in the page and wiped, or a signature pasted in from any BIP-137 wallet, which needs no JavaScript and lets the key stay on a machine that never touches the web. There is no password reset, and the recovery page says so plainly rather than offering a form that cannot work. A reset mechanism is by construction a way to take an account from its owner, and it is always easier to attack than the cryptography it bypasses. Publishing a post also exports it as static HTML to the name's storage on Sia, signed by the key that owns the name, so the site keeps answering when the server does not. Email as a feature is untouched. wp_mail() still works, SMTP still sends, and contact forms still deliver to addresses real people typed. Only mail to the site's own unroutable placeholder addresses is diverted to an in-app inbox. The objection was to email as identity, not to email. Core is pinned and patched rather than vendored. WordPress 7.1.1 is 149 MB and 5,008 files; the fork's entire core diff is 75 lines in wp-admin/install.php. Carrying the former to express the latter would bury the patch where nobody reviews it and make every clone of the monorepo pay for it. Upstream releases still merge through tools/update-wordpress.sh, which reapplies the series and says exactly which hunk needs a human. The cryptography is implemented twice — PHP on the server, JavaScript in the page — because the server must verify and the browser must sign. Both are pinned against libauth, the library the Sirius portal wallet and the BNS gateway already use, so a disagreement of one byte fails the test suite rather than presenting as a rejected login at three in the morning. 132 checks, no framework, about a second.
2026-09-21 01:39:38 +02:00
URL="https://wordpress.org/wordpress-${VERSION}.tar.gz"
TARBALL="$CACHE/wordpress-${VERSION}.tar.gz"
# ------------------------------------------------------------------- fetch
if [ ! -f "$TARBALL" ]; then
say "downloading WordPress $VERSION"
curl -fsSL -o "$TARBALL.part" "$URL" || die "could not download $URL — does that version exist?"
mv "$TARBALL.part" "$TARBALL"
fi
build(sirius-press): build from the vendored subtree instead of a download The subtree is in place, so everything that used to fetch and patch core at build time now just copies it. tools/build.sh copies wordpress/ — no download, no checksum step, because there is nothing to fetch and nothing to trust that is not already in the repository docker/Dockerfile COPY wordpress/ instead of curl + sha256 + patch; the build args and the `patch` package are gone docker-compose.yml no WP_VERSION / WP_URL / WP_SHA256 to keep in step tools/update-wordpress.sh is rewritten around what the subtree makes possible. It imports the pristine release onto sirius-press/wordpress-upstream and then `git subtree merge`s that branch, which three-way merges upstream against the fork's own commit. A patch either applies with fuzz and hopes or fails and leaves you re-deriving the change by hand; a merge conflict is resolved once, in the file, and the next release merges against the resolution. patches/ survives as documentation rather than mechanism, and is now generated: tools/refresh-patches.sh diffs the subtree against the pristine import and rewrites the directory, with --check for CI. It answers the question anyone auditing a fork asks first — what exactly did you change inside WordPress? — in a minute, which `git log wordpress/` cannot, because that log is mostly upstream imports. Generated documentation stays true; a hand-maintained record of a core diff drifts, and a stale one is worse than none because people trust it. One test change worth noting: the syntax sweep no longer walks all of wordpress/. It lints the fork's own PHP plus every core file patches/ says the fork touches, which keeps the suite at seven seconds instead of a minute while still covering the only core file that can break.
2026-09-21 03:19:28 +02:00
say "checking it against the SHA-1 wordpress.org publishes"
feat(sirius-press): a WordPress where the account is a key, not a mailbox WordPress makes two assumptions this project cannot accept: that identity comes from an email address, and that a site lives at one server. Both are things somebody else can take away — a mailbox is rented from a provider who can close it or be compelled to open it, and a server is one seizure from being gone. Sirius Press replaces the first and hedges the second. Signing in means signing a challenge with the key that controls a CashAddress. The address is recovered from the signature, so nothing is typed but the signature itself, and the result is an ordinary WordPress session cookie — roles, capabilities, nonces and the REST API never learn the login was different. Three ways to produce one: a wallet the browser already exposes, a phrase used once in the page and wiped, or a signature pasted in from any BIP-137 wallet, which needs no JavaScript and lets the key stay on a machine that never touches the web. There is no password reset, and the recovery page says so plainly rather than offering a form that cannot work. A reset mechanism is by construction a way to take an account from its owner, and it is always easier to attack than the cryptography it bypasses. Publishing a post also exports it as static HTML to the name's storage on Sia, signed by the key that owns the name, so the site keeps answering when the server does not. Email as a feature is untouched. wp_mail() still works, SMTP still sends, and contact forms still deliver to addresses real people typed. Only mail to the site's own unroutable placeholder addresses is diverted to an in-app inbox. The objection was to email as identity, not to email. Core is pinned and patched rather than vendored. WordPress 7.1.1 is 149 MB and 5,008 files; the fork's entire core diff is 75 lines in wp-admin/install.php. Carrying the former to express the latter would bury the patch where nobody reviews it and make every clone of the monorepo pay for it. Upstream releases still merge through tools/update-wordpress.sh, which reapplies the series and says exactly which hunk needs a human. The cryptography is implemented twice — PHP on the server, JavaScript in the page — because the server must verify and the browser must sign. Both are pinned against libauth, the library the Sirius portal wallet and the BNS gateway already use, so a disagreement of one byte fails the test suite rather than presenting as a rejected login at three in the morning. 132 checks, no framework, about a second.
2026-09-21 01:39:38 +02:00
published="$(curl -fsSL "${URL}.sha1" 2>/dev/null || true)"
actual_sha1="$(sha1sum "$TARBALL" | cut -d' ' -f1)"
if [ -z "$published" ]; then
build(sirius-press): build from the vendored subtree instead of a download The subtree is in place, so everything that used to fetch and patch core at build time now just copies it. tools/build.sh copies wordpress/ — no download, no checksum step, because there is nothing to fetch and nothing to trust that is not already in the repository docker/Dockerfile COPY wordpress/ instead of curl + sha256 + patch; the build args and the `patch` package are gone docker-compose.yml no WP_VERSION / WP_URL / WP_SHA256 to keep in step tools/update-wordpress.sh is rewritten around what the subtree makes possible. It imports the pristine release onto sirius-press/wordpress-upstream and then `git subtree merge`s that branch, which three-way merges upstream against the fork's own commit. A patch either applies with fuzz and hopes or fails and leaves you re-deriving the change by hand; a merge conflict is resolved once, in the file, and the next release merges against the resolution. patches/ survives as documentation rather than mechanism, and is now generated: tools/refresh-patches.sh diffs the subtree against the pristine import and rewrites the directory, with --check for CI. It answers the question anyone auditing a fork asks first — what exactly did you change inside WordPress? — in a minute, which `git log wordpress/` cannot, because that log is mostly upstream imports. Generated documentation stays true; a hand-maintained record of a core diff drifts, and a stale one is worse than none because people trust it. One test change worth noting: the syntax sweep no longer walks all of wordpress/. It lints the fork's own PHP plus every core file patches/ says the fork touches, which keeps the suite at seven seconds instead of a minute while still covering the only core file that can break.
2026-09-21 03:19:28 +02:00
warn "wordpress.org served no .sha1 for this release; recording the sha256 below unverified"
feat(sirius-press): a WordPress where the account is a key, not a mailbox WordPress makes two assumptions this project cannot accept: that identity comes from an email address, and that a site lives at one server. Both are things somebody else can take away — a mailbox is rented from a provider who can close it or be compelled to open it, and a server is one seizure from being gone. Sirius Press replaces the first and hedges the second. Signing in means signing a challenge with the key that controls a CashAddress. The address is recovered from the signature, so nothing is typed but the signature itself, and the result is an ordinary WordPress session cookie — roles, capabilities, nonces and the REST API never learn the login was different. Three ways to produce one: a wallet the browser already exposes, a phrase used once in the page and wiped, or a signature pasted in from any BIP-137 wallet, which needs no JavaScript and lets the key stay on a machine that never touches the web. There is no password reset, and the recovery page says so plainly rather than offering a form that cannot work. A reset mechanism is by construction a way to take an account from its owner, and it is always easier to attack than the cryptography it bypasses. Publishing a post also exports it as static HTML to the name's storage on Sia, signed by the key that owns the name, so the site keeps answering when the server does not. Email as a feature is untouched. wp_mail() still works, SMTP still sends, and contact forms still deliver to addresses real people typed. Only mail to the site's own unroutable placeholder addresses is diverted to an in-app inbox. The objection was to email as identity, not to email. Core is pinned and patched rather than vendored. WordPress 7.1.1 is 149 MB and 5,008 files; the fork's entire core diff is 75 lines in wp-admin/install.php. Carrying the former to express the latter would bury the patch where nobody reviews it and make every clone of the monorepo pay for it. Upstream releases still merge through tools/update-wordpress.sh, which reapplies the series and says exactly which hunk needs a human. The cryptography is implemented twice — PHP on the server, JavaScript in the page — because the server must verify and the browser must sign. Both are pinned against libauth, the library the Sirius portal wallet and the BNS gateway already use, so a disagreement of one byte fails the test suite rather than presenting as a rejected login at three in the morning. 132 checks, no framework, about a second.
2026-09-21 01:39:38 +02:00
elif [ "$published" != "$actual_sha1" ]; then
rm -f "$TARBALL"
build(sirius-press): build from the vendored subtree instead of a download The subtree is in place, so everything that used to fetch and patch core at build time now just copies it. tools/build.sh copies wordpress/ — no download, no checksum step, because there is nothing to fetch and nothing to trust that is not already in the repository docker/Dockerfile COPY wordpress/ instead of curl + sha256 + patch; the build args and the `patch` package are gone docker-compose.yml no WP_VERSION / WP_URL / WP_SHA256 to keep in step tools/update-wordpress.sh is rewritten around what the subtree makes possible. It imports the pristine release onto sirius-press/wordpress-upstream and then `git subtree merge`s that branch, which three-way merges upstream against the fork's own commit. A patch either applies with fuzz and hopes or fails and leaves you re-deriving the change by hand; a merge conflict is resolved once, in the file, and the next release merges against the resolution. patches/ survives as documentation rather than mechanism, and is now generated: tools/refresh-patches.sh diffs the subtree against the pristine import and rewrites the directory, with --check for CI. It answers the question anyone auditing a fork asks first — what exactly did you change inside WordPress? — in a minute, which `git log wordpress/` cannot, because that log is mostly upstream imports. Generated documentation stays true; a hand-maintained record of a core diff drifts, and a stale one is worse than none because people trust it. One test change worth noting: the syntax sweep no longer walks all of wordpress/. It lints the fork's own PHP plus every core file patches/ says the fork touches, which keeps the suite at seven seconds instead of a minute while still covering the only core file that can break.
2026-09-21 03:19:28 +02:00
die "SHA-1 mismatch — the download is not what wordpress.org publishes.
feat(sirius-press): a WordPress where the account is a key, not a mailbox WordPress makes two assumptions this project cannot accept: that identity comes from an email address, and that a site lives at one server. Both are things somebody else can take away — a mailbox is rented from a provider who can close it or be compelled to open it, and a server is one seizure from being gone. Sirius Press replaces the first and hedges the second. Signing in means signing a challenge with the key that controls a CashAddress. The address is recovered from the signature, so nothing is typed but the signature itself, and the result is an ordinary WordPress session cookie — roles, capabilities, nonces and the REST API never learn the login was different. Three ways to produce one: a wallet the browser already exposes, a phrase used once in the page and wiped, or a signature pasted in from any BIP-137 wallet, which needs no JavaScript and lets the key stay on a machine that never touches the web. There is no password reset, and the recovery page says so plainly rather than offering a form that cannot work. A reset mechanism is by construction a way to take an account from its owner, and it is always easier to attack than the cryptography it bypasses. Publishing a post also exports it as static HTML to the name's storage on Sia, signed by the key that owns the name, so the site keeps answering when the server does not. Email as a feature is untouched. wp_mail() still works, SMTP still sends, and contact forms still deliver to addresses real people typed. Only mail to the site's own unroutable placeholder addresses is diverted to an in-app inbox. The objection was to email as identity, not to email. Core is pinned and patched rather than vendored. WordPress 7.1.1 is 149 MB and 5,008 files; the fork's entire core diff is 75 lines in wp-admin/install.php. Carrying the former to express the latter would bury the patch where nobody reviews it and make every clone of the monorepo pay for it. Upstream releases still merge through tools/update-wordpress.sh, which reapplies the series and says exactly which hunk needs a human. The cryptography is implemented twice — PHP on the server, JavaScript in the page — because the server must verify and the browser must sign. Both are pinned against libauth, the library the Sirius portal wallet and the BNS gateway already use, so a disagreement of one byte fails the test suite rather than presenting as a rejected login at three in the morning. 132 checks, no framework, about a second.
2026-09-21 01:39:38 +02:00
published $published
got $actual_sha1"
fi
NEW_SHA256="$(sha256sum "$TARBALL" | cut -d' ' -f1)"
build(sirius-press): build from the vendored subtree instead of a download The subtree is in place, so everything that used to fetch and patch core at build time now just copies it. tools/build.sh copies wordpress/ — no download, no checksum step, because there is nothing to fetch and nothing to trust that is not already in the repository docker/Dockerfile COPY wordpress/ instead of curl + sha256 + patch; the build args and the `patch` package are gone docker-compose.yml no WP_VERSION / WP_URL / WP_SHA256 to keep in step tools/update-wordpress.sh is rewritten around what the subtree makes possible. It imports the pristine release onto sirius-press/wordpress-upstream and then `git subtree merge`s that branch, which three-way merges upstream against the fork's own commit. A patch either applies with fuzz and hopes or fails and leaves you re-deriving the change by hand; a merge conflict is resolved once, in the file, and the next release merges against the resolution. patches/ survives as documentation rather than mechanism, and is now generated: tools/refresh-patches.sh diffs the subtree against the pristine import and rewrites the directory, with --check for CI. It answers the question anyone auditing a fork asks first — what exactly did you change inside WordPress? — in a minute, which `git log wordpress/` cannot, because that log is mostly upstream imports. Generated documentation stays true; a hand-maintained record of a core diff drifts, and a stale one is worse than none because people trust it. One test change worth noting: the syntax sweep no longer walks all of wordpress/. It lints the fork's own PHP plus every core file patches/ says the fork touches, which keeps the suite at seven seconds instead of a minute while still covering the only core file that can break.
2026-09-21 03:19:28 +02:00
# ------------------------------------------- import onto the upstream branch
feat(sirius-press): take WordPress 7.1.2, and fix what that exposed The first real upstream release since the subtree landed, and the point of the whole arrangement. It merged cleanly: 7.1.2 changes about.php, template.php and version.php, none of which this fork touches, so the patched installer came through byte-identical and there was nothing to resolve. Getting there needed two fixes to the tool, both of which only a real release could have found — the earlier same-version run was a no-op that exercised none of this. **The prefix was an absolute path.** `${here#"$repo"/}` assumes the two strings share a spelling, and on Windows they do not: --show-toplevel answers "D:/Dev/…" while $PWD is "/d/Dev/…", so the subtraction left the path untouched and `git subtree merge --prefix` was handed something absolute. The same bug was fixed in refresh-patches.sh a few commits ago; this is the other copy of it. Both now ask git via `rev-parse --show-prefix`. **git-subtree refuses to run in a dirty repository** — any modification anywhere, not just under the subtree. In a monorepo shared with other work that is the normal state, so the tool was unusable exactly where it lives. The merge now happens in a scratch worktree, which is clean by construction, and comes back as one ordinary merge commit that touches only wordpress/ and so does not care what else is modified. Also: a failed run no longer refuses to retry. The import onto the upstream branch is idempotent now, and the failure message distinguishes "upstream and the fork changed the same lines" from "the merge could not start", instead of blaming a conflict for both.
2026-09-22 20:18:45 +02:00
IMPORT_TREE="$here/dist/.vendor-import"
MERGE_TREE="$here/dist/.vendor-merge"
MERGE_BRANCH="sirius-press/_merge-${VERSION}"
build(sirius-press): build from the vendored subtree instead of a download The subtree is in place, so everything that used to fetch and patch core at build time now just copies it. tools/build.sh copies wordpress/ — no download, no checksum step, because there is nothing to fetch and nothing to trust that is not already in the repository docker/Dockerfile COPY wordpress/ instead of curl + sha256 + patch; the build args and the `patch` package are gone docker-compose.yml no WP_VERSION / WP_URL / WP_SHA256 to keep in step tools/update-wordpress.sh is rewritten around what the subtree makes possible. It imports the pristine release onto sirius-press/wordpress-upstream and then `git subtree merge`s that branch, which three-way merges upstream against the fork's own commit. A patch either applies with fuzz and hopes or fails and leaves you re-deriving the change by hand; a merge conflict is resolved once, in the file, and the next release merges against the resolution. patches/ survives as documentation rather than mechanism, and is now generated: tools/refresh-patches.sh diffs the subtree against the pristine import and rewrites the directory, with --check for CI. It answers the question anyone auditing a fork asks first — what exactly did you change inside WordPress? — in a minute, which `git log wordpress/` cannot, because that log is mostly upstream imports. Generated documentation stays true; a hand-maintained record of a core diff drifts, and a stale one is worse than none because people trust it. One test change worth noting: the syntax sweep no longer walks all of wordpress/. It lints the fork's own PHP plus every core file patches/ says the fork touches, which keeps the suite at seven seconds instead of a minute while still covering the only core file that can break.
2026-09-21 03:19:28 +02:00
feat(sirius-press): take WordPress 7.1.2, and fix what that exposed The first real upstream release since the subtree landed, and the point of the whole arrangement. It merged cleanly: 7.1.2 changes about.php, template.php and version.php, none of which this fork touches, so the patched installer came through byte-identical and there was nothing to resolve. Getting there needed two fixes to the tool, both of which only a real release could have found — the earlier same-version run was a no-op that exercised none of this. **The prefix was an absolute path.** `${here#"$repo"/}` assumes the two strings share a spelling, and on Windows they do not: --show-toplevel answers "D:/Dev/…" while $PWD is "/d/Dev/…", so the subtraction left the path untouched and `git subtree merge --prefix` was handed something absolute. The same bug was fixed in refresh-patches.sh a few commits ago; this is the other copy of it. Both now ask git via `rev-parse --show-prefix`. **git-subtree refuses to run in a dirty repository** — any modification anywhere, not just under the subtree. In a monorepo shared with other work that is the normal state, so the tool was unusable exactly where it lives. The merge now happens in a scratch worktree, which is clean by construction, and comes back as one ordinary merge commit that touches only wordpress/ and so does not care what else is modified. Also: a failed run no longer refuses to retry. The import onto the upstream branch is idempotent now, and the failure message distinguishes "upstream and the fork changed the same lines" from "the merge could not start", instead of blaming a conflict for both.
2026-09-22 20:18:45 +02:00
drop_worktree() {
git -C "$repo" worktree remove --force "$1" >/dev/null 2>&1 || true
build(sirius-press): build from the vendored subtree instead of a download The subtree is in place, so everything that used to fetch and patch core at build time now just copies it. tools/build.sh copies wordpress/ — no download, no checksum step, because there is nothing to fetch and nothing to trust that is not already in the repository docker/Dockerfile COPY wordpress/ instead of curl + sha256 + patch; the build args and the `patch` package are gone docker-compose.yml no WP_VERSION / WP_URL / WP_SHA256 to keep in step tools/update-wordpress.sh is rewritten around what the subtree makes possible. It imports the pristine release onto sirius-press/wordpress-upstream and then `git subtree merge`s that branch, which three-way merges upstream against the fork's own commit. A patch either applies with fuzz and hopes or fails and leaves you re-deriving the change by hand; a merge conflict is resolved once, in the file, and the next release merges against the resolution. patches/ survives as documentation rather than mechanism, and is now generated: tools/refresh-patches.sh diffs the subtree against the pristine import and rewrites the directory, with --check for CI. It answers the question anyone auditing a fork asks first — what exactly did you change inside WordPress? — in a minute, which `git log wordpress/` cannot, because that log is mostly upstream imports. Generated documentation stays true; a hand-maintained record of a core diff drifts, and a stale one is worse than none because people trust it. One test change worth noting: the syntax sweep no longer walks all of wordpress/. It lints the fork's own PHP plus every core file patches/ says the fork touches, which keeps the suite at seven seconds instead of a minute while still covering the only core file that can break.
2026-09-21 03:19:28 +02:00
}
feat(sirius-press): take WordPress 7.1.2, and fix what that exposed The first real upstream release since the subtree landed, and the point of the whole arrangement. It merged cleanly: 7.1.2 changes about.php, template.php and version.php, none of which this fork touches, so the patched installer came through byte-identical and there was nothing to resolve. Getting there needed two fixes to the tool, both of which only a real release could have found — the earlier same-version run was a no-op that exercised none of this. **The prefix was an absolute path.** `${here#"$repo"/}` assumes the two strings share a spelling, and on Windows they do not: --show-toplevel answers "D:/Dev/…" while $PWD is "/d/Dev/…", so the subtraction left the path untouched and `git subtree merge --prefix` was handed something absolute. The same bug was fixed in refresh-patches.sh a few commits ago; this is the other copy of it. Both now ask git via `rev-parse --show-prefix`. **git-subtree refuses to run in a dirty repository** — any modification anywhere, not just under the subtree. In a monorepo shared with other work that is the normal state, so the tool was unusable exactly where it lives. The merge now happens in a scratch worktree, which is clean by construction, and comes back as one ordinary merge commit that touches only wordpress/ and so does not care what else is modified. Also: a failed run no longer refuses to retry. The import onto the upstream branch is idempotent now, and the failure message distinguishes "upstream and the fork changed the same lines" from "the merge could not start", instead of blaming a conflict for both.
2026-09-22 20:18:45 +02:00
say "importing the pristine tree onto $UPSTREAM_BRANCH"
drop_worktree "$IMPORT_TREE"
rm -rf "$IMPORT_TREE"
git -C "$repo" worktree add --quiet "$IMPORT_TREE" "$UPSTREAM_BRANCH"
trap 'drop_worktree "$IMPORT_TREE"' EXIT
build(sirius-press): build from the vendored subtree instead of a download The subtree is in place, so everything that used to fetch and patch core at build time now just copies it. tools/build.sh copies wordpress/ — no download, no checksum step, because there is nothing to fetch and nothing to trust that is not already in the repository docker/Dockerfile COPY wordpress/ instead of curl + sha256 + patch; the build args and the `patch` package are gone docker-compose.yml no WP_VERSION / WP_URL / WP_SHA256 to keep in step tools/update-wordpress.sh is rewritten around what the subtree makes possible. It imports the pristine release onto sirius-press/wordpress-upstream and then `git subtree merge`s that branch, which three-way merges upstream against the fork's own commit. A patch either applies with fuzz and hopes or fails and leaves you re-deriving the change by hand; a merge conflict is resolved once, in the file, and the next release merges against the resolution. patches/ survives as documentation rather than mechanism, and is now generated: tools/refresh-patches.sh diffs the subtree against the pristine import and rewrites the directory, with --check for CI. It answers the question anyone auditing a fork asks first — what exactly did you change inside WordPress? — in a minute, which `git log wordpress/` cannot, because that log is mostly upstream imports. Generated documentation stays true; a hand-maintained record of a core diff drifts, and a stale one is worse than none because people trust it. One test change worth noting: the syntax sweep no longer walks all of wordpress/. It lints the fork's own PHP plus every core file patches/ says the fork touches, which keeps the suite at seven seconds instead of a minute while still covering the only core file that can break.
2026-09-21 03:19:28 +02:00
# Replace the tree wholesale: files upstream deleted have to disappear, or the
# subtree merge would keep resurrecting them.
feat(sirius-press): take WordPress 7.1.2, and fix what that exposed The first real upstream release since the subtree landed, and the point of the whole arrangement. It merged cleanly: 7.1.2 changes about.php, template.php and version.php, none of which this fork touches, so the patched installer came through byte-identical and there was nothing to resolve. Getting there needed two fixes to the tool, both of which only a real release could have found — the earlier same-version run was a no-op that exercised none of this. **The prefix was an absolute path.** `${here#"$repo"/}` assumes the two strings share a spelling, and on Windows they do not: --show-toplevel answers "D:/Dev/…" while $PWD is "/d/Dev/…", so the subtraction left the path untouched and `git subtree merge --prefix` was handed something absolute. The same bug was fixed in refresh-patches.sh a few commits ago; this is the other copy of it. Both now ask git via `rev-parse --show-prefix`. **git-subtree refuses to run in a dirty repository** — any modification anywhere, not just under the subtree. In a monorepo shared with other work that is the normal state, so the tool was unusable exactly where it lives. The merge now happens in a scratch worktree, which is clean by construction, and comes back as one ordinary merge commit that touches only wordpress/ and so does not care what else is modified. Also: a failed run no longer refuses to retry. The import onto the upstream branch is idempotent now, and the failure message distinguishes "upstream and the fork changed the same lines" from "the merge could not start", instead of blaming a conflict for both.
2026-09-22 20:18:45 +02:00
find "$IMPORT_TREE" -mindepth 1 -maxdepth 1 ! -name '.git' -exec rm -rf {} +
tar -xzf "$TARBALL" -C "$IMPORT_TREE" --strip-components=1
git -C "$IMPORT_TREE" add -A
if git -C "$IMPORT_TREE" diff --cached --quiet; then
# Already imported — a previous run got this far and then stopped. Carry on
# to the merge rather than refusing, so a failure is retryable.
say "WordPress $VERSION was already imported; continuing to the merge"
else
git -C "$IMPORT_TREE" \
-c user.name="Silent Mode" -c user.email="hephaestus@silentmode.st" \
commit -q -m "WordPress ${VERSION}
build(sirius-press): build from the vendored subtree instead of a download The subtree is in place, so everything that used to fetch and patch core at build time now just copies it. tools/build.sh copies wordpress/ — no download, no checksum step, because there is nothing to fetch and nothing to trust that is not already in the repository docker/Dockerfile COPY wordpress/ instead of curl + sha256 + patch; the build args and the `patch` package are gone docker-compose.yml no WP_VERSION / WP_URL / WP_SHA256 to keep in step tools/update-wordpress.sh is rewritten around what the subtree makes possible. It imports the pristine release onto sirius-press/wordpress-upstream and then `git subtree merge`s that branch, which three-way merges upstream against the fork's own commit. A patch either applies with fuzz and hopes or fails and leaves you re-deriving the change by hand; a merge conflict is resolved once, in the file, and the next release merges against the resolution. patches/ survives as documentation rather than mechanism, and is now generated: tools/refresh-patches.sh diffs the subtree against the pristine import and rewrites the directory, with --check for CI. It answers the question anyone auditing a fork asks first — what exactly did you change inside WordPress? — in a minute, which `git log wordpress/` cannot, because that log is mostly upstream imports. Generated documentation stays true; a hand-maintained record of a core diff drifts, and a stale one is worse than none because people trust it. One test change worth noting: the syntax sweep no longer walks all of wordpress/. It lints the fork's own PHP plus every core file patches/ says the fork touches, which keeps the suite at seven seconds instead of a minute while still covering the only core file that can break.
2026-09-21 03:19:28 +02:00
Pristine upstream, unpacked from the official wordpress.org tarball.
${URL}
sha1 ${actual_sha1} (published by wordpress.org)
sha256 ${NEW_SHA256}
This branch carries nothing but upstream releases, one commit each, and is
never edited."
feat(sirius-press): take WordPress 7.1.2, and fix what that exposed The first real upstream release since the subtree landed, and the point of the whole arrangement. It merged cleanly: 7.1.2 changes about.php, template.php and version.php, none of which this fork touches, so the patched installer came through byte-identical and there was nothing to resolve. Getting there needed two fixes to the tool, both of which only a real release could have found — the earlier same-version run was a no-op that exercised none of this. **The prefix was an absolute path.** `${here#"$repo"/}` assumes the two strings share a spelling, and on Windows they do not: --show-toplevel answers "D:/Dev/…" while $PWD is "/d/Dev/…", so the subtraction left the path untouched and `git subtree merge --prefix` was handed something absolute. The same bug was fixed in refresh-patches.sh a few commits ago; this is the other copy of it. Both now ask git via `rev-parse --show-prefix`. **git-subtree refuses to run in a dirty repository** — any modification anywhere, not just under the subtree. In a monorepo shared with other work that is the normal state, so the tool was unusable exactly where it lives. The merge now happens in a scratch worktree, which is clean by construction, and comes back as one ordinary merge commit that touches only wordpress/ and so does not care what else is modified. Also: a failed run no longer refuses to retry. The import onto the upstream branch is idempotent now, and the failure message distinguishes "upstream and the fork changed the same lines" from "the merge could not start", instead of blaming a conflict for both.
2026-09-22 20:18:45 +02:00
say "imported as $(git -C "$IMPORT_TREE" rev-parse --short HEAD)"
fi
feat(sirius-press): a WordPress where the account is a key, not a mailbox WordPress makes two assumptions this project cannot accept: that identity comes from an email address, and that a site lives at one server. Both are things somebody else can take away — a mailbox is rented from a provider who can close it or be compelled to open it, and a server is one seizure from being gone. Sirius Press replaces the first and hedges the second. Signing in means signing a challenge with the key that controls a CashAddress. The address is recovered from the signature, so nothing is typed but the signature itself, and the result is an ordinary WordPress session cookie — roles, capabilities, nonces and the REST API never learn the login was different. Three ways to produce one: a wallet the browser already exposes, a phrase used once in the page and wiped, or a signature pasted in from any BIP-137 wallet, which needs no JavaScript and lets the key stay on a machine that never touches the web. There is no password reset, and the recovery page says so plainly rather than offering a form that cannot work. A reset mechanism is by construction a way to take an account from its owner, and it is always easier to attack than the cryptography it bypasses. Publishing a post also exports it as static HTML to the name's storage on Sia, signed by the key that owns the name, so the site keeps answering when the server does not. Email as a feature is untouched. wp_mail() still works, SMTP still sends, and contact forms still deliver to addresses real people typed. Only mail to the site's own unroutable placeholder addresses is diverted to an in-app inbox. The objection was to email as identity, not to email. Core is pinned and patched rather than vendored. WordPress 7.1.1 is 149 MB and 5,008 files; the fork's entire core diff is 75 lines in wp-admin/install.php. Carrying the former to express the latter would bury the patch where nobody reviews it and make every clone of the monorepo pay for it. Upstream releases still merge through tools/update-wordpress.sh, which reapplies the series and says exactly which hunk needs a human. The cryptography is implemented twice — PHP on the server, JavaScript in the page — because the server must verify and the browser must sign. Both are pinned against libauth, the library the Sirius portal wallet and the BNS gateway already use, so a disagreement of one byte fails the test suite rather than presenting as a rejected login at three in the morning. 132 checks, no framework, about a second.
2026-09-21 01:39:38 +02:00
feat(sirius-press): take WordPress 7.1.2, and fix what that exposed The first real upstream release since the subtree landed, and the point of the whole arrangement. It merged cleanly: 7.1.2 changes about.php, template.php and version.php, none of which this fork touches, so the patched installer came through byte-identical and there was nothing to resolve. Getting there needed two fixes to the tool, both of which only a real release could have found — the earlier same-version run was a no-op that exercised none of this. **The prefix was an absolute path.** `${here#"$repo"/}` assumes the two strings share a spelling, and on Windows they do not: --show-toplevel answers "D:/Dev/…" while $PWD is "/d/Dev/…", so the subtraction left the path untouched and `git subtree merge --prefix` was handed something absolute. The same bug was fixed in refresh-patches.sh a few commits ago; this is the other copy of it. Both now ask git via `rev-parse --show-prefix`. **git-subtree refuses to run in a dirty repository** — any modification anywhere, not just under the subtree. In a monorepo shared with other work that is the normal state, so the tool was unusable exactly where it lives. The merge now happens in a scratch worktree, which is clean by construction, and comes back as one ordinary merge commit that touches only wordpress/ and so does not care what else is modified. Also: a failed run no longer refuses to retry. The import onto the upstream branch is idempotent now, and the failure message distinguishes "upstream and the fork changed the same lines" from "the merge could not start", instead of blaming a conflict for both.
2026-09-22 20:18:45 +02:00
drop_worktree "$IMPORT_TREE"
build(sirius-press): build from the vendored subtree instead of a download The subtree is in place, so everything that used to fetch and patch core at build time now just copies it. tools/build.sh copies wordpress/ — no download, no checksum step, because there is nothing to fetch and nothing to trust that is not already in the repository docker/Dockerfile COPY wordpress/ instead of curl + sha256 + patch; the build args and the `patch` package are gone docker-compose.yml no WP_VERSION / WP_URL / WP_SHA256 to keep in step tools/update-wordpress.sh is rewritten around what the subtree makes possible. It imports the pristine release onto sirius-press/wordpress-upstream and then `git subtree merge`s that branch, which three-way merges upstream against the fork's own commit. A patch either applies with fuzz and hopes or fails and leaves you re-deriving the change by hand; a merge conflict is resolved once, in the file, and the next release merges against the resolution. patches/ survives as documentation rather than mechanism, and is now generated: tools/refresh-patches.sh diffs the subtree against the pristine import and rewrites the directory, with --check for CI. It answers the question anyone auditing a fork asks first — what exactly did you change inside WordPress? — in a minute, which `git log wordpress/` cannot, because that log is mostly upstream imports. Generated documentation stays true; a hand-maintained record of a core diff drifts, and a stale one is worse than none because people trust it. One test change worth noting: the syntax sweep no longer walks all of wordpress/. It lints the fork's own PHP plus every core file patches/ says the fork touches, which keeps the suite at seven seconds instead of a minute while still covering the only core file that can break.
2026-09-21 03:19:28 +02:00
trap - EXIT
feat(sirius-press): a WordPress where the account is a key, not a mailbox WordPress makes two assumptions this project cannot accept: that identity comes from an email address, and that a site lives at one server. Both are things somebody else can take away — a mailbox is rented from a provider who can close it or be compelled to open it, and a server is one seizure from being gone. Sirius Press replaces the first and hedges the second. Signing in means signing a challenge with the key that controls a CashAddress. The address is recovered from the signature, so nothing is typed but the signature itself, and the result is an ordinary WordPress session cookie — roles, capabilities, nonces and the REST API never learn the login was different. Three ways to produce one: a wallet the browser already exposes, a phrase used once in the page and wiped, or a signature pasted in from any BIP-137 wallet, which needs no JavaScript and lets the key stay on a machine that never touches the web. There is no password reset, and the recovery page says so plainly rather than offering a form that cannot work. A reset mechanism is by construction a way to take an account from its owner, and it is always easier to attack than the cryptography it bypasses. Publishing a post also exports it as static HTML to the name's storage on Sia, signed by the key that owns the name, so the site keeps answering when the server does not. Email as a feature is untouched. wp_mail() still works, SMTP still sends, and contact forms still deliver to addresses real people typed. Only mail to the site's own unroutable placeholder addresses is diverted to an in-app inbox. The objection was to email as identity, not to email. Core is pinned and patched rather than vendored. WordPress 7.1.1 is 149 MB and 5,008 files; the fork's entire core diff is 75 lines in wp-admin/install.php. Carrying the former to express the latter would bury the patch where nobody reviews it and make every clone of the monorepo pay for it. Upstream releases still merge through tools/update-wordpress.sh, which reapplies the series and says exactly which hunk needs a human. The cryptography is implemented twice — PHP on the server, JavaScript in the page — because the server must verify and the browser must sign. Both are pinned against libauth, the library the Sirius portal wallet and the BNS gateway already use, so a disagreement of one byte fails the test suite rather than presenting as a rejected login at three in the morning. 132 checks, no framework, about a second.
2026-09-21 01:39:38 +02:00
build(sirius-press): build from the vendored subtree instead of a download The subtree is in place, so everything that used to fetch and patch core at build time now just copies it. tools/build.sh copies wordpress/ — no download, no checksum step, because there is nothing to fetch and nothing to trust that is not already in the repository docker/Dockerfile COPY wordpress/ instead of curl + sha256 + patch; the build args and the `patch` package are gone docker-compose.yml no WP_VERSION / WP_URL / WP_SHA256 to keep in step tools/update-wordpress.sh is rewritten around what the subtree makes possible. It imports the pristine release onto sirius-press/wordpress-upstream and then `git subtree merge`s that branch, which three-way merges upstream against the fork's own commit. A patch either applies with fuzz and hopes or fails and leaves you re-deriving the change by hand; a merge conflict is resolved once, in the file, and the next release merges against the resolution. patches/ survives as documentation rather than mechanism, and is now generated: tools/refresh-patches.sh diffs the subtree against the pristine import and rewrites the directory, with --check for CI. It answers the question anyone auditing a fork asks first — what exactly did you change inside WordPress? — in a minute, which `git log wordpress/` cannot, because that log is mostly upstream imports. Generated documentation stays true; a hand-maintained record of a core diff drifts, and a stale one is worse than none because people trust it. One test change worth noting: the syntax sweep no longer walks all of wordpress/. It lints the fork's own PHP plus every core file patches/ says the fork touches, which keeps the suite at seven seconds instead of a minute while still covering the only core file that can break.
2026-09-21 03:19:28 +02:00
# ------------------------------------------------------------ subtree merge
feat(sirius-press): a WordPress where the account is a key, not a mailbox WordPress makes two assumptions this project cannot accept: that identity comes from an email address, and that a site lives at one server. Both are things somebody else can take away — a mailbox is rented from a provider who can close it or be compelled to open it, and a server is one seizure from being gone. Sirius Press replaces the first and hedges the second. Signing in means signing a challenge with the key that controls a CashAddress. The address is recovered from the signature, so nothing is typed but the signature itself, and the result is an ordinary WordPress session cookie — roles, capabilities, nonces and the REST API never learn the login was different. Three ways to produce one: a wallet the browser already exposes, a phrase used once in the page and wiped, or a signature pasted in from any BIP-137 wallet, which needs no JavaScript and lets the key stay on a machine that never touches the web. There is no password reset, and the recovery page says so plainly rather than offering a form that cannot work. A reset mechanism is by construction a way to take an account from its owner, and it is always easier to attack than the cryptography it bypasses. Publishing a post also exports it as static HTML to the name's storage on Sia, signed by the key that owns the name, so the site keeps answering when the server does not. Email as a feature is untouched. wp_mail() still works, SMTP still sends, and contact forms still deliver to addresses real people typed. Only mail to the site's own unroutable placeholder addresses is diverted to an in-app inbox. The objection was to email as identity, not to email. Core is pinned and patched rather than vendored. WordPress 7.1.1 is 149 MB and 5,008 files; the fork's entire core diff is 75 lines in wp-admin/install.php. Carrying the former to express the latter would bury the patch where nobody reviews it and make every clone of the monorepo pay for it. Upstream releases still merge through tools/update-wordpress.sh, which reapplies the series and says exactly which hunk needs a human. The cryptography is implemented twice — PHP on the server, JavaScript in the page — because the server must verify and the browser must sign. Both are pinned against libauth, the library the Sirius portal wallet and the BNS gateway already use, so a disagreement of one byte fails the test suite rather than presenting as a rejected login at three in the morning. 132 checks, no framework, about a second.
2026-09-21 01:39:38 +02:00
feat(sirius-press): take WordPress 7.1.2, and fix what that exposed The first real upstream release since the subtree landed, and the point of the whole arrangement. It merged cleanly: 7.1.2 changes about.php, template.php and version.php, none of which this fork touches, so the patched installer came through byte-identical and there was nothing to resolve. Getting there needed two fixes to the tool, both of which only a real release could have found — the earlier same-version run was a no-op that exercised none of this. **The prefix was an absolute path.** `${here#"$repo"/}` assumes the two strings share a spelling, and on Windows they do not: --show-toplevel answers "D:/Dev/…" while $PWD is "/d/Dev/…", so the subtraction left the path untouched and `git subtree merge --prefix` was handed something absolute. The same bug was fixed in refresh-patches.sh a few commits ago; this is the other copy of it. Both now ask git via `rev-parse --show-prefix`. **git-subtree refuses to run in a dirty repository** — any modification anywhere, not just under the subtree. In a monorepo shared with other work that is the normal state, so the tool was unusable exactly where it lives. The merge now happens in a scratch worktree, which is clean by construction, and comes back as one ordinary merge commit that touches only wordpress/ and so does not care what else is modified. Also: a failed run no longer refuses to retry. The import onto the upstream branch is idempotent now, and the failure message distinguishes "upstream and the fork changed the same lines" from "the merge could not start", instead of blaming a conflict for both.
2026-09-22 20:18:45 +02:00
say "merging into ${prefix}/ (in a scratch worktree)"
drop_worktree "$MERGE_TREE"
rm -rf "$MERGE_TREE"
git -C "$repo" branch -D "$MERGE_BRANCH" >/dev/null 2>&1 || true
git -C "$repo" worktree add --quiet -b "$MERGE_BRANCH" "$MERGE_TREE" HEAD
if git -C "$MERGE_TREE" \
build(sirius-press): build from the vendored subtree instead of a download The subtree is in place, so everything that used to fetch and patch core at build time now just copies it. tools/build.sh copies wordpress/ — no download, no checksum step, because there is nothing to fetch and nothing to trust that is not already in the repository docker/Dockerfile COPY wordpress/ instead of curl + sha256 + patch; the build args and the `patch` package are gone docker-compose.yml no WP_VERSION / WP_URL / WP_SHA256 to keep in step tools/update-wordpress.sh is rewritten around what the subtree makes possible. It imports the pristine release onto sirius-press/wordpress-upstream and then `git subtree merge`s that branch, which three-way merges upstream against the fork's own commit. A patch either applies with fuzz and hopes or fails and leaves you re-deriving the change by hand; a merge conflict is resolved once, in the file, and the next release merges against the resolution. patches/ survives as documentation rather than mechanism, and is now generated: tools/refresh-patches.sh diffs the subtree against the pristine import and rewrites the directory, with --check for CI. It answers the question anyone auditing a fork asks first — what exactly did you change inside WordPress? — in a minute, which `git log wordpress/` cannot, because that log is mostly upstream imports. Generated documentation stays true; a hand-maintained record of a core diff drifts, and a stale one is worse than none because people trust it. One test change worth noting: the syntax sweep no longer walks all of wordpress/. It lints the fork's own PHP plus every core file patches/ says the fork touches, which keeps the suite at seven seconds instead of a minute while still covering the only core file that can break.
2026-09-21 03:19:28 +02:00
-c user.name="Silent Mode" -c user.email="hephaestus@silentmode.st" \
subtree merge --prefix="$prefix" "$UPSTREAM_BRANCH" \
-m "merge: WordPress ${VERSION} into the vendored subtree"
then
feat(sirius-press): take WordPress 7.1.2, and fix what that exposed The first real upstream release since the subtree landed, and the point of the whole arrangement. It merged cleanly: 7.1.2 changes about.php, template.php and version.php, none of which this fork touches, so the patched installer came through byte-identical and there was nothing to resolve. Getting there needed two fixes to the tool, both of which only a real release could have found — the earlier same-version run was a no-op that exercised none of this. **The prefix was an absolute path.** `${here#"$repo"/}` assumes the two strings share a spelling, and on Windows they do not: --show-toplevel answers "D:/Dev/…" while $PWD is "/d/Dev/…", so the subtraction left the path untouched and `git subtree merge --prefix` was handed something absolute. The same bug was fixed in refresh-patches.sh a few commits ago; this is the other copy of it. Both now ask git via `rev-parse --show-prefix`. **git-subtree refuses to run in a dirty repository** — any modification anywhere, not just under the subtree. In a monorepo shared with other work that is the normal state, so the tool was unusable exactly where it lives. The merge now happens in a scratch worktree, which is clean by construction, and comes back as one ordinary merge commit that touches only wordpress/ and so does not care what else is modified. Also: a failed run no longer refuses to retry. The import onto the upstream branch is idempotent now, and the failure message distinguishes "upstream and the fork changed the same lines" from "the merge could not start", instead of blaming a conflict for both.
2026-09-22 20:18:45 +02:00
say "merged cleanly"
feat(sirius-press): a WordPress where the account is a key, not a mailbox WordPress makes two assumptions this project cannot accept: that identity comes from an email address, and that a site lives at one server. Both are things somebody else can take away — a mailbox is rented from a provider who can close it or be compelled to open it, and a server is one seizure from being gone. Sirius Press replaces the first and hedges the second. Signing in means signing a challenge with the key that controls a CashAddress. The address is recovered from the signature, so nothing is typed but the signature itself, and the result is an ordinary WordPress session cookie — roles, capabilities, nonces and the REST API never learn the login was different. Three ways to produce one: a wallet the browser already exposes, a phrase used once in the page and wiped, or a signature pasted in from any BIP-137 wallet, which needs no JavaScript and lets the key stay on a machine that never touches the web. There is no password reset, and the recovery page says so plainly rather than offering a form that cannot work. A reset mechanism is by construction a way to take an account from its owner, and it is always easier to attack than the cryptography it bypasses. Publishing a post also exports it as static HTML to the name's storage on Sia, signed by the key that owns the name, so the site keeps answering when the server does not. Email as a feature is untouched. wp_mail() still works, SMTP still sends, and contact forms still deliver to addresses real people typed. Only mail to the site's own unroutable placeholder addresses is diverted to an in-app inbox. The objection was to email as identity, not to email. Core is pinned and patched rather than vendored. WordPress 7.1.1 is 149 MB and 5,008 files; the fork's entire core diff is 75 lines in wp-admin/install.php. Carrying the former to express the latter would bury the patch where nobody reviews it and make every clone of the monorepo pay for it. Upstream releases still merge through tools/update-wordpress.sh, which reapplies the series and says exactly which hunk needs a human. The cryptography is implemented twice — PHP on the server, JavaScript in the page — because the server must verify and the browser must sign. Both are pinned against libauth, the library the Sirius portal wallet and the BNS gateway already use, so a disagreement of one byte fails the test suite rather than presenting as a rejected login at three in the morning. 132 checks, no framework, about a second.
2026-09-21 01:39:38 +02:00
else
cat >&2 <<EOF
build(sirius-press): build from the vendored subtree instead of a download The subtree is in place, so everything that used to fetch and patch core at build time now just copies it. tools/build.sh copies wordpress/ — no download, no checksum step, because there is nothing to fetch and nothing to trust that is not already in the repository docker/Dockerfile COPY wordpress/ instead of curl + sha256 + patch; the build args and the `patch` package are gone docker-compose.yml no WP_VERSION / WP_URL / WP_SHA256 to keep in step tools/update-wordpress.sh is rewritten around what the subtree makes possible. It imports the pristine release onto sirius-press/wordpress-upstream and then `git subtree merge`s that branch, which three-way merges upstream against the fork's own commit. A patch either applies with fuzz and hopes or fails and leaves you re-deriving the change by hand; a merge conflict is resolved once, in the file, and the next release merges against the resolution. patches/ survives as documentation rather than mechanism, and is now generated: tools/refresh-patches.sh diffs the subtree against the pristine import and rewrites the directory, with --check for CI. It answers the question anyone auditing a fork asks first — what exactly did you change inside WordPress? — in a minute, which `git log wordpress/` cannot, because that log is mostly upstream imports. Generated documentation stays true; a hand-maintained record of a core diff drifts, and a stale one is worse than none because people trust it. One test change worth noting: the syntax sweep no longer walks all of wordpress/. It lints the fork's own PHP plus every core file patches/ says the fork touches, which keeps the suite at seven seconds instead of a minute while still covering the only core file that can break.
2026-09-21 03:19:28 +02:00
feat(sirius-press): take WordPress 7.1.2, and fix what that exposed The first real upstream release since the subtree landed, and the point of the whole arrangement. It merged cleanly: 7.1.2 changes about.php, template.php and version.php, none of which this fork touches, so the patched installer came through byte-identical and there was nothing to resolve. Getting there needed two fixes to the tool, both of which only a real release could have found — the earlier same-version run was a no-op that exercised none of this. **The prefix was an absolute path.** `${here#"$repo"/}` assumes the two strings share a spelling, and on Windows they do not: --show-toplevel answers "D:/Dev/…" while $PWD is "/d/Dev/…", so the subtraction left the path untouched and `git subtree merge --prefix` was handed something absolute. The same bug was fixed in refresh-patches.sh a few commits ago; this is the other copy of it. Both now ask git via `rev-parse --show-prefix`. **git-subtree refuses to run in a dirty repository** — any modification anywhere, not just under the subtree. In a monorepo shared with other work that is the normal state, so the tool was unusable exactly where it lives. The merge now happens in a scratch worktree, which is clean by construction, and comes back as one ordinary merge commit that touches only wordpress/ and so does not care what else is modified. Also: a failed run no longer refuses to retry. The import onto the upstream branch is idempotent now, and the failure message distinguishes "upstream and the fork changed the same lines" from "the merge could not start", instead of blaming a conflict for both.
2026-09-22 20:18:45 +02:00
$(printf '\033[31mThe merge did not complete.\033[0m')
build(sirius-press): build from the vendored subtree instead of a download The subtree is in place, so everything that used to fetch and patch core at build time now just copies it. tools/build.sh copies wordpress/ — no download, no checksum step, because there is nothing to fetch and nothing to trust that is not already in the repository docker/Dockerfile COPY wordpress/ instead of curl + sha256 + patch; the build args and the `patch` package are gone docker-compose.yml no WP_VERSION / WP_URL / WP_SHA256 to keep in step tools/update-wordpress.sh is rewritten around what the subtree makes possible. It imports the pristine release onto sirius-press/wordpress-upstream and then `git subtree merge`s that branch, which three-way merges upstream against the fork's own commit. A patch either applies with fuzz and hopes or fails and leaves you re-deriving the change by hand; a merge conflict is resolved once, in the file, and the next release merges against the resolution. patches/ survives as documentation rather than mechanism, and is now generated: tools/refresh-patches.sh diffs the subtree against the pristine import and rewrites the directory, with --check for CI. It answers the question anyone auditing a fork asks first — what exactly did you change inside WordPress? — in a minute, which `git log wordpress/` cannot, because that log is mostly upstream imports. Generated documentation stays true; a hand-maintained record of a core diff drifts, and a stale one is worse than none because people trust it. One test change worth noting: the syntax sweep no longer walks all of wordpress/. It lints the fork's own PHP plus every core file patches/ says the fork touches, which keeps the suite at seven seconds instead of a minute while still covering the only core file that can break.
2026-09-21 03:19:28 +02:00
feat(sirius-press): take WordPress 7.1.2, and fix what that exposed The first real upstream release since the subtree landed, and the point of the whole arrangement. It merged cleanly: 7.1.2 changes about.php, template.php and version.php, none of which this fork touches, so the patched installer came through byte-identical and there was nothing to resolve. Getting there needed two fixes to the tool, both of which only a real release could have found — the earlier same-version run was a no-op that exercised none of this. **The prefix was an absolute path.** `${here#"$repo"/}` assumes the two strings share a spelling, and on Windows they do not: --show-toplevel answers "D:/Dev/…" while $PWD is "/d/Dev/…", so the subtraction left the path untouched and `git subtree merge --prefix` was handed something absolute. The same bug was fixed in refresh-patches.sh a few commits ago; this is the other copy of it. Both now ask git via `rev-parse --show-prefix`. **git-subtree refuses to run in a dirty repository** — any modification anywhere, not just under the subtree. In a monorepo shared with other work that is the normal state, so the tool was unusable exactly where it lives. The merge now happens in a scratch worktree, which is clean by construction, and comes back as one ordinary merge commit that touches only wordpress/ and so does not care what else is modified. Also: a failed run no longer refuses to retry. The import onto the upstream branch is idempotent now, and the failure message distinguishes "upstream and the fork changed the same lines" from "the merge could not start", instead of blaming a conflict for both.
2026-09-22 20:18:45 +02:00
Usually this means upstream changed code the fork also changes — in practice
wp-admin/install.php, the only file this fork patches. Your own checkout is
untouched and still on WordPress ${CURRENT}; the half-done merge is in a
scratch worktree:
build(sirius-press): build from the vendored subtree instead of a download The subtree is in place, so everything that used to fetch and patch core at build time now just copies it. tools/build.sh copies wordpress/ — no download, no checksum step, because there is nothing to fetch and nothing to trust that is not already in the repository docker/Dockerfile COPY wordpress/ instead of curl + sha256 + patch; the build args and the `patch` package are gone docker-compose.yml no WP_VERSION / WP_URL / WP_SHA256 to keep in step tools/update-wordpress.sh is rewritten around what the subtree makes possible. It imports the pristine release onto sirius-press/wordpress-upstream and then `git subtree merge`s that branch, which three-way merges upstream against the fork's own commit. A patch either applies with fuzz and hopes or fails and leaves you re-deriving the change by hand; a merge conflict is resolved once, in the file, and the next release merges against the resolution. patches/ survives as documentation rather than mechanism, and is now generated: tools/refresh-patches.sh diffs the subtree against the pristine import and rewrites the directory, with --check for CI. It answers the question anyone auditing a fork asks first — what exactly did you change inside WordPress? — in a minute, which `git log wordpress/` cannot, because that log is mostly upstream imports. Generated documentation stays true; a hand-maintained record of a core diff drifts, and a stale one is worse than none because people trust it. One test change worth noting: the syntax sweep no longer walks all of wordpress/. It lints the fork's own PHP plus every core file patches/ says the fork touches, which keeps the suite at seven seconds instead of a minute while still covering the only core file that can break.
2026-09-21 03:19:28 +02:00
feat(sirius-press): take WordPress 7.1.2, and fix what that exposed The first real upstream release since the subtree landed, and the point of the whole arrangement. It merged cleanly: 7.1.2 changes about.php, template.php and version.php, none of which this fork touches, so the patched installer came through byte-identical and there was nothing to resolve. Getting there needed two fixes to the tool, both of which only a real release could have found — the earlier same-version run was a no-op that exercised none of this. **The prefix was an absolute path.** `${here#"$repo"/}` assumes the two strings share a spelling, and on Windows they do not: --show-toplevel answers "D:/Dev/…" while $PWD is "/d/Dev/…", so the subtraction left the path untouched and `git subtree merge --prefix` was handed something absolute. The same bug was fixed in refresh-patches.sh a few commits ago; this is the other copy of it. Both now ask git via `rev-parse --show-prefix`. **git-subtree refuses to run in a dirty repository** — any modification anywhere, not just under the subtree. In a monorepo shared with other work that is the normal state, so the tool was unusable exactly where it lives. The merge now happens in a scratch worktree, which is clean by construction, and comes back as one ordinary merge commit that touches only wordpress/ and so does not care what else is modified. Also: a failed run no longer refuses to retry. The import onto the upstream branch is idempotent now, and the failure message distinguishes "upstream and the fork changed the same lines" from "the merge could not start", instead of blaming a conflict for both.
2026-09-22 20:18:45 +02:00
cd ${MERGE_TREE}
git status # what conflicted
build(sirius-press): build from the vendored subtree instead of a download The subtree is in place, so everything that used to fetch and patch core at build time now just copies it. tools/build.sh copies wordpress/ — no download, no checksum step, because there is nothing to fetch and nothing to trust that is not already in the repository docker/Dockerfile COPY wordpress/ instead of curl + sha256 + patch; the build args and the `patch` package are gone docker-compose.yml no WP_VERSION / WP_URL / WP_SHA256 to keep in step tools/update-wordpress.sh is rewritten around what the subtree makes possible. It imports the pristine release onto sirius-press/wordpress-upstream and then `git subtree merge`s that branch, which three-way merges upstream against the fork's own commit. A patch either applies with fuzz and hopes or fails and leaves you re-deriving the change by hand; a merge conflict is resolved once, in the file, and the next release merges against the resolution. patches/ survives as documentation rather than mechanism, and is now generated: tools/refresh-patches.sh diffs the subtree against the pristine import and rewrites the directory, with --check for CI. It answers the question anyone auditing a fork asks first — what exactly did you change inside WordPress? — in a minute, which `git log wordpress/` cannot, because that log is mostly upstream imports. Generated documentation stays true; a hand-maintained record of a core diff drifts, and a stale one is worse than none because people trust it. One test change worth noting: the syntax sweep no longer walks all of wordpress/. It lints the fork's own PHP plus every core file patches/ says the fork touches, which keeps the suite at seven seconds instead of a minute while still covering the only core file that can break.
2026-09-21 03:19:28 +02:00
\$EDITOR ${prefix}/wp-admin/install.php
git add ${prefix}/wp-admin/install.php
feat(sirius-press): take WordPress 7.1.2, and fix what that exposed The first real upstream release since the subtree landed, and the point of the whole arrangement. It merged cleanly: 7.1.2 changes about.php, template.php and version.php, none of which this fork touches, so the patched installer came through byte-identical and there was nothing to resolve. Getting there needed two fixes to the tool, both of which only a real release could have found — the earlier same-version run was a no-op that exercised none of this. **The prefix was an absolute path.** `${here#"$repo"/}` assumes the two strings share a spelling, and on Windows they do not: --show-toplevel answers "D:/Dev/…" while $PWD is "/d/Dev/…", so the subtraction left the path untouched and `git subtree merge --prefix` was handed something absolute. The same bug was fixed in refresh-patches.sh a few commits ago; this is the other copy of it. Both now ask git via `rev-parse --show-prefix`. **git-subtree refuses to run in a dirty repository** — any modification anywhere, not just under the subtree. In a monorepo shared with other work that is the normal state, so the tool was unusable exactly where it lives. The merge now happens in a scratch worktree, which is clean by construction, and comes back as one ordinary merge commit that touches only wordpress/ and so does not care what else is modified. Also: a failed run no longer refuses to retry. The import onto the upstream branch is idempotent now, and the failure message distinguishes "upstream and the fork changed the same lines" from "the merge could not start", instead of blaming a conflict for both.
2026-09-22 20:18:45 +02:00
git commit # finish the merge
build(sirius-press): build from the vendored subtree instead of a download The subtree is in place, so everything that used to fetch and patch core at build time now just copies it. tools/build.sh copies wordpress/ — no download, no checksum step, because there is nothing to fetch and nothing to trust that is not already in the repository docker/Dockerfile COPY wordpress/ instead of curl + sha256 + patch; the build args and the `patch` package are gone docker-compose.yml no WP_VERSION / WP_URL / WP_SHA256 to keep in step tools/update-wordpress.sh is rewritten around what the subtree makes possible. It imports the pristine release onto sirius-press/wordpress-upstream and then `git subtree merge`s that branch, which three-way merges upstream against the fork's own commit. A patch either applies with fuzz and hopes or fails and leaves you re-deriving the change by hand; a merge conflict is resolved once, in the file, and the next release merges against the resolution. patches/ survives as documentation rather than mechanism, and is now generated: tools/refresh-patches.sh diffs the subtree against the pristine import and rewrites the directory, with --check for CI. It answers the question anyone auditing a fork asks first — what exactly did you change inside WordPress? — in a minute, which `git log wordpress/` cannot, because that log is mostly upstream imports. Generated documentation stays true; a hand-maintained record of a core diff drifts, and a stale one is worse than none because people trust it. One test change worth noting: the syntax sweep no longer walks all of wordpress/. It lints the fork's own PHP plus every core file patches/ says the fork touches, which keeps the suite at seven seconds instead of a minute while still covering the only core file that can break.
2026-09-21 03:19:28 +02:00
feat(sirius-press): take WordPress 7.1.2, and fix what that exposed The first real upstream release since the subtree landed, and the point of the whole arrangement. It merged cleanly: 7.1.2 changes about.php, template.php and version.php, none of which this fork touches, so the patched installer came through byte-identical and there was nothing to resolve. Getting there needed two fixes to the tool, both of which only a real release could have found — the earlier same-version run was a no-op that exercised none of this. **The prefix was an absolute path.** `${here#"$repo"/}` assumes the two strings share a spelling, and on Windows they do not: --show-toplevel answers "D:/Dev/…" while $PWD is "/d/Dev/…", so the subtraction left the path untouched and `git subtree merge --prefix` was handed something absolute. The same bug was fixed in refresh-patches.sh a few commits ago; this is the other copy of it. Both now ask git via `rev-parse --show-prefix`. **git-subtree refuses to run in a dirty repository** — any modification anywhere, not just under the subtree. In a monorepo shared with other work that is the normal state, so the tool was unusable exactly where it lives. The merge now happens in a scratch worktree, which is clean by construction, and comes back as one ordinary merge commit that touches only wordpress/ and so does not care what else is modified. Also: a failed run no longer refuses to retry. The import onto the upstream branch is idempotent now, and the failure message distinguishes "upstream and the fork changed the same lines" from "the merge could not start", instead of blaming a conflict for both.
2026-09-22 20:18:45 +02:00
Then bring it back and finish up:
build(sirius-press): build from the vendored subtree instead of a download The subtree is in place, so everything that used to fetch and patch core at build time now just copies it. tools/build.sh copies wordpress/ — no download, no checksum step, because there is nothing to fetch and nothing to trust that is not already in the repository docker/Dockerfile COPY wordpress/ instead of curl + sha256 + patch; the build args and the `patch` package are gone docker-compose.yml no WP_VERSION / WP_URL / WP_SHA256 to keep in step tools/update-wordpress.sh is rewritten around what the subtree makes possible. It imports the pristine release onto sirius-press/wordpress-upstream and then `git subtree merge`s that branch, which three-way merges upstream against the fork's own commit. A patch either applies with fuzz and hopes or fails and leaves you re-deriving the change by hand; a merge conflict is resolved once, in the file, and the next release merges against the resolution. patches/ survives as documentation rather than mechanism, and is now generated: tools/refresh-patches.sh diffs the subtree against the pristine import and rewrites the directory, with --check for CI. It answers the question anyone auditing a fork asks first — what exactly did you change inside WordPress? — in a minute, which `git log wordpress/` cannot, because that log is mostly upstream imports. Generated documentation stays true; a hand-maintained record of a core diff drifts, and a stale one is worse than none because people trust it. One test change worth noting: the syntax sweep no longer walks all of wordpress/. It lints the fork's own PHP plus every core file patches/ says the fork touches, which keeps the suite at seven seconds instead of a minute while still covering the only core file that can break.
2026-09-21 03:19:28 +02:00
feat(sirius-press): take WordPress 7.1.2, and fix what that exposed The first real upstream release since the subtree landed, and the point of the whole arrangement. It merged cleanly: 7.1.2 changes about.php, template.php and version.php, none of which this fork touches, so the patched installer came through byte-identical and there was nothing to resolve. Getting there needed two fixes to the tool, both of which only a real release could have found — the earlier same-version run was a no-op that exercised none of this. **The prefix was an absolute path.** `${here#"$repo"/}` assumes the two strings share a spelling, and on Windows they do not: --show-toplevel answers "D:/Dev/…" while $PWD is "/d/Dev/…", so the subtraction left the path untouched and `git subtree merge --prefix` was handed something absolute. The same bug was fixed in refresh-patches.sh a few commits ago; this is the other copy of it. Both now ask git via `rev-parse --show-prefix`. **git-subtree refuses to run in a dirty repository** — any modification anywhere, not just under the subtree. In a monorepo shared with other work that is the normal state, so the tool was unusable exactly where it lives. The merge now happens in a scratch worktree, which is clean by construction, and comes back as one ordinary merge commit that touches only wordpress/ and so does not care what else is modified. Also: a failed run no longer refuses to retry. The import onto the upstream branch is idempotent now, and the failure message distinguishes "upstream and the fork changed the same lines" from "the merge could not start", instead of blaming a conflict for both.
2026-09-22 20:18:45 +02:00
cd ${repo}
git merge --no-ff ${MERGE_BRANCH}
git worktree remove ${MERGE_TREE}
git branch -d ${MERGE_BRANCH}
${here}/tools/refresh-patches.sh
build(sirius-press): build from the vendored subtree instead of a download The subtree is in place, so everything that used to fetch and patch core at build time now just copies it. tools/build.sh copies wordpress/ — no download, no checksum step, because there is nothing to fetch and nothing to trust that is not already in the repository docker/Dockerfile COPY wordpress/ instead of curl + sha256 + patch; the build args and the `patch` package are gone docker-compose.yml no WP_VERSION / WP_URL / WP_SHA256 to keep in step tools/update-wordpress.sh is rewritten around what the subtree makes possible. It imports the pristine release onto sirius-press/wordpress-upstream and then `git subtree merge`s that branch, which three-way merges upstream against the fork's own commit. A patch either applies with fuzz and hopes or fails and leaves you re-deriving the change by hand; a merge conflict is resolved once, in the file, and the next release merges against the resolution. patches/ survives as documentation rather than mechanism, and is now generated: tools/refresh-patches.sh diffs the subtree against the pristine import and rewrites the directory, with --check for CI. It answers the question anyone auditing a fork asks first — what exactly did you change inside WordPress? — in a minute, which `git log wordpress/` cannot, because that log is mostly upstream imports. Generated documentation stays true; a hand-maintained record of a core diff drifts, and a stale one is worse than none because people trust it. One test change worth noting: the syntax sweep no longer walks all of wordpress/. It lints the fork's own PHP plus every core file patches/ says the fork touches, which keeps the suite at seven seconds instead of a minute while still covering the only core file that can break.
2026-09-21 03:19:28 +02:00
# set WP_VERSION / WP_URL / WP_SHA256 / WP_SHA1 in tools/wordpress.lock
feat(sirius-press): a WordPress where the account is a key, not a mailbox WordPress makes two assumptions this project cannot accept: that identity comes from an email address, and that a site lives at one server. Both are things somebody else can take away — a mailbox is rented from a provider who can close it or be compelled to open it, and a server is one seizure from being gone. Sirius Press replaces the first and hedges the second. Signing in means signing a challenge with the key that controls a CashAddress. The address is recovered from the signature, so nothing is typed but the signature itself, and the result is an ordinary WordPress session cookie — roles, capabilities, nonces and the REST API never learn the login was different. Three ways to produce one: a wallet the browser already exposes, a phrase used once in the page and wiped, or a signature pasted in from any BIP-137 wallet, which needs no JavaScript and lets the key stay on a machine that never touches the web. There is no password reset, and the recovery page says so plainly rather than offering a form that cannot work. A reset mechanism is by construction a way to take an account from its owner, and it is always easier to attack than the cryptography it bypasses. Publishing a post also exports it as static HTML to the name's storage on Sia, signed by the key that owns the name, so the site keeps answering when the server does not. Email as a feature is untouched. wp_mail() still works, SMTP still sends, and contact forms still deliver to addresses real people typed. Only mail to the site's own unroutable placeholder addresses is diverted to an in-app inbox. The objection was to email as identity, not to email. Core is pinned and patched rather than vendored. WordPress 7.1.1 is 149 MB and 5,008 files; the fork's entire core diff is 75 lines in wp-admin/install.php. Carrying the former to express the latter would bury the patch where nobody reviews it and make every clone of the monorepo pay for it. Upstream releases still merge through tools/update-wordpress.sh, which reapplies the series and says exactly which hunk needs a human. The cryptography is implemented twice — PHP on the server, JavaScript in the page — because the server must verify and the browser must sign. Both are pinned against libauth, the library the Sirius portal wallet and the BNS gateway already use, so a disagreement of one byte fails the test suite rather than presenting as a rejected login at three in the morning. 132 checks, no framework, about a second.
2026-09-21 01:39:38 +02:00
EOF
exit 1
fi
feat(sirius-press): take WordPress 7.1.2, and fix what that exposed The first real upstream release since the subtree landed, and the point of the whole arrangement. It merged cleanly: 7.1.2 changes about.php, template.php and version.php, none of which this fork touches, so the patched installer came through byte-identical and there was nothing to resolve. Getting there needed two fixes to the tool, both of which only a real release could have found — the earlier same-version run was a no-op that exercised none of this. **The prefix was an absolute path.** `${here#"$repo"/}` assumes the two strings share a spelling, and on Windows they do not: --show-toplevel answers "D:/Dev/…" while $PWD is "/d/Dev/…", so the subtraction left the path untouched and `git subtree merge --prefix` was handed something absolute. The same bug was fixed in refresh-patches.sh a few commits ago; this is the other copy of it. Both now ask git via `rev-parse --show-prefix`. **git-subtree refuses to run in a dirty repository** — any modification anywhere, not just under the subtree. In a monorepo shared with other work that is the normal state, so the tool was unusable exactly where it lives. The merge now happens in a scratch worktree, which is clean by construction, and comes back as one ordinary merge commit that touches only wordpress/ and so does not care what else is modified. Also: a failed run no longer refuses to retry. The import onto the upstream branch is idempotent now, and the failure message distinguishes "upstream and the fork changed the same lines" from "the merge could not start", instead of blaming a conflict for both.
2026-09-22 20:18:45 +02:00
# Bring the merge home. This touches only ${prefix}/, so unrelated modified
# files elsewhere in the repository are not in its way.
say "bringing the merge into the working branch"
git -C "$repo" merge --no-ff -q \
-m "merge: WordPress ${VERSION} into ${prefix}/" "$MERGE_BRANCH" \
|| die "could not merge ${MERGE_BRANCH} into the working branch. It is still
there, with the subtree merge already done — resolve and merge it by hand."
drop_worktree "$MERGE_TREE"
git -C "$repo" branch -D "$MERGE_BRANCH" >/dev/null 2>&1 || true
feat(sirius-press): a WordPress where the account is a key, not a mailbox WordPress makes two assumptions this project cannot accept: that identity comes from an email address, and that a site lives at one server. Both are things somebody else can take away — a mailbox is rented from a provider who can close it or be compelled to open it, and a server is one seizure from being gone. Sirius Press replaces the first and hedges the second. Signing in means signing a challenge with the key that controls a CashAddress. The address is recovered from the signature, so nothing is typed but the signature itself, and the result is an ordinary WordPress session cookie — roles, capabilities, nonces and the REST API never learn the login was different. Three ways to produce one: a wallet the browser already exposes, a phrase used once in the page and wiped, or a signature pasted in from any BIP-137 wallet, which needs no JavaScript and lets the key stay on a machine that never touches the web. There is no password reset, and the recovery page says so plainly rather than offering a form that cannot work. A reset mechanism is by construction a way to take an account from its owner, and it is always easier to attack than the cryptography it bypasses. Publishing a post also exports it as static HTML to the name's storage on Sia, signed by the key that owns the name, so the site keeps answering when the server does not. Email as a feature is untouched. wp_mail() still works, SMTP still sends, and contact forms still deliver to addresses real people typed. Only mail to the site's own unroutable placeholder addresses is diverted to an in-app inbox. The objection was to email as identity, not to email. Core is pinned and patched rather than vendored. WordPress 7.1.1 is 149 MB and 5,008 files; the fork's entire core diff is 75 lines in wp-admin/install.php. Carrying the former to express the latter would bury the patch where nobody reviews it and make every clone of the monorepo pay for it. Upstream releases still merge through tools/update-wordpress.sh, which reapplies the series and says exactly which hunk needs a human. The cryptography is implemented twice — PHP on the server, JavaScript in the page — because the server must verify and the browser must sign. Both are pinned against libauth, the library the Sirius portal wallet and the BNS gateway already use, so a disagreement of one byte fails the test suite rather than presenting as a rejected login at three in the morning. 132 checks, no framework, about a second.
2026-09-21 01:39:38 +02:00
# --------------------------------------------------------------- the lock
say "updating tools/wordpress.lock"
build(sirius-press): build from the vendored subtree instead of a download The subtree is in place, so everything that used to fetch and patch core at build time now just copies it. tools/build.sh copies wordpress/ — no download, no checksum step, because there is nothing to fetch and nothing to trust that is not already in the repository docker/Dockerfile COPY wordpress/ instead of curl + sha256 + patch; the build args and the `patch` package are gone docker-compose.yml no WP_VERSION / WP_URL / WP_SHA256 to keep in step tools/update-wordpress.sh is rewritten around what the subtree makes possible. It imports the pristine release onto sirius-press/wordpress-upstream and then `git subtree merge`s that branch, which three-way merges upstream against the fork's own commit. A patch either applies with fuzz and hopes or fails and leaves you re-deriving the change by hand; a merge conflict is resolved once, in the file, and the next release merges against the resolution. patches/ survives as documentation rather than mechanism, and is now generated: tools/refresh-patches.sh diffs the subtree against the pristine import and rewrites the directory, with --check for CI. It answers the question anyone auditing a fork asks first — what exactly did you change inside WordPress? — in a minute, which `git log wordpress/` cannot, because that log is mostly upstream imports. Generated documentation stays true; a hand-maintained record of a core diff drifts, and a stale one is worse than none because people trust it. One test change worth noting: the syntax sweep no longer walks all of wordpress/. It lints the fork's own PHP plus every core file patches/ says the fork touches, which keeps the suite at seven seconds instead of a minute while still covering the only core file that can break.
2026-09-21 03:19:28 +02:00
python3 - "$VERSION" "$URL" "$NEW_SHA256" "$actual_sha1" "$here/tools/wordpress.lock" <<'PY'
feat(sirius-press): a WordPress where the account is a key, not a mailbox WordPress makes two assumptions this project cannot accept: that identity comes from an email address, and that a site lives at one server. Both are things somebody else can take away — a mailbox is rented from a provider who can close it or be compelled to open it, and a server is one seizure from being gone. Sirius Press replaces the first and hedges the second. Signing in means signing a challenge with the key that controls a CashAddress. The address is recovered from the signature, so nothing is typed but the signature itself, and the result is an ordinary WordPress session cookie — roles, capabilities, nonces and the REST API never learn the login was different. Three ways to produce one: a wallet the browser already exposes, a phrase used once in the page and wiped, or a signature pasted in from any BIP-137 wallet, which needs no JavaScript and lets the key stay on a machine that never touches the web. There is no password reset, and the recovery page says so plainly rather than offering a form that cannot work. A reset mechanism is by construction a way to take an account from its owner, and it is always easier to attack than the cryptography it bypasses. Publishing a post also exports it as static HTML to the name's storage on Sia, signed by the key that owns the name, so the site keeps answering when the server does not. Email as a feature is untouched. wp_mail() still works, SMTP still sends, and contact forms still deliver to addresses real people typed. Only mail to the site's own unroutable placeholder addresses is diverted to an in-app inbox. The objection was to email as identity, not to email. Core is pinned and patched rather than vendored. WordPress 7.1.1 is 149 MB and 5,008 files; the fork's entire core diff is 75 lines in wp-admin/install.php. Carrying the former to express the latter would bury the patch where nobody reviews it and make every clone of the monorepo pay for it. Upstream releases still merge through tools/update-wordpress.sh, which reapplies the series and says exactly which hunk needs a human. The cryptography is implemented twice — PHP on the server, JavaScript in the page — because the server must verify and the browser must sign. Both are pinned against libauth, the library the Sirius portal wallet and the BNS gateway already use, so a disagreement of one byte fails the test suite rather than presenting as a rejected login at three in the morning. 132 checks, no framework, about a second.
2026-09-21 01:39:38 +02:00
import io, sys
build(sirius-press): build from the vendored subtree instead of a download The subtree is in place, so everything that used to fetch and patch core at build time now just copies it. tools/build.sh copies wordpress/ — no download, no checksum step, because there is nothing to fetch and nothing to trust that is not already in the repository docker/Dockerfile COPY wordpress/ instead of curl + sha256 + patch; the build args and the `patch` package are gone docker-compose.yml no WP_VERSION / WP_URL / WP_SHA256 to keep in step tools/update-wordpress.sh is rewritten around what the subtree makes possible. It imports the pristine release onto sirius-press/wordpress-upstream and then `git subtree merge`s that branch, which three-way merges upstream against the fork's own commit. A patch either applies with fuzz and hopes or fails and leaves you re-deriving the change by hand; a merge conflict is resolved once, in the file, and the next release merges against the resolution. patches/ survives as documentation rather than mechanism, and is now generated: tools/refresh-patches.sh diffs the subtree against the pristine import and rewrites the directory, with --check for CI. It answers the question anyone auditing a fork asks first — what exactly did you change inside WordPress? — in a minute, which `git log wordpress/` cannot, because that log is mostly upstream imports. Generated documentation stays true; a hand-maintained record of a core diff drifts, and a stale one is worse than none because people trust it. One test change worth noting: the syntax sweep no longer walks all of wordpress/. It lints the fork's own PHP plus every core file patches/ says the fork touches, which keeps the suite at seven seconds instead of a minute while still covering the only core file that can break.
2026-09-21 03:19:28 +02:00
version, url, sha256, sha1, path = sys.argv[1:6]
fields = {
'WP_VERSION=': version,
'WP_URL=': url,
'WP_SHA256=': sha256,
'WP_SHA1=': sha1,
}
feat(sirius-press): a WordPress where the account is a key, not a mailbox WordPress makes two assumptions this project cannot accept: that identity comes from an email address, and that a site lives at one server. Both are things somebody else can take away — a mailbox is rented from a provider who can close it or be compelled to open it, and a server is one seizure from being gone. Sirius Press replaces the first and hedges the second. Signing in means signing a challenge with the key that controls a CashAddress. The address is recovered from the signature, so nothing is typed but the signature itself, and the result is an ordinary WordPress session cookie — roles, capabilities, nonces and the REST API never learn the login was different. Three ways to produce one: a wallet the browser already exposes, a phrase used once in the page and wiped, or a signature pasted in from any BIP-137 wallet, which needs no JavaScript and lets the key stay on a machine that never touches the web. There is no password reset, and the recovery page says so plainly rather than offering a form that cannot work. A reset mechanism is by construction a way to take an account from its owner, and it is always easier to attack than the cryptography it bypasses. Publishing a post also exports it as static HTML to the name's storage on Sia, signed by the key that owns the name, so the site keeps answering when the server does not. Email as a feature is untouched. wp_mail() still works, SMTP still sends, and contact forms still deliver to addresses real people typed. Only mail to the site's own unroutable placeholder addresses is diverted to an in-app inbox. The objection was to email as identity, not to email. Core is pinned and patched rather than vendored. WordPress 7.1.1 is 149 MB and 5,008 files; the fork's entire core diff is 75 lines in wp-admin/install.php. Carrying the former to express the latter would bury the patch where nobody reviews it and make every clone of the monorepo pay for it. Upstream releases still merge through tools/update-wordpress.sh, which reapplies the series and says exactly which hunk needs a human. The cryptography is implemented twice — PHP on the server, JavaScript in the page — because the server must verify and the browser must sign. Both are pinned against libauth, the library the Sirius portal wallet and the BNS gateway already use, so a disagreement of one byte fails the test suite rather than presenting as a rejected login at three in the morning. 132 checks, no framework, about a second.
2026-09-21 01:39:38 +02:00
out = []
for line in io.open(path, encoding='utf-8'):
build(sirius-press): build from the vendored subtree instead of a download The subtree is in place, so everything that used to fetch and patch core at build time now just copies it. tools/build.sh copies wordpress/ — no download, no checksum step, because there is nothing to fetch and nothing to trust that is not already in the repository docker/Dockerfile COPY wordpress/ instead of curl + sha256 + patch; the build args and the `patch` package are gone docker-compose.yml no WP_VERSION / WP_URL / WP_SHA256 to keep in step tools/update-wordpress.sh is rewritten around what the subtree makes possible. It imports the pristine release onto sirius-press/wordpress-upstream and then `git subtree merge`s that branch, which three-way merges upstream against the fork's own commit. A patch either applies with fuzz and hopes or fails and leaves you re-deriving the change by hand; a merge conflict is resolved once, in the file, and the next release merges against the resolution. patches/ survives as documentation rather than mechanism, and is now generated: tools/refresh-patches.sh diffs the subtree against the pristine import and rewrites the directory, with --check for CI. It answers the question anyone auditing a fork asks first — what exactly did you change inside WordPress? — in a minute, which `git log wordpress/` cannot, because that log is mostly upstream imports. Generated documentation stays true; a hand-maintained record of a core diff drifts, and a stale one is worse than none because people trust it. One test change worth noting: the syntax sweep no longer walks all of wordpress/. It lints the fork's own PHP plus every core file patches/ says the fork touches, which keeps the suite at seven seconds instead of a minute while still covering the only core file that can break.
2026-09-21 03:19:28 +02:00
for key, value in fields.items():
if line.startswith(key):
line = f'{key}{value}\n'
break
out.append(line)
feat(sirius-press): a WordPress where the account is a key, not a mailbox WordPress makes two assumptions this project cannot accept: that identity comes from an email address, and that a site lives at one server. Both are things somebody else can take away — a mailbox is rented from a provider who can close it or be compelled to open it, and a server is one seizure from being gone. Sirius Press replaces the first and hedges the second. Signing in means signing a challenge with the key that controls a CashAddress. The address is recovered from the signature, so nothing is typed but the signature itself, and the result is an ordinary WordPress session cookie — roles, capabilities, nonces and the REST API never learn the login was different. Three ways to produce one: a wallet the browser already exposes, a phrase used once in the page and wiped, or a signature pasted in from any BIP-137 wallet, which needs no JavaScript and lets the key stay on a machine that never touches the web. There is no password reset, and the recovery page says so plainly rather than offering a form that cannot work. A reset mechanism is by construction a way to take an account from its owner, and it is always easier to attack than the cryptography it bypasses. Publishing a post also exports it as static HTML to the name's storage on Sia, signed by the key that owns the name, so the site keeps answering when the server does not. Email as a feature is untouched. wp_mail() still works, SMTP still sends, and contact forms still deliver to addresses real people typed. Only mail to the site's own unroutable placeholder addresses is diverted to an in-app inbox. The objection was to email as identity, not to email. Core is pinned and patched rather than vendored. WordPress 7.1.1 is 149 MB and 5,008 files; the fork's entire core diff is 75 lines in wp-admin/install.php. Carrying the former to express the latter would bury the patch where nobody reviews it and make every clone of the monorepo pay for it. Upstream releases still merge through tools/update-wordpress.sh, which reapplies the series and says exactly which hunk needs a human. The cryptography is implemented twice — PHP on the server, JavaScript in the page — because the server must verify and the browser must sign. Both are pinned against libauth, the library the Sirius portal wallet and the BNS gateway already use, so a disagreement of one byte fails the test suite rather than presenting as a rejected login at three in the morning. 132 checks, no framework, about a second.
2026-09-21 01:39:38 +02:00
io.open(path, 'w', encoding='utf-8', newline='').write(''.join(out))
PY
build(sirius-press): build from the vendored subtree instead of a download The subtree is in place, so everything that used to fetch and patch core at build time now just copies it. tools/build.sh copies wordpress/ — no download, no checksum step, because there is nothing to fetch and nothing to trust that is not already in the repository docker/Dockerfile COPY wordpress/ instead of curl + sha256 + patch; the build args and the `patch` package are gone docker-compose.yml no WP_VERSION / WP_URL / WP_SHA256 to keep in step tools/update-wordpress.sh is rewritten around what the subtree makes possible. It imports the pristine release onto sirius-press/wordpress-upstream and then `git subtree merge`s that branch, which three-way merges upstream against the fork's own commit. A patch either applies with fuzz and hopes or fails and leaves you re-deriving the change by hand; a merge conflict is resolved once, in the file, and the next release merges against the resolution. patches/ survives as documentation rather than mechanism, and is now generated: tools/refresh-patches.sh diffs the subtree against the pristine import and rewrites the directory, with --check for CI. It answers the question anyone auditing a fork asks first — what exactly did you change inside WordPress? — in a minute, which `git log wordpress/` cannot, because that log is mostly upstream imports. Generated documentation stays true; a hand-maintained record of a core diff drifts, and a stale one is worse than none because people trust it. One test change worth noting: the syntax sweep no longer walks all of wordpress/. It lints the fork's own PHP plus every core file patches/ says the fork touches, which keeps the suite at seven seconds instead of a minute while still covering the only core file that can break.
2026-09-21 03:19:28 +02:00
if [ -x "$here/tools/refresh-patches.sh" ]; then
say "refreshing patches/ so it still describes the fork's core diff"
feat(sirius-press): take WordPress 7.1.2, and fix what that exposed The first real upstream release since the subtree landed, and the point of the whole arrangement. It merged cleanly: 7.1.2 changes about.php, template.php and version.php, none of which this fork touches, so the patched installer came through byte-identical and there was nothing to resolve. Getting there needed two fixes to the tool, both of which only a real release could have found — the earlier same-version run was a no-op that exercised none of this. **The prefix was an absolute path.** `${here#"$repo"/}` assumes the two strings share a spelling, and on Windows they do not: --show-toplevel answers "D:/Dev/…" while $PWD is "/d/Dev/…", so the subtraction left the path untouched and `git subtree merge --prefix` was handed something absolute. The same bug was fixed in refresh-patches.sh a few commits ago; this is the other copy of it. Both now ask git via `rev-parse --show-prefix`. **git-subtree refuses to run in a dirty repository** — any modification anywhere, not just under the subtree. In a monorepo shared with other work that is the normal state, so the tool was unusable exactly where it lives. The merge now happens in a scratch worktree, which is clean by construction, and comes back as one ordinary merge commit that touches only wordpress/ and so does not care what else is modified. Also: a failed run no longer refuses to retry. The import onto the upstream branch is idempotent now, and the failure message distinguishes "upstream and the fork changed the same lines" from "the merge could not start", instead of blaming a conflict for both.
2026-09-22 20:18:45 +02:00
"$here/tools/refresh-patches.sh" >/dev/null || warn "could not refresh patches/ — do it by hand"
build(sirius-press): build from the vendored subtree instead of a download The subtree is in place, so everything that used to fetch and patch core at build time now just copies it. tools/build.sh copies wordpress/ — no download, no checksum step, because there is nothing to fetch and nothing to trust that is not already in the repository docker/Dockerfile COPY wordpress/ instead of curl + sha256 + patch; the build args and the `patch` package are gone docker-compose.yml no WP_VERSION / WP_URL / WP_SHA256 to keep in step tools/update-wordpress.sh is rewritten around what the subtree makes possible. It imports the pristine release onto sirius-press/wordpress-upstream and then `git subtree merge`s that branch, which three-way merges upstream against the fork's own commit. A patch either applies with fuzz and hopes or fails and leaves you re-deriving the change by hand; a merge conflict is resolved once, in the file, and the next release merges against the resolution. patches/ survives as documentation rather than mechanism, and is now generated: tools/refresh-patches.sh diffs the subtree against the pristine import and rewrites the directory, with --check for CI. It answers the question anyone auditing a fork asks first — what exactly did you change inside WordPress? — in a minute, which `git log wordpress/` cannot, because that log is mostly upstream imports. Generated documentation stays true; a hand-maintained record of a core diff drifts, and a stale one is worse than none because people trust it. One test change worth noting: the syntax sweep no longer walks all of wordpress/. It lints the fork's own PHP plus every core file patches/ says the fork touches, which keeps the suite at seven seconds instead of a minute while still covering the only core file that can break.
2026-09-21 03:19:28 +02:00
fi
feat(sirius-press): a WordPress where the account is a key, not a mailbox WordPress makes two assumptions this project cannot accept: that identity comes from an email address, and that a site lives at one server. Both are things somebody else can take away — a mailbox is rented from a provider who can close it or be compelled to open it, and a server is one seizure from being gone. Sirius Press replaces the first and hedges the second. Signing in means signing a challenge with the key that controls a CashAddress. The address is recovered from the signature, so nothing is typed but the signature itself, and the result is an ordinary WordPress session cookie — roles, capabilities, nonces and the REST API never learn the login was different. Three ways to produce one: a wallet the browser already exposes, a phrase used once in the page and wiped, or a signature pasted in from any BIP-137 wallet, which needs no JavaScript and lets the key stay on a machine that never touches the web. There is no password reset, and the recovery page says so plainly rather than offering a form that cannot work. A reset mechanism is by construction a way to take an account from its owner, and it is always easier to attack than the cryptography it bypasses. Publishing a post also exports it as static HTML to the name's storage on Sia, signed by the key that owns the name, so the site keeps answering when the server does not. Email as a feature is untouched. wp_mail() still works, SMTP still sends, and contact forms still deliver to addresses real people typed. Only mail to the site's own unroutable placeholder addresses is diverted to an in-app inbox. The objection was to email as identity, not to email. Core is pinned and patched rather than vendored. WordPress 7.1.1 is 149 MB and 5,008 files; the fork's entire core diff is 75 lines in wp-admin/install.php. Carrying the former to express the latter would bury the patch where nobody reviews it and make every clone of the monorepo pay for it. Upstream releases still merge through tools/update-wordpress.sh, which reapplies the series and says exactly which hunk needs a human. The cryptography is implemented twice — PHP on the server, JavaScript in the page — because the server must verify and the browser must sign. Both are pinned against libauth, the library the Sirius portal wallet and the BNS gateway already use, so a disagreement of one byte fails the test suite rather than presenting as a rejected login at three in the morning. 132 checks, no framework, about a second.
2026-09-21 01:39:38 +02:00
cat <<EOF
$(printf '\033[32mSirius Press now builds on WordPress %s.\033[0m' "$VERSION")
build(sirius-press): build from the vendored subtree instead of a download The subtree is in place, so everything that used to fetch and patch core at build time now just copies it. tools/build.sh copies wordpress/ — no download, no checksum step, because there is nothing to fetch and nothing to trust that is not already in the repository docker/Dockerfile COPY wordpress/ instead of curl + sha256 + patch; the build args and the `patch` package are gone docker-compose.yml no WP_VERSION / WP_URL / WP_SHA256 to keep in step tools/update-wordpress.sh is rewritten around what the subtree makes possible. It imports the pristine release onto sirius-press/wordpress-upstream and then `git subtree merge`s that branch, which three-way merges upstream against the fork's own commit. A patch either applies with fuzz and hopes or fails and leaves you re-deriving the change by hand; a merge conflict is resolved once, in the file, and the next release merges against the resolution. patches/ survives as documentation rather than mechanism, and is now generated: tools/refresh-patches.sh diffs the subtree against the pristine import and rewrites the directory, with --check for CI. It answers the question anyone auditing a fork asks first — what exactly did you change inside WordPress? — in a minute, which `git log wordpress/` cannot, because that log is mostly upstream imports. Generated documentation stays true; a hand-maintained record of a core diff drifts, and a stale one is worse than none because people trust it. One test change worth noting: the syntax sweep no longer walks all of wordpress/. It lints the fork's own PHP plus every core file patches/ says the fork touches, which keeps the suite at seven seconds instead of a minute while still covering the only core file that can break.
2026-09-21 03:19:28 +02:00
${CURRENT} -> ${VERSION}
feat(sirius-press): take WordPress 7.1.2, and fix what that exposed The first real upstream release since the subtree landed, and the point of the whole arrangement. It merged cleanly: 7.1.2 changes about.php, template.php and version.php, none of which this fork touches, so the patched installer came through byte-identical and there was nothing to resolve. Getting there needed two fixes to the tool, both of which only a real release could have found — the earlier same-version run was a no-op that exercised none of this. **The prefix was an absolute path.** `${here#"$repo"/}` assumes the two strings share a spelling, and on Windows they do not: --show-toplevel answers "D:/Dev/…" while $PWD is "/d/Dev/…", so the subtraction left the path untouched and `git subtree merge --prefix` was handed something absolute. The same bug was fixed in refresh-patches.sh a few commits ago; this is the other copy of it. Both now ask git via `rev-parse --show-prefix`. **git-subtree refuses to run in a dirty repository** — any modification anywhere, not just under the subtree. In a monorepo shared with other work that is the normal state, so the tool was unusable exactly where it lives. The merge now happens in a scratch worktree, which is clean by construction, and comes back as one ordinary merge commit that touches only wordpress/ and so does not care what else is modified. Also: a failed run no longer refuses to retry. The import onto the upstream branch is idempotent now, and the failure message distinguishes "upstream and the fork changed the same lines" from "the merge could not start", instead of blaming a conflict for both.
2026-09-22 20:18:45 +02:00
The subtree merge is committed. tools/wordpress.lock and patches/ are changed
but not committed — look at them, then commit. Before pushing:
feat(sirius-press): a WordPress where the account is a key, not a mailbox WordPress makes two assumptions this project cannot accept: that identity comes from an email address, and that a site lives at one server. Both are things somebody else can take away — a mailbox is rented from a provider who can close it or be compelled to open it, and a server is one seizure from being gone. Sirius Press replaces the first and hedges the second. Signing in means signing a challenge with the key that controls a CashAddress. The address is recovered from the signature, so nothing is typed but the signature itself, and the result is an ordinary WordPress session cookie — roles, capabilities, nonces and the REST API never learn the login was different. Three ways to produce one: a wallet the browser already exposes, a phrase used once in the page and wiped, or a signature pasted in from any BIP-137 wallet, which needs no JavaScript and lets the key stay on a machine that never touches the web. There is no password reset, and the recovery page says so plainly rather than offering a form that cannot work. A reset mechanism is by construction a way to take an account from its owner, and it is always easier to attack than the cryptography it bypasses. Publishing a post also exports it as static HTML to the name's storage on Sia, signed by the key that owns the name, so the site keeps answering when the server does not. Email as a feature is untouched. wp_mail() still works, SMTP still sends, and contact forms still deliver to addresses real people typed. Only mail to the site's own unroutable placeholder addresses is diverted to an in-app inbox. The objection was to email as identity, not to email. Core is pinned and patched rather than vendored. WordPress 7.1.1 is 149 MB and 5,008 files; the fork's entire core diff is 75 lines in wp-admin/install.php. Carrying the former to express the latter would bury the patch where nobody reviews it and make every clone of the monorepo pay for it. Upstream releases still merge through tools/update-wordpress.sh, which reapplies the series and says exactly which hunk needs a human. The cryptography is implemented twice — PHP on the server, JavaScript in the page — because the server must verify and the browser must sign. Both are pinned against libauth, the library the Sirius portal wallet and the BNS gateway already use, so a disagreement of one byte fails the test suite rather than presenting as a rejected login at three in the morning. 132 checks, no framework, about a second.
2026-09-21 01:39:38 +02:00
tests/run.sh
tools/build.sh
then walk through wp-admin/install.php once — the setup wizard is the only
build(sirius-press): build from the vendored subtree instead of a download The subtree is in place, so everything that used to fetch and patch core at build time now just copies it. tools/build.sh copies wordpress/ — no download, no checksum step, because there is nothing to fetch and nothing to trust that is not already in the repository docker/Dockerfile COPY wordpress/ instead of curl + sha256 + patch; the build args and the `patch` package are gone docker-compose.yml no WP_VERSION / WP_URL / WP_SHA256 to keep in step tools/update-wordpress.sh is rewritten around what the subtree makes possible. It imports the pristine release onto sirius-press/wordpress-upstream and then `git subtree merge`s that branch, which three-way merges upstream against the fork's own commit. A patch either applies with fuzz and hopes or fails and leaves you re-deriving the change by hand; a merge conflict is resolved once, in the file, and the next release merges against the resolution. patches/ survives as documentation rather than mechanism, and is now generated: tools/refresh-patches.sh diffs the subtree against the pristine import and rewrites the directory, with --check for CI. It answers the question anyone auditing a fork asks first — what exactly did you change inside WordPress? — in a minute, which `git log wordpress/` cannot, because that log is mostly upstream imports. Generated documentation stays true; a hand-maintained record of a core diff drifts, and a stale one is worse than none because people trust it. One test change worth noting: the syntax sweep no longer walks all of wordpress/. It lints the fork's own PHP plus every core file patches/ says the fork touches, which keeps the suite at seven seconds instead of a minute while still covering the only core file that can break.
2026-09-21 03:19:28 +02:00
file this fork patches, so it is the only thing this can have broken.
feat(sirius-press): a WordPress where the account is a key, not a mailbox WordPress makes two assumptions this project cannot accept: that identity comes from an email address, and that a site lives at one server. Both are things somebody else can take away — a mailbox is rented from a provider who can close it or be compelled to open it, and a server is one seizure from being gone. Sirius Press replaces the first and hedges the second. Signing in means signing a challenge with the key that controls a CashAddress. The address is recovered from the signature, so nothing is typed but the signature itself, and the result is an ordinary WordPress session cookie — roles, capabilities, nonces and the REST API never learn the login was different. Three ways to produce one: a wallet the browser already exposes, a phrase used once in the page and wiped, or a signature pasted in from any BIP-137 wallet, which needs no JavaScript and lets the key stay on a machine that never touches the web. There is no password reset, and the recovery page says so plainly rather than offering a form that cannot work. A reset mechanism is by construction a way to take an account from its owner, and it is always easier to attack than the cryptography it bypasses. Publishing a post also exports it as static HTML to the name's storage on Sia, signed by the key that owns the name, so the site keeps answering when the server does not. Email as a feature is untouched. wp_mail() still works, SMTP still sends, and contact forms still deliver to addresses real people typed. Only mail to the site's own unroutable placeholder addresses is diverted to an in-app inbox. The objection was to email as identity, not to email. Core is pinned and patched rather than vendored. WordPress 7.1.1 is 149 MB and 5,008 files; the fork's entire core diff is 75 lines in wp-admin/install.php. Carrying the former to express the latter would bury the patch where nobody reviews it and make every clone of the monorepo pay for it. Upstream releases still merge through tools/update-wordpress.sh, which reapplies the series and says exactly which hunk needs a human. The cryptography is implemented twice — PHP on the server, JavaScript in the page — because the server must verify and the browser must sign. Both are pinned against libauth, the library the Sirius portal wallet and the BNS gateway already use, so a disagreement of one byte fails the test suite rather than presenting as a rejected login at three in the morning. 132 checks, no framework, about a second.
2026-09-21 01:39:38 +02:00
EOF
Reference in a new issue Copy permalink