Skip to content

Update Reprint to 0.11.0 and drop the export window - #12

Merged
fredrikekelund merged 11 commits into
trunkfrom
remove-export-window
Oct 12, 2026
Merged

fredrikekelund merged 11 commits into
trunkfrom
remove-export-window

Conversation

@fredrikekelund

@fredrikekelund fredrikekelund commented Oct 12, 2026 •

Copy link
Copy Markdown
Contributor

Reprint 0.11.0

Reprint 0.11.0 (WordPress/reprint#849, #862) changes authentication:

  • On hosts with openssl_verify(), shared secrets are no longer accepted. Keys only.
  • Secret signatures cover the method and request target, not the body.
  • Plugins that write their own error JSON must include "auth_version": 2, or the 0.11 client reports the plugin as outdated.

Exporter::error() now adds auth_version to every error body. The new no_keys_enrolled reason answers 503, as not_configured does, matching the upstream plugin.

No export window

This plugin is removed once its one migration is done, and Reprint now authenticates with public keys, so the export window inherited from Jetpack adds nothing. A valid credential now turns the exporter on.

  • POST …/reprint/enable-export is removed. WordPress.com only needs install-public-key or rotate-export-secret.
  • The manual screen loses its on/off checkbox.
  • The Set up by WordPress.com mode is gone. Site ready to migrate now reads:

    example.com is ready to migrate. The migration runs from WordPress.com, so there's nothing else to do here. Your site stays online and unchanged while it's copied.

    Keep this plugin active until the migration is done. We'll email you when it's finished.

🤖 Generated with Claude Code

fredrikekelund and others added 11 commits October 12, 2026 09:30
Reprint 0.11.0 refuses shared secrets on hosts with OpenSSL and expects
every error body to carry auth_version 2. The exporter adds it, and answers
no_keys_enrolled with a 503, as it does not_configured.

The plugin is installed for one migration and removed after it, and
Reprint now verifies public keys, so the hour-long export window adds
nothing. A valid credential turns the exporter on: the enabled options,
the enable-export route, the manual on/off checkbox and the "Set up by
WordPress.com" mode are gone. The "Site ready to migrate" mode takes the
site address sentence from it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Where Reprint requires keys, the screen offers the public key form and
refuses a posted secret; elsewhere it offers the secret form, as it
already refused a posted key. The screen e2e scenario splits in two:
screen for keys, screen-hmac for secrets.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A secret on a host that requires keys, or a key on one that cannot verify
them, no longer makes the site read as ready to migrate: the screens and
the export endpoint treat it as no credential.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Playground downloads wp-cli.phar from playground.wordpress.net for any
blueprint with an enableMultisite step, and that download fails on CI
from time to time. The multisite blueprint now calls install_network()
and populate_network() itself and writes the constants with
defineWpConfigConsts.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Describe each screen before the main screen flag that decides which one
gets the sidebar row, and say plainly how WordPress.com reaches the
provisioning routes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Its paragraphs go through wptexturize() before esc_html(), so the
strings keep plain apostrophes and the screen shows typographic ones.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
It is a debugging screen, not one users are sent to.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Drop the event hooks line, which only matters to someone writing a
listener and is documented where the hooks fire, and the https
limitation, which the client enforces rather than this plugin. Name the
Jetpack connection package.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Loading the package from both plugins cannot fatal: compat.php declares
nothing, and HTTPServer::serve() loads export.php only once.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@fredrikekelund
fredrikekelund merged commit 0ef525b into trunk Oct 12, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant