Core checksums not available for some locales/versions

[chesio]

Hi,

Since release of version 5.0.1 (and 4.9.9 etc.) 5 days ago, ​https://api.wordpress.org/core/checksums/1.0/?version=4.9.9&locale=de_DE returns just:

{"checksums":false}

I have core integrity monitoring active on several sites that now fails because of missing checksums. Does checksums generation take so long? I do not recall having this problem with any previous release of WordPress.

[dd32]

Checksums are available until the relevant WordPress package is generated, in the case of the de_DE package, the 4.9.9 package wasn't generated until 2018 Dec 18 22:00 (I'm assuming UTC time) where as the 5.0.1 package was generated at 2018 Dec 15 14:01.

I'm not sure what tool you're using for the monitoring, but note that for minor releases, WordPress auto-updates using the English packages which will almost always be generated (and installed) prior to localised builds being made available, so tools should fall back to using the https://api.wordpress.org/core/checksums/1.0/?version=4.9.9 API when the localised variant isn't available with the built-in-smarts to know that readme.html and wp-config-sample.php may differ in checksums at that time (plus a handful of others - sometimes, varies on locale I think?).

I'm going to mark this as worksforme as the API is working correctly per it's design, but with the acknowledgement that it's not perfectly useful to be used in a monitoring situation given the limitations and data-source it's using given the variety of packages that get used for WordPress updates.

[chesio]

Hi,

thanks for the clarification! I'm using a custom made script, so I guess I'll just extend it to fall back to checksums for default locale as you suggested and possibly ignore problematic files like readme.html etc.