Talk Devy to Me WPM With Lovekesh Kumar - CourtneyR.dev's 2nd Brain

Talk Devy to Me: WPM With Lovekesh Kumar ![rw-book-cover](https://img.youtube.com/vi/Cy6JgeSOuLA/maxresdefault.jpg) 🔗 **Source:** [Talk Devy to Me: WPM With Lovekesh Kumar](https://www.youtube.com/watch?v=Cy6JgeSOuLA) > [!note]+ Document Notes > tags: [wordpress-development, package-management, developer-tools, supply-chain-security, plugin-distribution] > author: [MISSING] > source: YouTube > reference: https://www.youtube.com/watch?v=Cy6JgeSOuLA > date created: {{date:YYYY-MM-DD}} {{time:HH:mm}} > > # 🏷️ Title: Talk Devy To Me: wpm with Lovekesh Kumar >  ## 🧭 Table of Contents - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#️-notes) - [📚 References](#-references) - [🗣️ Paraphrase](#️-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB Assessment](#-deib-assessment) - [✅ Logical Validity](#-logical-validity) - [🛡️ DARVO Analysis](#-darvo-analysis) - [🎯 Conclusion](#-conclusion) ## 📝 Summary - **What happened:** Lovekesh Kumar introduced WPM (WordPress Package Manager), a new tool designed to manage WordPress plugins and themes similar to how npm manages JavaScript packages - **Why it matters:** Current WordPress dependency management is fragmented, with no unified way to handle private plugins, verify package integrity, or manage dependencies automatically - **Key stakeholders:** Enterprise WordPress developers, agencies, WordPress VIP users, plugin/theme vendors - **Risks and tradeoffs:** Adds another tool to the ecosystem; requires adoption by vendors; centralized registry dependency - **Bottom line:** WPM aims to solve WordPress's package management gaps with security-first approach and dependency resolution ## 📖 Main Content WPM (WordPress Package Manager) is a new tool that brings npm-like package management to WordPress plugins and themes. Created by Lovekesh Kumar, it addresses several pain points in the WordPress development ecosystem. ### Core Problems WPM Solves **Fragmented Distribution:** Unlike JavaScript's npm ecosystem, WordPress has no unified package management. Public plugins use WordPress.org, premium plugins have vendor-specific APIs or manual downloads, and private plugins require custom solutions. **Manual Dependency Management:** WordPress plugins with dependencies (like WooCommerce extensions requiring WooCommerce) don't automatically resolve dependencies. Developers must manually track and install prerequisite plugins. **Security Gaps:** Current distribution methods lack cryptographic verification. If a vendor's site is compromised, users can unknowingly download malicious code with no way to verify package integrity. **Enterprise Workflow Friction:** Large WordPress installations require managing plugins as code rather than through the dashboard. This involves manually downloading, unzipping, and committing plugin files to repositories, bloating git repos and complicating updates. ### How WPM Works WPM operates as both a CLI tool and package registry. It automatically mirrors WordPress.org plugins every 15 minutes, creating cryptographically signed tarballs with verification metadata. The system uses: - **Dependency Resolution:** Automatically installs required plugins (e.g., installing a WooCommerce extension automatically includes WooCommerce) - **Cryptographic Verification:** Uses AWS KMS-backed private keys to sign packages, preventing supply chain attacks - **Version Management:** Supports specific version installation and tracks dependency trees - **Development Dependencies:** Separates production plugins from development-only tools (like Query Monitor) ### Security Architecture The security model prevents tampering through multiple layers: - Cryptographic signatures using hardware security modules (HSM) - Publisher verification through GitHub/GitLab OIDC integration - Software Bill of Materials (SBOM) attestation - Provenance tracking showing where and how packages were built ## 🗒️ Notes #### ⏱️ [00:00:00](https://www.youtube.com/watch?v=Cy6JgeSOuLA?t=0) Introduction and Context - WPM introduced at WordCamp Asia as "npm for WordPress" - Focus on package management and registry functionality - Addresses enterprise WordPress development needs #### ⏱️ [00:03:12](https://www.youtube.com/watch?v=Cy6JgeSOuLA?t=192) Problem Definition - WordPress lacks unified package management unlike JavaScript ecosystem - Current solutions require manual processes for updates and distribution - Enterprise environments can't use dashboard-based plugin installation #### ⏱️ [00:08:45](https://www.youtube.com/watch?v=Cy6JgeSOuLA?t=525) Security Concerns - No verification mechanism for downloaded plugins - Vendor site compromises can inject malicious code - Supply chain attacks possible without cryptographic verification #### ⏱️ [00:15:30](https://www.youtube.com/watch?v=Cy6JgeSOuLA?t=930) Live Demonstration - Installation: `wpm install advanced-query-loop` - Dependency resolution shown with Elementor + Dino Pack example - Version-specific installation: `wpm install package@version` #### ⏱️ [00:25:20](https://www.youtube.com/watch?v=Cy6JgeSOuLA?t=1520) Development Dependencies - Separate dev dependencies (Query Monitor) from production plugins - `wpm install --save-dev query-monitor` for development-only tools - Production installs exclude dev dependencies automatically #### ⏱️ [00:30:00](https://www.youtube.com/watch?v=Cy6JgeSOuLA?t=1800) Registry Architecture - 15-minute cron jobs sync WordPress.org SVN repository - Automatic tarball creation with cryptographic signatures - HSM-backed signing prevents private key compromise ## 📚 References - [WPM.so](https://wpm.so) - Main website and documentation - [WP2WPM GitHub Repository](https://github.com/wpmio/wp2wpm) - Automation system for WordPress.org mirroring - WordPress.org Plugin Directory - Source for public plugin mirroring - WP-CLI - Existing WordPress command-line tool for comparison ## 🗣️ Paraphrase WPM represents an attempt to bring modern package management practices to WordPress development. While WordPress has grown into a sophisticated development platform, its tooling has lagged behind other ecosystems. The fragmented nature of plugin distribution—spanning WordPress.org, vendor-specific systems, and manual processes—creates friction for professional development workflows. The security focus addresses real concerns in an ecosystem where supply chain attacks have become increasingly common. By implementing cryptographic verification and provenance tracking, WPM aims to provide enterprise-grade assurance about package integrity. However, success depends on ecosystem adoption. For WPM to reach its potential, plugin vendors need to integrate with the system, and developers need compelling reasons to adopt another tool in their workflow. ## 📰 Newsletter 🔧 **New Tool Alert: WordPress Gets Its Own Package Manager** The WordPress development ecosystem just got a significant upgrade with WPM (WordPress Package Manager), a new tool that brings npm-style dependency management to plugins and themes. **What makes this interesting:** - **Automatic dependency resolution** - Install a WooCommerce extension and it automatically includes WooCommerce - **Enterprise-grade security** - Cryptographic verification prevents supply chain attacks - **Development workflow integration** - Manage WordPress dependencies as code, not through dashboards **Perfect for:** Agencies managing multiple client sites, enterprise WordPress installations, and developers who prefer infrastructure-as-code approaches. The tool automatically mirrors WordPress.org plugins with enhanced security features, while also supporting private and premium plugin distribution. Early adoption could streamline WordPress development workflows significantly. [Check out WPM.so](https://wpm.so) to explore the documentation and see if it fits your development process. ## ✅ Action Items #### DevRel - **Developer advocacy:** Create comparison guides showing WPM vs existing WordPress tooling workflows - **Education:** Develop workshops on secure WordPress package management practices - **Developer experience:** Document integration patterns with popular WordPress development tools - **Community management:** Establish feedback channels for enterprise WordPress developers #### WordPress - **Core:** Evaluate potential integration points for package management metadata in plugin headers - **Security:** Review WPM's security model for potential adoption of verification standards - **CLI:** Consider WP-CLI integration or compatibility with WPM workflows - **Plugins:** Document best practices for plugin authors to support dependency declarations #### Community - **Maintainers:** Evaluate adding WPM support to popular WordPress development boilerplates - **Contributors:** Test WPM integration with existing WordPress development workflows - **Ecosystem:** Create standards for WordPress package metadata and dependency declaration ## 🧪 Hypotheses - WPM adoption will correlate with enterprise WordPress usage patterns - Security-conscious organizations will drive initial adoption over convenience features - Plugin vendors will adopt WPM integration if it reduces support burden - Developer workflow improvements will outweigh tool complexity for target users - Automated dependency resolution will reduce WordPress project setup time significantly ### 📊 Methodology - **Adoption tracking:** Monitor WPM registry growth and CLI download metrics - **Developer surveys:** Quarterly feedback on WordPress tooling preferences and pain points - **Security analysis:** Audit cryptographic implementation and compare to industry standards - **Performance measurement:** Benchmark installation speed vs manual plugin management - **Enterprise case studies:** Document workflow improvements in controlled enterprise environments ### ❓ Questions - How will WPM handle WordPress.org plugin approval process integration? - What incentives exist for premium plugin vendors to adopt WPM distribution? - How does WPM's security model compare to other package managers? - What happens to WPM packages if the registry becomes unavailable? - How will WordPress hosting providers adapt to package manager workflows? ### 🔮 Future Research - Integration possibilities with WordPress hosting platforms - Potential for WordPress Core to adopt package management standards - Impact on WordPress.org plugin distribution statistics - Security audit of cryptographic implementation - Developer productivity measurements in WPM vs traditional workflows ### 💡 Implications - **Enterprise WordPress:** Could standardize dependency management across large WordPress installations - **Plugin Development:** May encourage better dependency documentation and modular plugin architecture - **Security Posture:** Raises security expectations for WordPress package distribution - **Developer Tooling:** Could catalyze broader WordPress development tool modernization - **Hosting Integration:** May drive hosting providers to support package manager workflows ### 🧠 Learning Styles Assessment Reading level: **College level** (Flesch-Kincaid ~13-15). Technical terminology and complex workflow descriptions require developer background. #### 👀 Visual learners - **Present:** Code examples, terminal output, dependency tree visualization - **Improve:** Architecture diagrams showing WPM vs traditional workflows, package verification flow charts #### 🔊 Aural learners - **Present:** Video demonstration with live coding and explanation - **Improve:** Audio-only version explaining concepts without visual dependency #### 🗣️ Verbal learners - **Present:** Clear analogies (npm for WordPress), technical definitions, step-by-step explanations - **Improve:** Glossary of package management terms, plain-language security explanations #### 🧩 Kinesthetic learners - **Present:** Live terminal demonstrations, installation commands, hands-on examples - **Improve:** Downloadable sandbox environment, guided tutorial with checkpoints #### 🧠 Logical learners - **Present:** Problem-solution structure, security architecture explanation, workflow comparisons - **Improve:** Decision matrix for adoption, formal security model documentation #### 🧑‍🤝‍🧑 Social learners - **Present:** Interview format, community discussion, collaborative problem-solving - **Improve:** Developer forum integration, peer review processes #### 🧘‍♀️ Solitary learners - **Present:** Comprehensive documentation links, self-paced exploration - **Improve:** Self-assessment checklist, independent project ideas #### 🌿 Naturalistic learners - **Present:** Ecosystem metaphors, organic tool evolution discussion - **Improve:** WordPress ecosystem health metrics, sustainable development practices ### 📊 Accessibility Assessment #### Screen reader semantics - **Present:** Clear heading structure, descriptive link text - **Improve:** Alt text for terminal screenshots, ARIA labels for complex interactions #### Keyboard navigation - **Present:** Standard video controls, text-based content - **Improve:** Keyboard shortcuts for video sections, skip links for long technical discussions #### Contrast and readability - **Present:** Standard text presentation - **Improve:** High contrast mode for code examples, larger font options #### Media and captions - **Present:** Video with clear audio - **Improve:** Full transcript with timestamps, closed captions, audio descriptions for visual demos ### 🌍 DEIB Assessment #### Cultural breadth - **Present:** English-only content, Western development practices - **Improve:** Multi-language documentation, global WordPress community examples #### Inclusive language - **Present:** Technical jargon with some explanation - **Improve:** Plain-language alternatives, expanded glossary #### Neurodiversity support - **Present:** Long-form discussion format - **Improve:** Content chunking, bullet-point summaries, consistent structure #### Representation - **Present:** Male-dominated discussion - **Improve:** Diverse developer perspectives, varied use case examples ### ✅ Logical Validity #### Strong reasoning - **Security necessity:** Well-articulated supply chain attack scenarios with concrete examples - **Workflow efficiency:** Clear demonstration of manual process friction and automated solutions - **Enterprise needs:** Logical connection between WordPress maturity and tooling requirements #### Fallacies - **Appeal to novelty:** Implies newer package management is inherently better without fully addressing existing tool limitations - **False dichotomy:** Presents WPM vs current methods without exploring hybrid approaches #### Tone of voice Professional and technical with collaborative undertones. Demonstrates genuine problem-solving intent rather than competitive positioning. ### 🛡️ DARVO Analysis No DARVO patterns detected. Discussion focuses on technical solutions rather than interpersonal dynamics. ## 🎯 Conclusion WPM addresses legitimate gaps in WordPress package management, particularly for enterprise development workflows. The security-first approach and dependency resolution features solve real problems that existing tools handle incompletely. Success will depend on ecosystem adoption—both from plugin vendors implementing WPM integration and developers incorporating it into their workflows. The tool's enterprise focus may limit initial adoption but could drive broader WordPress tooling modernization if it proves successful in that niche. For WordPress professionals managing complex deployments, WPM deserves evaluation as a potential workflow improvement, especially where security and dependency management are primary concerns. --- ## Full Transcript [00:01] All right. Hi everybody. Here we are. [00:03] We're here. We're here and I'm joined by [00:06] a special guest, a friend, [00:08] um, Love, the Love as he likes to go by. [00:12] Uh, we are here to talk about something [00:14] that Loveh talk told talked to me about [00:17] when I was in India at for word camp um, [00:20] Asia. That's the word camp and it is [00:22] called WPM.O. [00:24] So um, Love Cesh, why don't you tell us [00:27] about it? [00:28] >> Okay. So [00:31] um I just [00:33] uh like bring the attention of Ryan that [00:35] I have built something. I was just [00:37] gathering feedbacks from hopes around WC [00:40] issue. So I shared uh something I [00:43] created. It's called WPM. It's like npm [00:46] but it's for WordPress. So it's a [00:49] package manager and also a registry. So, [00:52] I talked about it with Ryan at WCAC and [00:55] he asked me whether I want to come on [00:57] this live streaming and I said yes and [01:00] here we are. [01:02] >> Nice. Yeah, that's that's literally the [01:04] step by step of how you got here. That's [01:06] fantastic. Um I just dropped the link u [01:09] in in in chat. I don't know why Bales of [01:11] Fate is showing up there, but um we I [01:14] dropped WPM.so into the chat. So, go go [01:18] go and check that out. But let me ask [01:19] you, so what what what what does this [01:21] thing do? Tell me what this does. Tell [01:23] me why I should care about it and [01:25] pretend like I've never seen it before. [01:28] >> Okay. So, um let's not talk about uh [01:31] WordPress here. Let's talk about uh uh I [01:35] think everyone have played around React [01:39] since Gutenberg is in React and when you [01:41] go to set up blocks, what is the first [01:44] thing that you do? So maybe the first [01:46] thing that you do is you [01:49] uh run a command something like npmx [01:51] create WordPress block or something like [01:53] this something like that and it [01:55] bootstraps the uh like a block scaffold [01:59] on your [02:00] >> in your folder is what you're talking [02:02] about. [02:02] >> Yeah. Now now imagine that think about [02:05] it for a moment that how it's happening [02:08] in that particular ecosystem and do we [02:11] have any similar tooling in WordPress [02:12] ecosystem or not. So in JavaScript [02:16] ecosystem you have like package manager [02:19] a task runner everything combined in one [02:21] tool and it's called npm. Now there are [02:24] faster alternatives to npm as well in [02:26] case folks are using maybe pnpm or bun. [02:29] So these are like like package manager. [02:31] So what they just do is that you [02:34] distribute your package. So so the core [02:36] idea is you build something and now you [02:38] want that okay I want to distribute it [02:40] to other people so that they can just [02:41] download it and use it easily. [02:44] So they distributed some a place called [02:46] registry. You will send your package to [02:48] a registry. And now npm cli will just [02:51] download it from anywhere else. So the [02:53] ecosystem is like very seamless. You can [02:56] download for example any npm package. So [02:59] I can like remind you any package that [03:01] starts with at the rate WordPress is npm [03:04] package for WordPress. You can just [03:05] download it anytime anywhere without any [03:08] problem. you just don't have to worry [03:11] about like u wiring up in a like manual [03:15] way in your CI/CD you don't do that [03:17] there is like enough mature tooling [03:19] around that but if you want same sort of [03:21] experience in WordPress then how will [03:25] you do it do you have the required tools [03:28] also when it comes to like distributing [03:32] your things there is like very popular [03:35] thing we are using I think for more than [03:38] 18 or 20 years that is called [03:39] WordPress.org plug-in and theme [03:42] distribution. But the thing is that it's [03:44] for it's mainly for public plug-in and [03:46] themes and you have to get approvals to [03:50] register your plug-in and from there and [03:51] then you can start distributing them. [03:54] But again, it works seamlessly with the [03:56] WordPress dashboard itself. For example, [03:58] the plugins and themes pages uh in the [04:01] WordPress admin. But what about uh the [04:05] people that are managing their WordPress [04:07] as code? When I say WordPress as code, [04:10] it means that you push everything to [04:13] your server including plug-in and themes [04:15] as code rather than downloading plug-in [04:17] and themes from the WordPress dashboard. [04:20] So [04:20] >> okay [04:21] >> then uh like few years back someone [04:23] created WP package list. So what [04:26] basically that was is that [04:28] >> someone created a composer layer on top [04:30] of WordPress.org. Now you can download [04:32] the those packages using composer tool. [04:34] So composer is another package manager [04:37] just like npm but it's for PHP [04:39] ecosystem. [04:41] But now again the problem is that you [04:43] can easily handle your plug-in and [04:46] themes that are published on [04:48] WordPress.org. [04:50] But what about plug-in and themes that [04:51] are not on WordPress or they are like a [04:54] scattered somewhere maybe on GitHub, [04:56] GitLab. Uh many of many plug-in and [04:58] themes are private. So every vendors [05:01] give you like their own API to download [05:04] that plug-in or theme and you have to [05:06] wire up those API maybe in your [05:08] automation script or something like that [05:10] to download the chips then unpack it. So [05:12] there is like a whole gap when we talk [05:15] about tooling in WordPress ecosystem. So [05:18] I I I basically mostly work on [05:20] enterprise WordPress. Uh and that [05:24] consist of like very strict processes [05:25] how we do things. For example, we just [05:27] can't go to a WordPress site, go to the [05:30] dashboard and just install a plug-in or [05:32] theme we want to. We just can't do it [05:34] that way because many of our clients are [05:36] on WordPress VIP. WordPress VIP wouldn't [05:39] allow that because there are like lot of [05:42] uh security considerations there and [05:44] other things. So, generally what people [05:47] do is most of the time they just [05:48] download the plug-in either from [05:50] WordPress.org or maybe from a premium [05:54] vendor. they will just unzip it in their [05:56] git repo commit and push it and now we [05:58] are all done. But the problems comes [06:01] when you have to update that particular [06:03] plug-in and themes and suppose that your [06:06] plug-in and theme has thousand of files. [06:08] Now you have to unpack that and commit [06:10] that you're basically what you are just [06:12] doing is you're bloating your git repo [06:15] >> and again [06:16] >> that makes sense. I can see a lot of [06:17] people like [06:18] >> having worked in agency land my myself I [06:22] know exactly what that's like and you [06:23] know the files that you're downloading [06:25] from.org or for example, [06:26] >> yeah, [06:27] >> may not have the source files and [06:29] especially because we we live in a world [06:30] that's that's, you know, JavaScript [06:32] first now. Uh, you know, you might just [06:34] be parsing through like, you know, [06:36] obuscated minified JavaScript trying to [06:38] search for security issues and I know I [06:40] know VIP is not a big fan of doing that. [06:42] So, [06:42] >> yeah. [06:43] >> Uh, cool. Okay. Awesome. Yeah. So that [06:45] is a so so the first question that comes [06:49] to mind [06:50] >> and and and and the first comment in [06:52] chat was like so like composer and that [06:54] was before you started talking about [06:55] composer and wp packages and stuff. So [06:57] >> what so we have npm and we have have [06:59] have composer we've had those since the [07:02] you know the dawn of time and with wp [07:05] packages I can you actually well with [07:08] composer you you can actually check out [07:11] github git repositories I believe. Yeah. [07:14] >> Yeah, you can. Yeah. [07:16] >> Yeah. And so how does how does WPM [07:21] bridge the gap between npm and composer [07:24] and and and or or does it is is is that [07:27] the is that the point of it? Um [07:31] >> yeah. So I just use npm as like [07:34] terminology to talk about that what WPM [07:36] is actually. So we can like forget about [07:38] npm here because it's the package [07:40] manager for JavaScript and it won't help [07:43] us much when it comes to distributing [07:45] >> it doesn't handle any of the WordPress [07:47] JavaScript stuff. [07:48] >> Yeah. Yeah. It it just handles like [07:52] JavaScript packages that you want to [07:54] install but WordPress uh like plug-in [07:56] and themes are mostly PHP code wired up [07:59] in a different way. So we we should omit [08:03] like npm from this scenario here. Now [08:04] coming to composer actually the first [08:08] thing is that composer was not built for [08:12] handling such use cases. While composer [08:15] have those features for example you can [08:18] uh wire up uh like jip jip there or [08:22] maybe a g repo there or or maybe some [08:26] jip. [08:27] uh disk URL there it can handle those [08:30] but neither composer [08:33] was built in such a way that they were [08:35] keeping WP specific nonsense in their [08:38] mind while they were building composer [08:40] so composer don't treat WordPress [08:42] plug-in or themes as like uh what should [08:45] I say like first class citizens and now [08:49] when it comes to WordPress WordPress.org [08:52] or distribution mechanism wasn't built [08:54] in such a way that it can talk to [08:56] composer as for first uh class citizen. [09:01] Ah, okay. So, this is [09:03] >> Yeah, [09:04] >> I I'm seeing. Okay. So, I think [09:07] >> I think and I think I'm probably [09:10] my mind is probably going in the same [09:12] direction as as users. So, this is lit. [09:16] Let let me back up. My brain is not [09:18] functioning. I can't talk. So, this is [09:20] like a first like a WordPress first. [09:22] It's not a replacement for composer. Let [09:25] me just ask that question. Sorry. Is it [09:27] intended as a replacement for composer [09:28] or just as as a as a replacement for [09:31] composer plus WP packagist? [09:33] >> So it's a replacement for composer in [09:36] like uh different terms. For example, [09:40] let's say how you want to manage your uh [09:44] WordPress dependencies. The question [09:46] number one is that because composer can [09:47] manage. Now at this moment uh I can like [09:52] say that folks who are managing or using [09:55] composer to manage WordPress plug-in and [09:57] themes I can say that composer isn't [10:00] like handling single responsibility [10:02] rather it's handling two you are [10:04] managing your PHP packages and then you [10:06] are managing your WordPress packages as [10:08] well. [10:09] >> Okay. [10:09] >> So that is thing number one. Now second [10:11] thing is when we then comes is uh like [10:14] uh how are your [10:18] WordPress plug-in and themes packaged in [10:20] such a way that it can leverage all the [10:22] toolings that composer exposed or [10:25] exposes. For example, composer exposes [10:27] something called uh like boundary [10:30] configuration. You can save you can [10:32] shape uh win files with your plug-in and [10:35] themes and it will just wire them up and [10:38] you can run those binary as tools. [10:40] Another thing is does your does you [10:42] write your plug-in and themes in such a [10:44] way that it can wrap another [10:46] dependencies. For example, let's let [10:48] let's talk about WooCommerce. [10:50] WooCommerce have like thousands of [10:52] extensions that doesn't run without [10:54] WooCommerce. Add those thousands of [10:57] WooCommerce extension built in such a [11:00] way that they can be distributed with [11:01] composer and when you download any of [11:04] those extensions can composer determine [11:07] that whether it should download [11:08] WordPress with it or sorry not WordPress [11:10] whether it should download WooCommerce [11:12] with it or not. So it's not one package [11:14] composer now have to download composer [11:16] have the ideal responsibility of [11:18] downloading two packages. one is the [11:20] extension and another is the wcommerce [11:22] package [11:24] because this is how your dependency tree [11:26] is going to be look like [11:29] >> and there there are like many other [11:30] nonsense maybe I can't think of you at [11:33] this time [11:35] >> yeah sorry and I I don't I I don't want [11:38] you feeling like we're grilling you like [11:40] hey what why is this thing any good [11:42] right um yeah so there's a couple the so [11:44] there is a question in chat from Kev XB [11:46] hello Kev [11:49] Um, [11:50] and it it it goes like this. Uh, the [11:53] question, sorry I have to find my window [11:55] now. The questions in it. Uh, can you [11:57] I'm just going to highlight the message. [11:59] Can you add PHP dependencies, other [12:01] plugins as dependencies or run post [12:03] install scripts [12:05] >> uh in WPM? Yes. So WPM is only for [12:08] WordPress. It will download any [12:10] WordPress related plug-in or theme and [12:13] it will run life cycle scripts. But it [12:16] will run life cycle scripts that are [12:19] declared in your root wpm.json. It will [12:22] not run any life cycle script that is [12:24] defined in your like packages that are [12:26] going to be downloaded and that is due [12:28] to security measures and that thing is [12:31] like now being removed from many package [12:33] managers like by default in WordPress in [12:36] JavaScript ecosystem PNPM blocks that [12:39] because that brings lot of security [12:41] issues running arbitrary codes from such [12:44] code that you just can't believe that [12:46] what they are going to run and also [12:48] inherently [12:50] uh WordPress plug-in and themes doesn't [12:53] requires [12:55] uh post install scripts from different [12:57] packages because by default WordPress [12:59] plug-in and themes are like [13:01] self-contained, [13:03] >> right? [13:04] >> Yeah. [13:04] >> Okay. So, [13:07] okay. So I think [13:10] so this this is so th this is meant to [13:12] run [13:14] if I'm understanding correctly and [13:16] please correct me if I'm wrong but it [13:17] sounds to me that that that this this [13:19] could run easily with with composer as [13:22] well. So if if if you had a project that [13:24] downloaded a number of PHP libraries [13:27] that you wanted to to use in a theme for [13:29] example that you were creating or a [13:31] plugin that you were creating for a [13:33] client [13:33] >> but then you also wanted to manage five [13:35] or six plugins. Let's say it's a [13:36] WooCommerce, like to use your example. [13:38] It's a it's a Woo Commerce site that's [13:41] got a custom theme and maybe a c a [13:44] couple of custom extensions. And so you [13:45] you're using Composer to get the PHP [13:48] libraries that you want to use in your [13:49] theme and whatever. And then you use WPM [13:53] to download the the core um uh [13:56] WooCommerce plugin, any other extensions [13:58] and stuff like that. And that all runs [14:00] sort of seamlessly. [14:02] >> Yeah. Um, and [14:05] okay. And so, so there the there there [14:09] is a kind of a spicy question from [14:11] thrown of error. I guess I guess the [14:12] easiest way to ask is what problem does [14:14] this solve? And it sounds to me that the [14:16] problem it solves is managing WordPress [14:18] and theme and installations, updates at [14:20] a code level. Like so this is not [14:23] something that like someone who just [14:25] wants to go download a plugin and then [14:27] update it manually and you know this is [14:30] not for those folks. This is for people [14:32] that are building an entire [14:35] um [14:38] microcosm I guess. So like like so your [14:41] your project has got four themes and 15 [14:43] plugins and all this stuff and you want [14:45] to manage it all in source control and [14:46] you want to make sure that you have [14:47] versions and all all of that stuff. I [14:50] think that's the problem that this [14:52] solves is the ability to [14:53] >> so so this is the thing like if if I say [14:57] that uh this is the thing that composer [14:59] can also handle right so WPM is like you [15:03] don't have to think it like that someone [15:05] is asking me that replace something that [15:07] composer is already doing for me rather [15:10] WPM here is to fill the ecosystem gap [15:14] now let me explain what I like really [15:17] meant uh from this So uh any folk like [15:21] who manages like big enterprise websites [15:25] so they they must know that uh when they [15:29] think about plugins it's just not that [15:31] they are using all the public plugins [15:33] that are available on WP packages or the [15:36] new uh WordPress WordPress packages [15:39] registry called WP packages it all the [15:43] plug-in and themes are not available the [15:44] things comes when you have to manage [15:48] private plug plug-in and theme as well. [15:50] So for example, let's say there is a [15:52] project. It's possible that you are [15:55] using 10 plugins, right? But out of [15:58] those 10 plugins, the question is that [16:01] how much plugins are private that are [16:03] easily downloadable using composure and [16:05] how many plugins and themes are uh no [16:09] sorry how many plug-in and themes are [16:10] like public that you can easily download [16:12] using composure without any issues and [16:14] how many plug-in and themes are private [16:17] that you have to download using multiple [16:19] ways. So for example in WordPress [16:22] ecosystem when it comes to distributing [16:25] premium plug-in and theme there is no [16:27] spec compliant thing and when I say spec [16:31] compliant thing it means that there is [16:33] no single way by adhering which every [16:36] vendor is distributing their packages. [16:38] So for example that Yoast I I'm just [16:42] taking names here that it might be [16:43] possible that Yoast gives you a composer [16:46] API gravity forms give you a composer [16:48] API but then again there are like [16:52] vendors that don't provide you composer [16:54] API they just give you GIFs you can [16:56] download GIFs from their uh from log to [17:00] their dashboard just download GIFs and [17:03] that is when the problem comes so now [17:05] now the thing is that for many of the [17:08] vendors you can download those packages [17:10] uh using composure and now for some of [17:13] the vendors you can just don't do that [17:15] because you have to download manually [17:17] using their dashboard. Now in those [17:18] particular scenarios the auto sorry the [17:22] workflow is like very messy when it's [17:24] come to uh respond quickly to the [17:27] updates right pushing to the live [17:29] product live environments so that is [17:32] like very problematic that is something [17:33] that I have felt in past five years and [17:36] that is why I came to build something [17:38] that is like centralized that is specd [17:40] driven so that whenever some vendor want [17:43] to distribute a plug-in or theme they [17:45] can just bind to one framework that [17:47] Okay, I have this meta that if I am [17:50] distributing a plug-in or theme that I [17:53] provide a GIF for it or a tarot for it [17:55] and I provide a meta data file with it. [17:58] So no matter how user is going to [18:01] download this thing, they can automate [18:03] their workflows in a singular way so [18:06] that anyone can download these artifacts [18:08] that I'm distributing. So that's the [18:10] whole point. Now coming to second point [18:13] is the security. [18:15] So for example that uh le let's talk [18:18] about uh composer repo you are using how [18:22] you are so confident that whatever you [18:24] are downloading from the composer repo [18:26] is exactly the same that author has [18:29] published there how you can [18:31] cryptographically verify or like you can [18:34] be confident that I'm getting the same [18:36] thing and there is no supply chain [18:38] attack in the middle. So what these [18:42] composure repositories generally do is [18:44] so there is a wordpress.org distribution [18:47] system they place their mirror at this [18:50] level in the middle and now you are the [18:52] consumer here. So you will make request [18:55] here your request will go to [18:57] wordpress.org [18:58] and now there is a like layer that can [19:00] be compromised in a way. So how can you [19:03] be sure that you are actually [19:05] downloading what you requested? [19:08] WPM fixes that. WPM has like very good [19:11] built-in supply chain primitives that [19:14] that very that actually verifies that [19:16] you are downloading what you uploaded. [19:19] It verifies that thing [19:20] cryptographically. Now uh also I have [19:23] also managed private plugins and themes [19:26] using composer and trust me that is very [19:29] messy. So to do that in composer first [19:32] you have to find out that whether your [19:34] vendor provides uh the composer API or [19:37] not. If they provide then you have to [19:39] add those particular entries into your [19:41] composer.json's [19:43] repository config and then you have to [19:45] manage off.json that varies by every [19:48] vendor. So for example, you are [19:51] downloading or you are using premium [19:53] plug-in and themes from five vendors and [19:56] three of them provides composer API then [19:59] you have to manage authentication or [20:02] authorization for three uh of those [20:05] vendors in your JSON and for rest of the [20:07] two you just have to do things manually. [20:11] >> Okay. [20:12] >> Yeah. [20:12] >> Okay. Cool. So um [20:16] yeah. Okay. So let's maybe um someone in [20:20] the chat is saying can we see it in [20:21] action and what a what a workflow would [20:23] would look like. So is there anything [20:25] else like so I like we're talking about [20:27] like entering all the security and all [20:30] of that stuff. So so are you storing [20:32] versions of these plugins? [20:34] >> Yeah. So [20:35] >> what I do is uh let me share a link with [20:38] you. [20:39] >> Sure. [20:41] Uh [20:43] >> you you can drop it if you're if you're [20:45] in chat you can drop it in chat [20:48] yourself. [20:48] >> Uh I will [20:50] >> or you can just you can send it to me in [20:51] Google meet. [20:53] >> Um I am having a hard time to find it. [20:55] I'll just send it in Google meet chat. [20:57] >> Sure. [20:58] >> So this is uh like an automation system. [21:03] What this automation system does it that [21:05] every 15 minutes it will check that are [21:09] there any new plug-in on themes [21:11] published on the WordPress.org [21:13] uh SBN repo. It will uh run a chron job [21:18] every 15 minutes. It will download all [21:21] those plug-in and themes. It will create [21:23] a JSTD compressed tarball out of it and [21:26] it will push that to the WPM registry. [21:29] While pushing it, WPM registry will will [21:31] verify its check sum and it will [21:34] generate cryptographically verifiable [21:36] signatures that will now later be uh [21:39] distributed in the package manifest. Now [21:42] using those signatures and using the [21:46] public key that is distributed over [21:48] HTTPS right now I'm planning to move [21:50] that over to tough repo. You can verify [21:53] whether this is the same package that [21:55] was uploaded. [21:57] So like uh if so also uh this project is [22:02] not just for WPM in case you want to [22:05] create your own mirror on top of [22:07] WordPress.org in a like very secure way [22:10] you can also use this project you can [22:13] also create your own composer registry [22:15] on top of WordPress.org using the same [22:17] product that I'm using. So it's like [22:20] very extendable. [22:24] >> Very nice. Oh my god. I'm sorry. [22:28] This cough has been dogging me for days. [22:30] Okay, anyways. So, okay, cool. So, let's [22:34] let's let's let's dive into it. So, [22:36] okay. I have set up a site. I have just [22:40] a random site that I set up with studio. [22:42] >> Mhm. [22:43] >> So, what what do I need what do I need [22:45] to do? Do I first I I'm going to need to [22:47] install this, I assume. I'm going to [22:49] open [22:49] >> So, you can go to wpm.so. [22:52] based on your operating system. You will [22:55] get a install command [22:57] >> and you can just run [22:58] >> that. [22:59] >> All right. And so does this this will [23:01] install it globally? I I I assume. [23:04] >> Yeah. [23:05] >> Okay. It's downloading. [23:07] >> I just hope it works on Mac. [23:10] >> Me too. [23:12] >> Yeah. [23:12] >> Okay. So, all right. So, [23:14] >> now you can just uh reload your shell [23:17] once. You can run you can basically [23:21] >> run the command above the [23:23] >> WPM help that is printed in the [23:27] information [23:28] >> right [23:30] uh [23:30] >> it's it's it's execute exec bing dish [23:36] >> there we go wpm oh I spelled it wrong [23:38] wpm-help [23:40] let's see what we got okay so there's a [23:42] lot of stuff in here I'm just going to [23:43] make this a little bit bigger [23:46] auth Oh Okay. So, knit. [23:49] >> Yeah. [23:50] >> Okay. So, how how would you recommend [23:52] having never used this before? [23:55] >> So, uh there there are like few things [23:57] uh whether you want to [24:00] create a plug-in, create a theme or you [24:02] want to like create a generic WordPress [24:04] project which have a lot of plugins and [24:06] themes. [24:09] >> Um I don't know. So, where am I right [24:12] now? I think I'm in I'm in the root of a [24:14] WordPress in installation. So, should I [24:17] go? So, let's say I wanted to create a [24:19] plugin. [24:20] >> So, I I need to see. [24:21] >> So, I I I think uh I think let's just do [24:25] uh let's just do WPM install and your [24:28] favorite plugin of theme. [24:33] >> Oh, sorry. Oh, install. Okay. [24:36] >> Yeah, WPM install. [24:38] >> But do I have to do that from my WP [24:40] content folder? [24:41] >> Uh no, no, no. Just just do it in the [24:42] root. So what WPM does it that by [24:46] default it will place your plug-in and [24:47] themes into the WP content folder until [24:50] and unless you have configured it to be [24:52] somewhere else. [24:53] >> Okay. So all right so I and then what do [24:56] I pass? So if I want to do install [24:59] uh oh no [25:02] so what so what am I so if I just do [25:04] install okay it's telling me oh I have [25:06] to pass the name of a plugin for for [25:08] example right okay well there's only one [25:10] plugin that everyone should be [25:12] installing it's called advanced query [25:13] loop and it's by [25:17] the best looking guy named Ryan on this [25:19] stream [25:22] install advanced query loop boom [25:24] resolving okay So, let's look at let's [25:28] I'm just going to open this up in Visual [25:30] Studio so we can just see what's going [25:33] on. What's going on? There we go. All [25:35] right. So, content plugins advanced [25:38] query loop. Okay. So, it installed. That [25:40] was super painless. Um, all right. Demo [25:44] over. We can go home. [25:46] So, cool. Okay. So, that's that. So, [25:48] that's great. So, how so let's say that [25:50] I I I [25:51] wanted to [25:53] instead of pulling it from Okay. So like [25:55] what would be the next thing? [25:58] >> Uh so yeah [25:59] >> all right actually we before we move on [26:01] we do have h have a question here from [26:03] thrown error. He's asking the hard [26:06] questions. I'm just going to spotlight [26:08] it. The question is I keep hearing [26:09] securing and security. Can you give an [26:11] example of why this is secure and what [26:13] security measures? [26:15] >> Okay so um I keep hearing secure and [26:20] security. Okay. So in WordPress [26:23] ecosystem, [26:26] let's say you are downloading a plug-in [26:29] or theme from some source, right? Let's [26:33] say I am the website owner. Let's say I [26:36] am the plug-in owner and you are [26:38] downloading it from my website. You are [26:40] downloading the plug-in or theme and now [26:44] my website is hacked or compromised in [26:47] some way. I don't know. [26:50] And now someone what they just did is [26:52] that I I people trust me right they will [26:57] trust my product that okay this person [26:59] have created this plug-in or theme I [27:01] will just use it blindly on my system [27:03] and when they downloaded this plug-in or [27:06] theme now now you have some security [27:08] nightmare at your end and it it could it [27:12] have been prevented yes there could have [27:15] been a good tooling in place to [27:16] determine that what you are downloading [27:19] is is integrity is like good [27:24] then that problem wouldn't have happened [27:26] in the first place. Right. [27:28] >> Right. [27:29] >> But since there is no tooling. [27:31] >> Mhm. [27:31] >> Mhm. No sorry carry on. [27:34] >> But since there is no tooling there is [27:35] no way to identify uh that whether this [27:38] thing have been like tempered in transit [27:41] or not. So that's the like main goal [27:45] >> of security. [27:47] So, so in the in the in the case that I [27:50] that my my advanced query loop plugin, I [27:52] decide to offer a premium version of it [27:53] and I sell it through my website only. [27:56] >> Um, [27:57] >> this [27:59] uh and my my my site is hacked. Someone [28:02] replaces the archive with a flappy a [28:05] Flappy Bird clone. We all know what [28:07] happens when you click those links [28:08] >> and uh and it gets downloaded to a [28:12] client site. The world ends, right? So [28:14] what so what we're saying is is WPM [28:17] >> allows allows vendors [28:20] >> um to subscribe to the system. I'm I'm [28:23] not sure if if that's the right word but [28:25] but prepared their plugins in such a way [28:27] that it can be ingested by you your [28:31] service and and so when you download it [28:34] through uh WPM um you are like so I'm [28:40] assuming WPM does that that [28:43] cryptographical check for us right so so [28:46] there's no possible way [28:48] >> now how does okay is that accurate so is [28:51] there a copy of my advance query loop [28:53] plugin on your server somewhere. [28:55] >> Yeah. So, um you you pushed your [28:58] advanced query plug-in on your uh on on [29:01] WPM, right? And let's say so it's like [29:05] future proof. No one can like no user [29:08] can download a temporal version now. [29:11] >> Okay. [29:11] >> And let's say I have to as [29:13] >> as the plug-in author I I have to say, [29:15] okay, I've published this to to the [29:17] repo. I'm going to publish this to to [29:20] WPM just the same way that you would [29:22] publish to a composer package or you [29:23] would you you well maybe not composer [29:26] but like for npm for example when you [29:29] want to publish a new version of that [29:30] you you push it up to the system right [29:32] >> so it's the same idea [29:34] >> uh yeah sort of [29:36] >> okay [29:37] >> so [29:38] >> okay cool [29:38] >> and to explain it in simple terms [29:41] >> that what happens is that uh let's say [29:45] even if WPM get compromised that WPM [29:49] would never install that compromised [29:51] package and the reason being is that the [29:55] cryptographic verification is like [29:56] deterministic. [29:58] You can't fake public key for a private [30:01] key that is used to sign particular [30:02] metadata for a package. So even if they [30:05] let's say they changed the uh let's say [30:10] let's say they changed the contents of [30:12] her artifact they changed somehow the [30:15] they were able to change the even the [30:17] manifest but they can't have access to [30:19] private key because it's hosted in HSM [30:22] backed hardware somewhere in the AWS KMS [30:25] data centers. So, [30:27] >> so they just can't hack it. And if you [30:29] can't hack up private key to generate [30:31] more signatures, you you can just uh [30:34] fake this. [30:36] >> Okay. So, the long and short of it is [30:39] it's it's once it's in the system of the [30:43] WPM system, it's next to impossible to [30:45] to fake it. Now, [30:46] >> can [30:49] >> that's got me think. So, let's say that [30:50] I didn't realize that there was [30:52] something wrong with the zip and I [30:55] >> published it. Um [30:57] there's nothing stopping that but I [31:00] guess that's just like that that's user [31:01] error. [31:03] >> Yeah. Yeah. [31:04] >> That's my problem. Right. [31:05] >> So what what what can be stopped is [31:07] let's say somehow someone was able to [31:10] get your right tokens uh right and [31:13] someone tries to uh [31:17] publish a package using that particular [31:21] token. that won't be possible because I [31:23] will be bringing publisher uh [31:27] uh mechanism to the WPM. So in that [31:31] particular scenario what happens is that [31:34] you will connect WPM and your GitHub [31:36] repo basically the source from where you [31:39] publish your uh plug-in or theme right [31:43] so what happen is that currently it's [31:45] supported on GitHub and GitLab so let's [31:47] say your repo is on GitHub GitHub and [31:49] GitLab you will connect [31:51] uh your GitHub repo to WPM something [31:54] using something called like OIDC [31:56] verification. [31:58] So now when you will publish that [32:00] particular package that can only be [32:01] published from your GitHub repo [32:05] and uh when you will initiate the [32:07] publish chain like very shortlived write [32:10] token will be generated and that will be [32:12] used to publish that particular package. [32:14] So even your right uh token is like uh [32:19] compromised in some way uh end user just [32:22] can't publish anything to WPM because it [32:25] will verify that how the last version of [32:28] the plug-in uh was published was it [32:31] using OIDC was it using manually then it [32:34] will check that if OIDC is connected is [32:36] it being published from the legit repo [32:39] that is configured in the WBM dashboard [32:41] and it will just reject the push. [32:44] >> Okay. So it sounds it sounds like [32:45] there's a a number of layers of security [32:49] here. Throw it to your does that sort of [32:51] answer your questions? [32:52] >> Also uh there is one more thing that end [32:55] user can attest that from which source [32:58] this uh plug-in was created from. So it [33:02] is something called material of bill [33:04] that we put it in a test station that [33:07] you can verify that it can that can be [33:09] used to prove that where this plug-in [33:11] was built. For example, let's say you [33:13] build your plug-in in GitHub actions. [33:15] Then it will push the information like [33:17] that it was built in GitHub actions. [33:19] This was the uh operating system version [33:23] at that time. These were the packages [33:24] installed at that time. So in case the [33:27] these things help you to identify let's [33:29] say uh someone find a back door in the [33:32] GitHub actions itself and they [33:34] compromise the package in such a way. So [33:36] such things can even help to identify it [33:38] further than where the problem really [33:40] occurred. [33:42] So that are the like types of security [33:45] uh uh security things that I'm trying to [33:48] bring to WPM and mostly to the WordPress [33:51] ecosystem so that people can be aware [33:53] about it. [33:54] >> Okay. So how so let's say I wanted to [33:59] um opt my plugin in. So, like [34:02] >> I'm assuming at this point everything [34:04] that's on that's hosted is like in in [34:08] the plugins re uh repo [34:10] >> is is available. Um yeah, because I did [34:13] I did nothing to to add my plugin to it, [34:16] but it's there. [34:17] >> Yeah. [34:17] >> So, if I wanted to um [34:21] how like if I wanted to say allow people [34:25] to download the source of my plugin, [34:28] >> is that something that I would do or is [34:30] that just [34:31] Uh you you mean download the source of [34:33] your uh you mean download your uh plugin [34:37] from WPM, right? [34:39] >> Yeah. So like like I've I've got a [34:41] repository that my advanced plugin is in [34:43] and it contains all the source files [34:45] which it's open source. So, like if I [34:48] wanted if I wanted to [34:50] >> so let's say that that you know RTMP [34:52] wants to use my my plugin on a on a [34:55] project but they want to be able to [34:58] >> like they want to be able to to see the [35:00] source files because they need to um you [35:03] know [35:04] >> uh get it approved by VIP or you know [35:07] you want to do a uh security check [35:09] internally and stuff like that. Is there [35:10] a way to be to to [35:12] opt into that sort of thing to say [35:14] here's the entire source file but you'll [35:16] have to build it basically. [35:18] >> Yeah. So so there can be few things that [35:20] uh you can link your GitHub profile [35:22] using your you uh using I think GitHub [35:25] repo field maybe in WPMJSON I I don't [35:28] remember if I have even added that or [35:30] not. So basically you can you can do it [35:32] anywhere. Let's say just include your [35:34] repo link in read me and if you will go [35:37] to so let's say let's if you can go to [35:40] wpm.so website I can show you that how [35:42] you can see the strike is there. [35:45] >> Yeah [35:45] >> that would be like much better [35:48] and just go to plugins [35:50] or search whatever you want. [35:54] >> Oh my keyboard [35:55] >> and search your plugin here. Yeah, [35:58] sorry. My keyboard uh [36:01] disconnects if I don't type. Oh, well, [36:04] there we go. [36:06] Query. [36:08] Oh, come on. [36:10] There we go. So, I click on that one. [36:16] So, you can link required metadata here. [36:19] You can copy the install command from [36:21] here. And literally, this is what you [36:23] need to like download your plug-in. So, [36:26] by the way, this information is passed [36:28] from readme.txt [36:30] of your plug-in. [36:31] >> Oh, okay. [36:32] >> Then it converted to readme.md and then [36:34] it's being shown. [36:36] >> So, if I download this this this [36:38] tarball, this will just essentially be [36:41] the the built version of my plug that [36:44] I've shipped to.org. So, if I wanted to [36:46] to make this um like if I wanted to say, [36:50] okay, so you have that that option, [36:52] which is great, but also I want someone [36:55] to be able to download the actual raw [36:56] source [36:58] um in as is is that a possibility? So I [37:03] so to download the raw source uh you can [37:06] link your raw source information [37:09] somewhere maybe in read me or I will [37:11] give a field that will show that [37:13] particular source link. Uh see that [37:17] there is a homepage section there maybe [37:19] it will take you to there or maybe I [37:21] will add one more button here called [37:23] source repo that will take you to the [37:25] source. [37:26] >> Yeah like so so so there is like a link [37:29] to my official thing here. Yeah. [37:31] >> Like, well, let me back up first. Like, [37:34] does that sound like something that [37:36] people would want? I feel like [37:38] >> if if I'm going to be checking this [37:41] checking this project out [37:44] >> and and bundling it with my client theme [37:46] or whatever it is, um, you know, having [37:49] the the source files which which don't [37:52] get included when you build it, um, you [37:55] know, [37:55] >> yeah, and distributed to.org. I feel [37:58] like this option um would be the better [38:02] one. Not but not not everyone's going to [38:04] want this option. Like some people just [38:05] want to install the plugins. So So [38:08] >> is that a use case? Like I feel like [38:09] that that would be a use case cuz like [38:12] >> when I was at Tenop, you know, we used [38:14] to have to do plug-in reviews all the [38:15] time. client would say, "Hey, I I I want [38:17] to use [38:19] >> amazing a gallery slider plugin that we [38:22] have to like spend hours and hours [38:24] reviewing and all the JavaScript was [38:25] always [38:26] >> minified and stuff like that." And so [38:28] like I I feel like [38:30] >> um being able to provide the source [38:34] version of this plugin that then, you [38:35] know, in the project you would just add [38:37] it to your build process or your [38:39] whatever would be something that people [38:41] would be into. Am I I don't know, Chad, [38:43] what what do you think? Is that [38:44] something that people would want? I [38:46] mean, if you're I don't see why somebody [38:50] would be like you can have my plugin but [38:52] not the source because it's also [38:54] licensed. But [38:55] >> my thing process is that whoever want [38:57] this level of observability [39:00] most of the time they will be easily to [39:02] figure out that from where the source is [39:03] coming. For example, you were [39:05] >> easily able to identify the rappling [39:08] from the reading. [39:09] >> Yeah. [39:10] >> So, so they can they can just find it. [39:12] Yeah. And I can also add a like [39:14] dedicated field that can link to the [39:16] source. Generally right most people do [39:20] that to like homepage or something like [39:22] that from where you will be able to get [39:24] all the information [39:25] >> and it's there already. [39:27] >> It may not it may not even be something [39:28] that that is that important. [39:31] >> Um because you're right I mean like [39:33] >> people will just say okay well let's go [39:36] look at the repo and then they'll then [39:37] they'll they'll sick uh like co-pilot on [39:40] it anyways to do the review. So, so [39:42] maybe that's not a big deal. Okay, cool. [39:44] >> Yeah. [39:45] >> Yeah. [39:46] >> But I have like lot of things planned up [39:48] for this if it goes well. [39:50] >> One is that uh that by looking at the [39:54] source right when I pushing things to [39:56] WPM, I can quickly pass all the source [39:59] code and find out all the custom hooks [40:03] and document them on the website itself. [40:05] So, [40:05] >> oh that's nice. [40:06] >> Yeah. So many uh ecosystem does that. [40:09] For example, if someone's have worked [40:10] with Go, go have like really cool [40:13] implementation. They just show [40:15] >> the package. So, so we can also do that [40:18] here. So, not only does it become a [40:21] place for like to to download plugins [40:24] and find plugins, it also becomes, you [40:27] know, some a bit of documentation as [40:29] well, which as we all know is the last [40:32] thing that any developer really wants to [40:34] spend time doing is is [40:36] >> especially when you have like, you know, [40:38] like like my plugins got two hooks in [40:40] it, I think. aren't that it's not that [40:42] that big a deal to document but [40:44] >> um so throw to error is asking so it [40:48] this is more of a version control system [40:51] and I don't think it is I think it's [40:53] basically along the same lines of um and [40:57] you know I'm going to answer I'm going [40:58] to answer for you love cash and you tell [41:00] me if I'm wrong or not uh this is not [41:03] version control this is this is like a [41:06] distribution control I think is what it [41:09] is like the same It's npm for WordPress [41:12] plugins and and and themes. That's [41:14] that's the that's the oneline elevator [41:17] pitch I think. [41:19] >> Yeah. Yeah. Yeah. That that's correct. [41:20] It's not a version control. Rather, it's [41:22] a uh you can have information about all [41:25] the versions that we have published [41:27] here. That's one thing. But it's not uh [41:30] like version control in like a strict [41:32] way uh for talking about version control [41:35] system like git and all that stuff. [41:37] >> Right. So how so this does this ingest [41:40] all the tags that are available on.org [41:42] like is that how this [41:44] >> Yeah. Okay. [41:45] >> So all the tags are available on WPM and [41:48] I do it because uh to support backward [41:51] compatibility basically let's say [41:53] someone is on version 1.00 [41:56] so they can also download [41:58] >> but [41:58] >> and you may also want to um you know [42:01] lock to a certain version you know. [42:04] >> Yeah. Yeah. and and stuff. Just put AI [42:06] on the landing page and people will just [42:07] put AI. Kevin says just put AI on the [42:11] landing page and people will use it. [42:12] There you go. You should call it [42:15] wpm.so.ai [42:16] and now you'll get like a thousand more [42:19] >> more people jumping on. No. [42:22] Okay. So, I can import things from [42:25] packages that I thrown is asking a [42:28] question. So, I So, can I import things [42:30] from packages that I install? I don't [42:33] think I I understand [42:36] the question. Does that [42:38] >> So I I I think I I got it. They are [42:40] asking because this thing generally [42:42] happens in npm. So you install packages [42:45] and then you import them. But the [42:47] WordPress and PHP ecosystem works in a [42:50] different way. You have to activate a [42:52] plug-in and then you can use their code. [42:54] Like if they are exposing hooks, then [42:56] you can add your functionality to those [42:58] hooks. not import like you uh think in a [43:02] thing or like you do in npm or in [43:04] composite. [43:04] >> Yeah. Okay. That's a really good [43:07] distinction. So think of it as npm but [43:09] just the part that manages what you are [43:12] downloading not the not how you're using [43:14] what you're downloading. Right. That's [43:16] sort of [43:17] >> Yeah. So so the same way that like [43:20] composer is meant to to to download the [43:23] PHP libraries that you want to use. Um, [43:26] and then how you use that stuff is is [43:29] secondary, but this is how you get [43:30] access to it. Uh, [43:34] Kevin's asking, "How did all those [43:35] versions get there? Does it slurp the [43:37] SVN?" That's he's talking about the [43:40] Yeah, does yes. [43:41] >> Yes, Kevin. [43:45] >> So, I I I can like explain it a little [43:47] bit more. So what happens is that like I [43:49] mentioned before that every 15 minutes a [43:52] chron will check the state of SPN repo [43:56] since the last time it was scrapped and [43:59] it will find the difference and then it [44:01] will try to figure out that what [44:03] packages have been upload in that [44:05] particular time frame and then it will [44:06] migrate. So you can go to WP2 WPM repo. [44:11] Uh Ryan will share the link and you can [44:14] go to actions and you can see like lot [44:16] of jobs there that are updating the uh [44:20] reply. [44:22] >> Yeah. So in the GitHub one GitHub [44:25] workflows in here. [44:27] >> Yeah. You can go to actions. [44:30] >> Oh sorry [44:32] >> on the on the actions tab itself. [44:34] >> Oh actions tab. Yeah. I'll I'll learn [44:38] >> on on the top on the right hand side. [44:41] >> So these are the like migrate jobs [44:42] happening every 15 minutes. [44:45] >> Let's take a look here. So oh mine I I [44:50] Okay. [44:59] >> Oh, okay. Cool. So this So So what does [45:02] this do? Does it just um does it just [45:06] kind of like get the latest ones that [45:08] have been updated or is like this this [45:10] must run on some kind of b because I I [45:12] know how many plugins get submitted [45:14] every day to the plug-in repository. So [45:17] this thing must be running constantly. [45:19] >> Yeah, it's it's running every 15 [45:21] minutes. Okay, [45:23] >> it founds the difference that let's say [45:25] your plug-in have 100 versions [45:27] >> and it's published then it will try to [45:29] find the diff that what versions are [45:31] already there on WPM and what versions [45:33] are remaining [45:34] >> and then it will push those remaining [45:36] versions to it. [45:37] >> Oh, nice. So like it starts with most [45:39] recent and then kind of works it way [45:40] down I'd imagine something like that. [45:41] Okay, cool. Yeah. So yeah, um just as a [45:45] as a as an aside, I think the plug-in [45:48] team is getting something in the the [45:49] like four or 500 submissions a day for [45:53] new plugins. That's insane. That's [45:56] insane how many and so many of them and [45:58] it's because of AI. So anyways, so shout [46:00] out to the plug-in team who's doing a [46:01] hell of a job keeping that that uh Q [46:04] time as low as it is. Anyhow, um okay, [46:08] cool. So, what else [46:11] should I Okay, so what else can be done? [46:14] So, we installed the plugin. [46:15] >> Yeah. [46:16] >> Cool. Now, what what what [46:18] >> I want you to show me the coolest like [46:20] wow feature of this right now. I put you [46:22] on the spot. Show me the coolest thing [46:23] you can do. [46:24] >> Um, let me give you one command in chat [46:27] and try install. [46:29] >> All right, let's let's do it. And and if [46:31] it's an RMR RF, I'm not running it. Or [46:34] if it's a link to [46:36] the Flappy Bird, if you're not familiar [46:39] with what I'm talking about chat or look [46:42] at, someone uh [46:46] linked a Flappy Bird clone, Flappy Bird [46:49] clone in in my chat one day and I like [46:52] an idiot clicked on it and it changed [46:55] me. It changed my life and I'll never be [46:58] I'll never be be the same. Okay. So, [47:01] this is a this is the command that you [47:03] sent me. WPM install Dynopac for [47:06] Elementor. [47:08] >> Yeah. [47:08] >> What? Well, first it's not Gutenberg, so [47:12] I'm a little bit annoyed, but that's [47:14] fine. What do I What do I So, what's [47:16] this going to do? Or should we just run [47:18] it and see what happens? [47:19] >> Yeah, you you just run it and see. [47:21] >> Okay, here we go. Are you ready? I'm [47:23] going to zoom it in. Actually, before I [47:25] I do that, I'm going to I'm just going [47:27] to clear it out so we can see it. Here [47:28] we go. Install a dino pack for element. [47:30] Bang. [47:33] What's it doing? Okay, [47:35] now what? It did it. [47:38] >> So if you will notice that it just [47:40] didn't install nanop for elemental [47:42] rather it also installed elemental with [47:44] itself. [47:45] >> Oh, so it just figured that out. [47:46] >> Yeah. And now if you will if you will do [47:49] wpmls [47:53] >> what? Sorry, what was the command? [47:55] >> WPM ls list [47:56] >> ls. Yeah. [47:59] >> Oh. Oh, that's cool. [48:02] >> Now it will show you that [48:04] >> how many dependencies you are using and [48:07] why element exists there in the first [48:09] place. [48:10] >> So in composer [48:12] >> in your WordPress dashboard I I doubt if [48:15] you will be able to figure it out in [48:16] such a way. [48:18] >> That's really nice. So this is showing [48:20] me all the plugins. So, how does this [48:22] So, like if I were to do WPM install uh [48:26] blockbase, which is a theme, [48:29] right? I think it's [48:31] >> I just hope it's there. [48:33] >> It is. There you go. WPM ls. [48:37] Okay. So, it doesn't show me the themes. [48:39] So, do I have to specify if I want to [48:41] see themes and and plugins like like [48:43] themes? Oh, here's a question. Oh my [48:46] god, so many things. Okay, let me I have [48:49] I have 10 questions. So, let me just [48:50] start with the first one. Um, if I [48:52] wanted it to show me all the installed [48:54] themes, is there is there something that [48:56] I have to do for that? [48:57] >> Yeah, that would be a cool feature and I [48:59] would love if you can create a issue on [49:01] CLA repo. [49:02] >> Sure. Yeah. Yeah. Yeah. Okay. So, that's [49:05] the first thing. The second the the the [49:07] second part of that is it would be [49:09] amazing if you could show child themes [49:12] in the same hierarchal uh structure [49:14] which I I don't know if I said that word [49:16] correctly. Yeah, that that [49:19] >> Yeah, because that that would be very [49:20] cool. Or you just run ls and it says [49:23] plugins blah blah blah blah themes blah [49:24] blah blah blah shows you what [49:27] >> it should also show you what's does it [49:28] know what's active? Does it have access [49:30] to the database or is it just more file [49:32] structures? [49:32] >> No, it it it's just uh uh FS only. No [49:37] access to your WordPress installation. [49:39] >> Well, that's good to know. [49:41] >> Um Okay, cool. So, it will just show you [49:43] what you have installed, not necessarily [49:44] if if it's running or active or not. And [49:46] that's that's cool. [49:48] >> That's that's the thing for your uh like [49:50] WordPress dashboard to figure out. [49:52] That's why it exists to show. [49:54] >> Yeah. Yeah. No, I I think I think it's [49:56] better. Personally, I think it it would [49:58] feel a bit icky if uh and icky is the [50:00] technical term, by the way. It would [50:02] feel a bit icky if um if this tool had [50:05] man had access to the database because I [50:07] don't know why I would ever need to. [50:08] >> Yeah. Um [50:11] okay. [50:12] >> Okay. So one more cool feature coming [50:14] your way. Mhm. [50:15] >> So let's say now you don't have just [50:17] three or four packages here rather you [50:19] have like 10 or 20 packages here [50:22] >> and you spotted a plug-in or theme that [50:25] you don't remembering installing and you [50:28] are questioning yourself that why it [50:29] exists here then you can just simply [50:32] type WPMY and then plugin of theme [50:36] >> WPMY WPM [50:39] sorry PM Y and then say what Blockbase [50:44] maybe. [50:45] >> Yeah. [50:45] >> Wait, it did list Blockbase. Hold on. [50:48] Maybe that's a plugin. Let me check. [50:52] Just let me check that. [50:54] >> Ideally, you should have copied [50:55] elementor because element is something [50:57] that you have you don't you haven't [50:59] installed yourself and installed by [51:02] package. [51:02] >> Let me get that over here. So, let's [51:05] just see plugins. Install plugins. Is [51:07] there a blockbased plugin? No, there [51:08] isn't. Okay. So, [51:13] okay, they're not, but that's fine. I'm [51:15] just going to go in the themes. So, it [51:17] did install Black Oh, interesting. So, [51:19] it did install Blockbase, which is a [51:21] theme, and it's actually showing it in [51:23] the list already, but it wasn't showing [51:25] it up here. [51:26] >> Oh, [51:29] that's okay. That's cool. Um, so if if I [51:33] say why block base, it'll tell me why. [51:37] Or Elementor is probably a better one, [51:39] right? Yeah. [51:40] >> Okay. [51:44] Okay. So, it's unclear to me what that [51:47] means. I I know what it means because of [51:48] what we're demoing, but yeah, it's a [51:50] little unclear to me [51:52] >> that you say why Elementor and it's just [51:54] showing me. [51:56] >> Yeah. So, let's say you got tempted by [51:58] some extension online and you just [52:01] installed it, but now you just installed [52:03] it and you just forgot. Now you're [52:05] coming to your website and seeing that [52:06] why element exists here and then you can [52:10] just simply check then now you can [52:11] figure out okay my project requires [52:13] dynopac for element and that packages [52:15] requires element. So that's the [52:17] hierarchy. [52:19] >> Yeah. Yeah. [52:23] >> Also one more thing that you can [52:26] >> you can install a specific version of [52:28] your plug-in and themes. You just have [52:30] to do WPM install package at the rate [52:33] version. [52:35] >> So if I wanted to install version one of [52:37] advanced query loop, [52:39] uh will this override anything? It's [52:41] already there. [52:42] >> It it will replace the existing button [52:44] with the [52:45] >> do I have to do is it like that or said [52:46] that do you use the at or [52:50] >> add the add? Yeah, between you have to [52:52] add [52:53] >> Okay. [52:55] Should should there be a space or no [52:57] space? [52:57] >> No space. no space. Okay. So, it's the [53:00] same way that you would install. So, [53:01] it's the same syntax as npm, which is [53:03] nice. [53:03] >> Yeah. Yeah. [53:04] >> Okay. Okay. Cool. All right. Uh, [53:10] okay. So, there's [53:12] throw new error with the spicy. So, what [53:15] won't WPI do what you're asking? [53:18] >> Uh, WP CLI will only install what's [53:22] there on.org if I'm not wrong. [53:26] Also, it will just download the JIP. It [53:28] will don't give you a metadata and all [53:30] the information that we are doing here. [53:31] >> Yeah. And it it does not handle [53:33] dependencies. [53:34] >> Yeah, it don't uh I'm not sure about [53:36] that. Uh if it will handle or not, [53:40] >> but I don't know. And this is something [53:43] that Well, we can test it right now. We [53:45] can test it right now. Um so if I if I [53:49] go in here and I go into into iTerm in [53:51] here and I say WP, I should have WPCLI [53:54] installed, right? So if I go WP, [54:00] let me zoom that in. Sorry. [54:01] >> What I know is that if you will install [54:04] a [54:05] plug-in using uh WPCLI, it will uh [54:09] verify the MD5 [54:11] hash. But MD5 you shouldn't really use [54:14] it because it's not collision free. [54:17] >> Okay, so hold on. So we go WP plugin [54:23] plugin, right? Yeah, WP plugin install. [54:26] >> I think it would be either install or [54:28] download. I think [54:31] >> yeah, you need a database connection. [54:35] >> You know, it should I I I don't know why [54:37] this this is this is for this site. So, [54:39] I don't know what's going on here. Like [54:42] uh I mean it will install plugins. I [54:45] think this Yeah. Okay. So, whatever for [54:46] whatever reason, [54:48] >> I keep losing my database connection in [54:50] here, which is super fun. [54:53] WP plugin install [54:56] um what's it called? [54:59] What was the name of that plugin? Dino [55:01] for Elementor. Dina's what's it called? [55:04] >> Yeah. Dino pack for you. Maybe this [55:07] >> problem [55:08] back for Elementor, right? [55:12] >> Yeah. [55:13] >> So, if I install Okay, so I can't do it [55:15] here, which is super annoying. Um [55:18] I I don't know why that's happening. Do [55:20] I have to enable WP PCLI on this? Come [55:22] on. Come on. Y'all, [55:30] that's super annoying. [55:33] Try Let me try it on a different site. [55:35] Uh, let me try it on my badge press [55:37] site. Sure, why not? Let's just see. So, [55:39] I go into iTerm and I go WP plugin [55:45] install Dino Packac. I spell it right [55:49] for Elementor. So, what I'm trying to [55:52] test here is if it will um [55:57] if it will handle the dependencies of [55:59] this plug-in requiring Elementor. Okay, [56:02] I give up. Studio, what's your problem? [56:07] What is your problem, Studio? Um, [56:16] okay. I don't have any way to test this [56:17] right now, but I'm pretty sure I'm [56:20] almost positive and I I will look into [56:22] it that WPCLI will not look in in the [56:25] requires header and say, "Oh, you have [56:28] to download this this plug-in as well." [56:30] So, that's something that that that WPM [56:32] does that I believe WPCLI doesn't. [56:34] >> So, so what uh so if folks are asking [56:38] for that what it unlocks that WP CLA [56:42] doesn't? So, let me answer that [56:44] question. For example, let's say you are [56:46] a plug-in author, right? Every plug-in, [56:48] every complex plug-in have some sort of [56:51] helper plug-in that help you to debug it [56:52] in a better way. For example, Jetpack [56:55] has such extensions that can help you [56:57] debug your uh site in a like different [57:00] manner and that are like development [57:02] only, right? So, in those particular [57:04] cases, you can ship your particular [57:07] plug-in or theme with development only [57:11] uh dependencies, right? Now if user is [57:15] in development environment they can run [57:17] your plug-in alongside with your [57:20] development only plug-in or theme and in [57:23] production when you run it in your [57:24] pipeline you can just [57:27] uh just ignore downloading the dev [57:31] dependencies I call it or plugin and [57:33] themes requires in the development [57:35] environment only. So if you will just do [57:39] uh just let me share one thing. [57:42] Waiting on [57:44] I will give you two commands. [57:49] Okay. One is this. [57:57] Okay. I'm just going to clear my the [57:58] console here so we can see it. So the [58:00] first one is I have a feeling I know [58:02] exact exactly what that's going to do. [58:04] >> So I'm just going to run that. Okay. [58:05] Guys, now we've got query monitor [58:10] and [58:12] >> so if you will you will check your [58:14] WPM.json it will add the query monitor [58:17] into the development dependencies. [58:19] >> So those are only meant to be in [58:22] development environment. These plugins [58:25] don't need to sit in your like [58:28] production [58:29] >> right [58:29] >> and being just sitting ideal there. You [58:32] just don't install them or something [58:34] like that. [58:34] >> Right. Oh okay. Okay. And and then so [58:35] you just you it's WPM install node which [58:38] is [58:39] >> Yeah. And if you will just do WPM [58:41] install node node dependency will be [58:43] there. You will just have uh dependency [58:47] that are strictly required by your [58:49] production. You see it removed the [58:52] parameter now and you have only [58:54] production ready. [58:55] >> So if I just do WPM install again. Yeah. [58:58] So this is I mean this is pretty [58:59] straightforward. This is pretty great. [59:01] >> So this also improve your life in not [59:04] just in like while working locally but [59:06] in your CI/CD as well. Currently what uh [59:10] mostly people do is they just uh commit [59:13] uh the plug-in in their git repo because [59:16] they have to use it and it will just sit [59:19] ideal in your production environment but [59:22] you would just won't enable it. So that [59:24] sort of things happens I have seen it. [59:28] So this is particular case for query [59:30] monitor but it can be with like any uh [59:33] like plug-in or theme. For example, [59:35] let's say you are building a product and [59:38] your product have some sort of let's say [59:40] QA extra plugins that you want to [59:42] distribute only in a dev environment. So [59:45] currently it's a problem because you [59:48] have to you don't have to distribute one [59:50] plug-in rather you have to distribute [59:52] two plugins that hey download my plug-in [59:54] and download like beta tester plug-in or [59:56] QA plug-in or testing plug-in with WPM [60:00] you just have to distribute single thing [60:01] and [60:03] that extra thing will be just shipped [60:04] within development environment [60:07] >> right okay so um thro is asking are you [60:12] not but are you not slurping fromorg the [60:15] Yes. But this is not meant like [60:19] I think I think I think the disconnect [60:21] here is is is that it's not when he I [60:24] don't believe Cush is trying to to [60:28] um replace that mechanism for [60:31] distribution in in.org. What this what [60:33] this is doing what I'm seeing is that [60:35] this is a simplification of dealing with [60:39] uh plugins and themes in a production in [60:41] a in a like a large development in [60:44] environment. you like if if if if [60:48] actually this is a question I I'm gonna [60:50] say this and you tell me if I'm like I [60:53] feel like if you weren't dealing with [60:56] any plugins that were not uh private or [60:59] themes that were private, you could [61:03] >> just use composer and wp packages to do [61:05] some of these things as well. [61:07] >> Okay. Um because you're a composer, you [61:10] you're able to uh define all the plugins [61:13] that you want. They're all available on [61:15] on WP uh WP packages. That doesn't like [61:20] that would work fine. [61:21] >> Yeah. [61:22] >> And you would get to the same point. But [61:24] what WPM does is it gives you a little [61:26] bit more nice ease like quality of life [61:30] things like I'm going to install a [61:32] plugin that requires another plugin. [61:34] It's just going to install those plugins [61:35] for me and it's going to add them. Oh. [61:37] Oh, you know what I I'm I'm not I I'm [61:39] noticing is that it didn't install [61:41] Elementor as a dependency. [61:45] Is that something that I I would imagine [61:48] that if I wanted to ship this that I I [61:51] would need that. But anyways, the idea [61:53] is that when I installed Dynopac for [61:55] Elementor, Elementor got installed as [61:57] well. That's not something that that [62:00] composer [62:01] will do automatically when you do [62:03] install things, right? I I I guess [62:05] unless the packages file indicates that [62:08] somehow, but um yeah. Does that make [62:11] sense? Am I making sense? [62:14] >> Yeah, sort of. So, so the thing is that [62:16] how you want to [62:17] >> sort of best answer ever. Hello. [62:19] >> Yeah. So, actually see that what [62:21] generally composer is doing for you is [62:24] that it just downloads the jip from.org [62:28] to your local machine right and it [62:31] maintains a manifest that okay this [62:33] project uses this much plug-in and [62:34] themes. Next time someone runs WPA sorry [62:37] composer installed I will download the [62:39] JIP of this particular plug-in in themes [62:41] and I will unjip it in the current [62:43] working environment. That's the only [62:45] thing right that composer is doing. [62:47] >> So so if I ask you that you you can just [62:51] write a 10 line B script [62:54] right add plug-in and themes that you [62:57] want to download and just run bash and [63:00] that script name. What's the difference [63:01] between composer and that bash script? [63:04] basically [63:05] >> nothing. And that's that's my point is [63:08] is that [63:09] >> um [63:10] >> you're not replacing composer with this [63:13] like your intent is is is is to make [63:16] working with themes and plugins easier. [63:19] >> Yeah. So my intent is that when when [63:21] people say that composer is the package [63:24] manager of WordPress, my simple take is [63:26] that it's not because compos sorry [63:29] because package manager just don't [63:32] download the artifacts from somewhere [63:34] from some upstream to your local [63:36] machine. It does like 100 things in [63:38] between. It verifies many things. It uh [63:41] resolves a dependency. It give you [63:43] information that why this thing exist in [63:46] first place. It works based on an [63:48] environment that you are using it in dev [63:50] environment, you are using it in CI, you [63:52] are using even using it in lab [63:54] environment. It provides you tooling to [63:56] do many things. For example, it helps [63:58] you to verify uh the check some of the [64:01] things that you have downloaded. It [64:03] helps you to audit the plug-in and [64:06] themes for any security issues. So for [64:08] example people whoever you are using [64:10] like npm they must have noticed when you [64:13] do npm install in the end npm shows you [64:15] that 14 packages are in compromised [64:19] state or something like that. It tells [64:20] you that what what packages are like [64:23] having any sort of security issues, [64:26] right? So, so this is the like job of [64:28] package manager when you do with [64:30] dependencies that they take care of [64:33] dependency management end to end not [64:35] just download something from upstream to [64:37] your local because you can just simply [64:39] achieve it with a batch script or like [64:41] anything right [64:43] >> and [64:43] >> I think that's a really good point [64:44] >> and and on top of that it gives you a [64:46] like streamlined experience. So for [64:49] example when you have like you if most [64:52] of you don't know [64:54] you can use your own npm registry you [64:58] can use npm registry on github packages [65:01] you can use npm registry on on AWS you [65:05] can use github sorry npm registry on [65:07] google cloud now why these solutions [65:10] exist is that for enterprise many times [65:13] what happens is that they just don't [65:15] trust the reliability of external [65:17] registries or security state of external [65:20] registries. So they just bring in their [65:22] own registry. They manage everything or [65:24] in-house things there and they just use [65:27] npm tool because the thing is this [65:28] compliant you are building things in [65:30] such a way that npm understands npm [65:33] understand the language you can now [65:35] build anything you just type you just [65:37] attach your registry with npm you can [65:39] just download it. So that is the like [65:41] sort of vision I have with the WordPress [65:43] ecosystem. [65:45] So people can just have like their own [65:47] they can build own solution they can [65:49] plug in many things in the existing [65:51] ecosystem they can build things in a [65:53] like spec compliant way so that anyone [65:57] can use it without like writing lot of [65:59] automations manually rather they just [66:02] plug and play with existing tooling. [66:06] >> Very cool. [66:07] >> Very cool. I think um I don't know I [66:10] like it. I think it's fun. like it's [66:12] help [66:12] >> also WP without WPM it's without like a [66:16] native package manager there are like [66:18] this is not possible to bring many [66:20] things to WordPress ecosystem for [66:22] example that for many things you can use [66:27] uh existing tool let's say how you [66:29] update your dependencies today [66:32] uh in many packages dependabot can [66:35] download your composer packages even [66:37] WordPress themes and plugins but what [66:40] about the private ones [66:41] that is that are even not there on the [66:44] composer how you will download them. So [66:46] there is a gap now you have to find out [66:48] manually that okay this package have now [66:50] update available or you can even figure [66:52] out from WordPress dashboard right how [66:55] you will know that a package has some [66:58] malicious code in previous version right [67:01] so so there are like lot of sort of [67:03] things that needs to be here to make [67:06] life easy at least for developers that [67:08] is what I think I want same ecosystem as [67:11] npm in the WordPress that is like you [67:14] can put it [67:17] Yeah, I mean I think I I mean it seems [67:20] like an it seems very straightforward. [67:22] It's easy to share this stuff. [67:24] >> Um [67:27] >> yeah, I mean I don't know if I I don't [67:29] see any other question. I think I think [67:31] throw new errors actually jumped off [67:33] stream but um he had a lot of questions. [67:35] But so let me ask you this. If somebody [67:36] wants to help um how how can they if if [67:40] they want to do they just head on over [67:42] to the the the the the CLI repo or [67:46] >> Yeah, they they can go to the CLI repo. [67:49] They can just download it, try it. So [67:51] see you just uh taught me a good thing [67:54] just a while back that add support for [67:56] themes and plugins, right? That what [67:58] WPMLS theme WPMS LS plugins, right? So [68:01] that is the like sort of feedback that [68:03] I'm looking for. Now you can just create [68:04] a issue. So I can work on it. If you are [68:06] like technically proficient, you can [68:08] just raise a PR. It would be like very [68:10] helpful. You can give me ideas that what [68:12] can actually what we are missing in our [68:16] daily workflows and we can have it. So [68:19] there are like a number of things you [68:20] can suggest you can do. You can just [68:24] help me like other people help in open [68:27] source ecosystem and open source [68:28] projects. [68:30] That can be anything like fine-tuning [68:33] dogs, adding more things to do, uh [68:36] raising PRs, fixing bugs, any any sort [68:39] of things you want. [68:41] >> Cool. Oh, something's going on. Sorry, I [68:44] tried to drop the link in there and it's [68:46] only going to YouTube. I don't know [68:47] what's what's going on. Do you have the [68:49] stream open there? I'm just wondering [68:51] like did you see my last thing? I don't [68:54] know what's going on here, but there it [68:56] is. Looks like it's going in there. I [68:59] don't know what's going on. Anyways, [69:00] maybe my reream chats chat's just going [69:03] weird on me. [69:04] >> I can see the CLA repo. [69:06] >> Okay, cool. So, if you're interested in [69:08] uh helping out, that's the place to go. [69:10] I'm going to open up an issue after [69:12] we're done here about adding themes and [69:15] um into the ls command. Uh I did notice [69:18] something as well. [69:21] Um so, when we when we ran the install [69:24] Dynopac for Elementor, it installed [69:26] Elementor, but it didn't add it to the [69:28] dependencies. Now will it handle will [69:31] will it resolve these dependencies on [69:33] install but on its own [69:35] >> that's why a lock file exists there that [69:37] locks the element to a particular [69:39] version. [69:40] >> Oh okay. So if I were to say if I were [69:43] to just delete all these plugins for [69:46] example. [69:47] >> So you just can do rmrf WP content and [69:50] just run WPM install again. It will [69:53] >> uh bring everything back. Yeah. Let's [69:56] Let's I love I love RMR RF. [70:01] Here we go. Uh is this going to yell at [70:04] me? Okay. So, then I go npm. No, sorry. [70:06] W Let me clear this so chat can can see [70:09] it properly. And then just go WPM [70:14] in Oh god. Come on. Right. Install. [70:18] Okay. So, it installed everything that [70:20] it needed. Okay. So, it doesn't need to [70:24] Let me just Sorry. Let me get this open. [70:26] So here plugins. Plugins. Okay. So okay [70:30] it interesting. So this is it. This is [70:32] like interactively. [70:34] Um I I guess that's the question. It it [70:36] will figure out if any of these plugins [70:38] have dependencies. It will just [70:40] automatically install those [70:41] dependencies. Now is that that's [70:43] triggered by the readme file? [70:46] >> No. [70:46] >> I imagine in here. [70:49] So um so let's say first time you will [70:52] install a dependency right? [70:55] >> Yes. So [70:57] >> first time uh it will so see what [70:59] happens is that when I publish any new [71:02] plugin to the WPM registry it will parse [71:05] your readme.txt and main plug-in file [71:08] >> and it will take a look at the request [71:10] plugins. Yeah that's the exact field. [71:12] >> Okay. [71:13] >> And it will add that as [71:14] >> dependence. That's exactly what it's [71:15] doing. So anytime you install a plugin [71:17] it just automatically scans that. So is [71:19] that more or less efficient? This is a [71:21] random question. Then just once it's [71:24] determined it, it just adds like is it [71:28] more efficient? I don't know. You you [71:30] tell me. I I know that uh this is [71:32] written and I I want to say I think you [71:33] told me. [71:34] >> So you should see the WPM.json inside [71:36] Dynopac for Elementor and it will make [71:38] things easy for me [71:42] in Danop for element. [71:44] >> Oh, right there. Okay. [71:45] >> Here it is. [71:46] >> That's where this is coming from. [71:47] >> Yeah. [71:48] >> Yeah. Okay. And so is is this something [71:50] that has been shipped with Dino pack for [71:52] Elementor? [71:53] >> No. [71:53] >> Ah, [71:54] >> I do it in automation. [71:56] >> So this is [71:58] >> Oh, I there's there's one in there too. [72:01] >> Yeah. [72:02] >> Oh, [72:02] >> every every package will have it. [72:04] >> So this is [72:05] >> this is the like meta data of the [72:07] plug-in. [72:09] You will find everything [72:10] >> interesting [72:11] >> platform PHPWP like what platforms it [72:14] supports and uh tags homepage everything [72:18] it will add there. [72:21] >> Okay. [72:21] >> And from this metadata [72:24] >> and from this metadata WPM CLI resolves [72:27] that what it needs to install. [72:30] >> And so are what at which at what point [72:33] is this created? Is this created when [72:36] you're running npm WPM install and it [72:39] installs advance? No. Okay. [72:40] >> It's it's created at the time when it [72:42] downloads the text from SVN in the [72:46] GitHub action. [72:46] >> Oh, so so this is so you're adding this [72:50] into the zip I guess or whatever. [72:53] >> Yeah. [72:53] >> Um on on the server side. Okay. So [72:56] that's how it's handling it. So it is [72:57] just as a so we don't need to store that [72:59] at the project level. We just need to [73:02] restore that this is the thing we [73:03] actually need and it handles um [73:07] >> uh yeah uh okay couple of questions one [73:11] is from Kevin um how will it make money [73:15] >> so my idea is to uh to make it [73:18] sustainable is that registry also [73:20] supports private plug-in and themes so [73:24] instead so currently what happens is [73:26] that let's say you are uh authoring a [73:28] premium plug-in or theme you will have [73:30] to set up your own infra to distribute [73:31] that, right? [73:33] >> Mhm. [73:33] >> So instead of setting up your own infra, [73:37] publish your private plug-in or theme on [73:39] WPM for even less than [73:42] >> it would take you to set up your own [73:43] infra and then in in you know like [73:46] better way how it will help ecosystem is [73:49] that from a single place you can [73:50] download all the private all the public [73:53] plug-in. [73:55] So this is the like so this is that [73:57] that's why I keep the registry so that [73:59] people can add private public and with [74:03] any sort of visibility they can just [74:04] push it there and you just don't have to [74:07] manage multiple authentication systems [74:09] and all that to download your um private [74:12] and public managed uh plug-in in themes [74:15] just so so you must agree with me that [74:17] it was very fast when you run WPM [74:20] install and the plug-in name right [74:23] >> yeah it was very fast and and you can [74:25] like add 20 plugins or themes name [74:28] there. It will just install them in less [74:30] than a second. Now imagine that in that [74:34] particular list five plugins are private [74:36] and five plugins are uh public and and [74:40] feel like what type of developer [74:41] experience you will get out of it. [74:43] Right? So, so even to test it, I can [74:47] like give you a very big list to test [74:50] its capability. [74:54] >> Just [74:54] >> um just while you're doing that, Ali [74:56] man, Ali Ma'am is uh saying, "Is this an [74:59] interview?" Uh I guess it's an [75:00] interview. It's with my man Love Cashar [75:03] here and we are talking about his WPM.Oo [75:06] um product. So, uh you can scroll back [75:09] in chat and see what's what we're [75:11] talking about. like it's more of a like [75:13] open source project. [75:15] >> I small Yeah. No, no work involved. Let [75:18] me uh Okay. So, this is what you're So, [75:20] this is installing. [75:21] >> Yeah. [75:22] >> One, two, three, four, five, six, seven, [75:26] eight plugins. Looks like eight eight [75:28] plugins. So, let's see how fast that can [75:30] go. And the market set. [75:34] >> That was lightning fast. That was really [75:37] fast. And now imagine that out of these [75:39] eight plugins, four are public and four [75:41] are private. Then this is the sort of DX [75:44] that we reserve like at least as a [75:46] developer instead of setting up 10 types [75:49] of automation to download private stuff [75:51] from 10 different servers. [75:54] >> Yeah, this is cool. Um [75:58] I don't know if chat wants to answer the [76:01] the question. It's a it's a WordPress [76:04] package manager wpm.so. Go and check it [76:07] out. I'll drop the link and you can go [76:08] read about this. Um, [76:12] where is it? Oh, I've lost the link. [76:14] Have I lost the link? [76:17] M.S.O. [76:20] There it is. Go. You can go have a read [76:23] there. Um, [76:28] cool. Anyways, uh, awesome. Okay. Well, [76:30] yeah, like I think you're right. I think [76:32] that like the the development experience [76:34] should it shouldn't matter where these [76:35] things are hosted. [76:37] >> Like I because if you're just like [76:39] setting up a project and going to work [76:40] on it, you don't why would I care what [76:42] whether this is a private repo or [76:45] publicly hosted on.org or both or [76:47] whatever like it doesn't matter. So I [76:49] think I think I think you're right. Just [76:51] like a nice just install. There it is. [76:53] Now now go do your work. [76:55] >> Also very fast. One one great thing [76:57] about this is that since this is specd [77:00] driven everything is in like in a [77:02] deterministic way it's universal that [77:05] with WPM you will have a manifest file [77:07] and then you will have a tarboard. So [77:09] you can integrate with it with like any [77:11] tool you want. For example I am seeing a [77:14] comment in pitch that [77:17] uh getting this into playground would be [77:19] cool. So yes to playground team that [77:22] whether they want to integrate it [77:25] >> and see I am sharing one more link with [77:27] you if you can please open it on your [77:29] screen. [77:29] >> Yeah sure. [77:30] >> So playground team can just [77:34] uh like get whatever information they [77:37] need about a package from the registry [77:39] and they can just integrate into their [77:41] own system because like there are no [77:44] gotchas everything is in public there [77:46] they can just integrate. Okay, [77:49] >> this is the manifest for Jetpack plugin. [77:52] >> Mhm. [77:53] >> You can figure out that what things it [77:55] will need like what WP version this [77:58] plug-in will require, what PHP version [78:00] this plug-in will require and you can [78:01] just spin up your own thing. You can [78:03] integrate in your like studio or in your [78:06] playground whatever you like. [78:07] >> Yeah. Yeah. Yeah. Yeah. I mean I don't [78:09] see why like playground does it have [78:11] command line? Um, so Playground does [78:14] have [78:15] it does have WP CLI in it, which would [78:18] mean that there would be some sort of [78:19] command line interface. So I I don't see [78:22] why it wouldn't be a possibility. It's [78:24] an interesting concept though. Um, [78:26] because really like you're just you just [78:28] want to be able to run command line [78:31] commands, command line commands, right, [78:34] in playground. [78:37] Here's playground. Let's let's take a [78:38] look. That's not it. [78:41] That's not it. I go to settings. So, [78:43] let's go settings network [78:47] >> on playground. I think you can add zip [78:48] files as well and it will uh download. [78:52] >> Yeah, you so you can you can um you can [78:55] definitely uh [78:58] install plugins [79:00] >> um [79:03] >> from [79:03] >> so you have to add in I think some sort [79:05] of blueprint. I'm not [79:07] >> Yeah. Yeah. Well, that would be [79:09] interesting. You know what why might be [79:11] be super helpful for you is to generate [79:13] a blueprint that demonstrated this um [79:18] like just to be like hey and it works [79:20] with playground too here you know blah [79:22] blah blah here's your here's a blueprint [79:24] showing you how to do that I I think [79:25] that would be very neat because um you [79:28] can use CLI so you you can actually like [79:31] have it install CLI [79:34] uh like WP CLI and then and then run it [79:37] that way but um I'd have to look at the [79:39] steps So maybe um uh Felif is probably [79:42] someone that we should talk to about [79:43] this um just to see what command line [79:46] stuff is actually available. Uh which is [79:48] kind of neat. So [79:50] Oh, you can search anything from [79:54] Oh yeah, cool. Oh, now you're you're [79:56] just answering the questions. You don't [79:58] even need me here anymore. I'm just I'm [79:59] just I'm just hanging out. [80:01] >> I just didn't want to interrupt you. [80:03] >> No, no, no, no. Please do. Also also [80:06] like one more thing that I am planning [80:08] to expose a composer compatible AI as [80:12] well from WPM. So it's not just like [80:14] that you can only take take advantage of [80:17] this WPN registry from WPM CLI even [80:21] though it's preferable that you use for [80:23] like all sort of security measurements [80:25] and that is stuff but you in near future [80:28] you will be able to use WPM registry [80:30] from uh composer as well. [80:33] So I I am doing so because uh it will be [80:38] uh measurable faster since I will be [80:40] distributing [80:42] uh plug-in or themes artifacts as [80:46] compress instead of jip [80:50] >> which and gif has like compression [80:52] ratio. So you will find like latency if [80:55] you are using WPM composer API instead [80:59] of the aggressive. [81:02] Oh, sorry. I keep clicking on the wrong [81:03] link here. Um, okay, cool. [81:06] >> Um, well, this has been great, man. This [81:08] is really good. I I I think this is fun. [81:11] Um, I mean, I'm not building massive [81:15] uh projects anymore. Um, but I can see [81:18] how this is super helpful in in that [81:21] case. Um, [81:24] so the model that you're hoping to to [81:28] implement for sustainability is [81:30] basically paid um in infrastructure for [81:34] folks that want to manage their their [81:36] their stuff. But is there also like if [81:38] someone if someone just loved what you [81:39] were doing and wanted to donate is like [81:41] do do you have a [81:43] like is there a a can they get can they [81:46] donate to your GitHub account or [81:48] anything like like that? I haven't uh [81:50] set the sponsorship yet. [81:54] >> That's the word I was trying to Yeah. [81:55] >> Yeah. I I haven't set it, but maybe I [81:57] will set it up. [81:59] >> Sure. Yeah, I I would. And then Yeah. [82:01] Merch. [82:02] Is there is there going to be a WPM [82:05] shirt because I I'll wear it. I'll [82:08] PM.so. Good to hear. [82:09] >> Yeah. But I would appreciate if you can [82:12] >> give the repo a star. It will help me to [82:16] open source grants [82:17] >> from like different ecosystem. I'm [82:19] trying to get one from Docker so that I [82:23] can publish uh images on Docker and then [82:25] anyone can just pull them without [82:26] limits. So, this thing will help. [82:28] >> Oh, nice. Yeah. So, go and I'll drop the [82:31] the link in here. So, if you're in in [82:33] chat and you have a GitHub account, get [82:34] over there, click on that, start it. Um, [82:37] this has been great. This has been [82:38] awesome, man. Well, thank you so much. [82:40] Love we got about four minutes left. [82:42] I feel like this is a pretty good place [82:44] to kind of wrap it up, but uh does [82:46] anyone in chat have any questions that [82:49] they want to ask? Um [82:53] and I have a couple of things, but I [82:56] will not just because I'm constantly [83:00] self-promoting, but [83:04] excuse me. Oh my god. No. No. Okay. So, [83:08] let me I'm just going to do a little [83:10] back scroll here. So, I think we've got [83:11] everything. We've answered all the [83:13] questions, but [83:15] um is are when will we see you next? Are [83:19] are you going to be are are are you [83:20] coming to work camp Europe by any [83:22] chance? [83:23] >> Uh no, but I wanted the opportunity. [83:26] >> No. [83:26] >> Yeah. [83:27] >> Okay. Well, I guess we'll have to see [83:28] you online until we don't. But um it was [83:32] great hanging out in [83:34] >> Yeah. [83:34] >> India. It was my first time in India. I [83:36] I enjoyed it. Now that there's going to [83:37] be a word camp India like specific [83:40] fourth [83:41] >> flagship it's going to be very cool. I [83:43] don't know did they announce where where [83:45] it is yet? Have you heard? [83:47] >> I I'm not I I don't think they announced [83:49] it. [83:50] >> No. Okay. So that'll be interesting. [83:52] >> Um so cool. So if I don't see you [83:55] hopefully I'll see you at one of those [83:56] ones. But um speaking of this is a [83:59] really nice segue. Speaking of work [84:00] camp, I'm going to be there and uh I if [84:04] if anyone uh wants to grab some time [84:06] with me, I have a calendarly link set [84:08] up. Uh I I I dropped it in chat. We can [84:11] talk about AI. We can talk about WP.so. [84:13] We can talk WPM.so. I'm sorry. We should [84:15] all could also talk about coming on the [84:17] stream. Talk Debbie to me, which is [84:20] ridiculously fun title. Uh but yeah, so [84:23] if you're interested, grab grab a slot [84:24] time with me and uh I'll be tweeting [84:26] this out and everything before we go, [84:28] but I think it's next week. I have to [84:30] leave to go. I'm doing a workshop there. [84:32] It's on the interactivity API. So [84:34] hopefully we're there. Um [84:39] I want a better plug-in search. Oh, Kev [84:41] Kev's always got great ideas. Just ask [84:43] Kevin and Kevin will be like, "Yeah, [84:44] here's 10 ideas and here's 20 ways to do [84:47] it." And he's he's a smart dude. [84:50] All right, cool. Well, maybe we should [84:52] wrap it up. Uh, love C. Thanks again. I [84:55] don't know what time it is for you. It [84:56] must be super late right now. I don't [84:59] know. [84:59] >> No, no, it's not that much late. It's [85:01] 9:30 p.m. Yeah. [85:04] >> Oh, okay. Well, yeah. So, you're nine [85:06] hours ahead of me. So, that's nine and a [85:08] half hours ahead of me. It's only noon [85:10] here [85:11] >> time. So, it's not too bad. Not too bad. [85:13] But, um, thanks again for taking the [85:16] time to to talk to us about WPM.So So, [85:19] and uh and walking us through it. I [85:21] loved it. It was fun. Um so, uh in the [85:25] YouTube description, there are all the [85:27] ways to get in touch with with Love Cesh [85:29] and we've also um linked everything [85:32] everywhere. So, if you're interested, [85:33] reach out to him or me and uh you know, [85:35] we can make some connections here, get [85:37] some get some love happening to uh WPM. [85:43] Cool. All right. Well, we're going to [85:44] call it, but uh thanks for hanging out [85:46] today. um everyone in chat and we will I [85:50] won't be streaming next week because I [85:51] will be at War Camp Europe, but then the [85:53] week after [85:54] >> I will be streaming and then I think I [85:56] have my next guest set up. You know him [85:58] and love him as Terrence. Uh he's he's [86:01] he's going to come on and show us [86:03] something that he built that I'm going [86:04] to completely make fun of because that's [86:07] how we do things anyways. Okay, but [86:09] enough about that. Love kiss. Thanks so [86:11] much, man. And we'll talk to you all [86:13] later. Okay, we'll talk to you soon. [86:15] Have a good one.  📄 **Full text:** ![[Full Document Contents/Articles/Talk Devy to Me WPM With Lovekesh Kumar.md|Talk Devy to Me: WPM With Lovekesh Kumar by YouTube]] ## Highlights - the those packages using composer tool. So composer is another package manager just like npm but it's for PHP ecosystem. ([View Highlight](https://read.readwise.io/read/01ktwhdsfxdc20rx4tdegv2ad8)) - Note: Positioning vs Composer/npm — tradeoff is another tool + centralized registry dependency + vendor adoption - Tags: atom/literature/h2, wpm - >> yeah. So I just use npm as like terminology to talk about that what WPM is actually. So we can like forget about npm here because it's the package manager for JavaScript and it won't help us much when it comes to distributing >> it doesn't handle any of the WordPress JavaScript stuff. >> Yeah. Yeah. It it just handles like JavaScript packages that you want to install but WordPress uh like plug-in and themes are mostly PHP code wired up in a different way. So we we should omit ([View Highlight](https://read.readwise.io/read/01ktwhacp39cc6ea2facsn62r6)) - Tags: 👻 ai highlighted - terminology to talk about that what WPM is actually. So we can like forget about npm here because it's the package manager for JavaScript and it won't help ([View Highlight](https://read.readwise.io/read/01ktwhdphex27qvycsfd959ft7)) - Note: WPM = a WordPress Package Manager (Lovekesh Kumar) — npm-style plugin/theme management for WP - Tags: wpm, atom/literature/h1 - not for those folks. This is for people that are building an entire um microcosm I guess. So like like so your your project has got four themes and 15 plugins and all this stuff and you want to manage it all in source control and you want to make sure that you have versions and all all of that stuff. I think that's the problem that this solves is the ability to >> so so this is the thing like if if I say that uh this is the thing that composer can also handle right so WPM is like you ([View Highlight](https://read.readwise.io/read/01ktwhacr5kpp7dthmj1z0xnfy)) - Tags: 👻 ai highlighted - >> Oh, sorry. Oh, install. Okay. >> Yeah, WPM install. >> But do I have to do that from my WP content folder? >> Uh no, no, no. Just just do it in the root. So what WPM does it that by default it will place your plug-in and themes into the WP content folder until and unless you have configured it to be somewhere else. >> Okay. So all right so I and then what do I pass? So if I want to do install uh oh no ([View Highlight](https://read.readwise.io/read/01ktwhact7rfqbdzct7new7dz7)) - Tags: 👻 ai highlighted