gohanman

FWIW, I did look at the documentation before posting. What’s distinctly not helpful about the documentation is that it also does not say which version of OpenSSL is supported. Saying “more than 5 years old” is way more ambiguous than listing a minimum version number. Also, OpenSSL 1.0.1 was released a bit over 6 years ago.

Yeah. The problem actually stemmed from the security advice here: https://codex.ww.wp.xz.cn/Writing_a_Plugin#Plugin_Files

I wrote

defined( 'ABS_PATH' ) or die( 'No script kiddies please!' );

instead of

defined( 'ABSPATH' ) or die( 'No script kiddies please!' );

but die() isn’t really a fatal error. It just prints to STDOUT (which presumably gets eaten by output buffering somewhere) and exits.

Something like this would probably be a better solution.

if (!defined('ABSPATH')) {
    trigger_error('Invalid call state', E_USER_ERROR);
}

Version control! I never had WordPress itself under VC, but there was an old .svn folder farther up the directory tree (an artifact of hosting multiple domains under the same root directory). It took a bit of digging through the code to figure out what paths it was checking for version control.

From what I saw tracing through this, it looks to me like automatic background updates won’t run under any of the following conditions:
a) both cURL and streams are unavailable
b) cURL and/or streams do not have SSL support
c) WordPress appears to be under version control

IMO it would be helpful to note somewhere which of these checks is failing. I realize this isn’t useful information to all users and showing it prominently would confuse more than it helps, but having the details available somewhere would have been quicker than familiarizing myself with WP’s HTTP abstractions to figure out what was happening.