Rethink the relation of checklist checks and checksum verification

[chesio]

Motivation: Now when checklist checks are executed asynchronously, it could make sense to include checksum verification as yet another check in the checklist.

Notes and questions to be considered:

1. Does it make sense to log checksum verification alerts? In general, what check failures (and how) should be logged?
2. Does it make sense to have separate cron jobs for checksum verification, when it would be possible to just run it within checklist monitoring?
3. It seem that some kind of distinction between simple and complex checks is necessary as some checks (removed plugins, checksum verification) are slow to execute, because they rely on external HTTP requests, so running them asynchronously/in separate cron task is viable. On the other hand, simple checks could be executed within single AJAX request/cron task.
4. Checksum verification (but possibly some other checks too) can produce a long error report. If it should be included in checklist, UI has to be adapted to account for this.

[chesio]

Does it make sense to log checksum verification alerts? In general, what check failures (and how) should be logged?

Short answer: no.

Long answer: I believe only events that are unique and non-reproducible by their nature should be recorded in events log. Failed checksum verification check can be reproduced, while failed login attempt obviously cannot.

What should be logged though, are failures due to API connection errors. But I don't think these should be logged in the events log, rather logged as standard PHP warnings (and end up in debug.log if configured) - this is what core update mechanism does in case of connection errors too. Whether they should be also reported via notifications mechanism is an open question.

[chesio]

Does it make sense to have separate cron jobs for checksum verification, when it would be possible to just run it within checklist monitoring?

I think it does. See also point 3. I think every check that depends on external HTTP request should be contained in its own execution thread (ie. cron task when run non-interactively or AJAX request when run interactively).

[chesio]

It seem that some kind of distinction between simple and complex checks is necessary as some checks (removed plugins, checksum verification) are slow to execute, because they rely on external HTTP requests, so running them asynchronously/in separate cron task is viable. On the other hand, simple checks could be executed within single AJAX request/cron task.

I think this distinction should be also emphasized in UI of checklist page. One may not prefer to run checks that require talking to wordpress.org or any other external service. A rough idea is to split the checklist page in two sections: basic checks that do not require any external HTTP requests and advanced checks that do.

[chesio]

Checksum verification (but possibly some other checks too) can produce a long error report. If it should be included in checklist, UI has to be adapted to account for this.

As a first try, maybe just display full report in jQuery UI dialog.

This task would likely need more thoughts (and iterations) to find a good solution.

[chesio]

Ok, all concerns except the last one (possibly excessive length of checksum verification report) have been dealt with, closing.