Ryan McKern

This article was orig­i­nally about auto­matic updates over SSH2 not work­ing for me when I upgraded to Word­Press 2.8. Word­Press 2.9 is out now, and this prob­lem turned out not to be their fault.

After fil­ing a bug report and work­ing through it with the Word­Press team, a solu­tion was even­tu­ally found (see the final update to this post). If you're not inclined to skip to the end then here is a spoiler: turn off open_basedir or make the dec­la­ra­tion less restrictive.

If you're not expe­ri­enc­ing this prob­lem (and Google says you're land­ing here if you're look­ing for help set­ting up SFTP/SSH updat­ing for Word­Press), I don't think this write-up will be of much help. But feel free to stick around; I've got snacks!

After upgrad­ing to Word­Press 2.8 I dis­cov­ered that this update has bro­ken auto­matic core and plu­gin updates for me. I use SSH2/SFTP as I don't trust, like, need, or sup­port FTP, and the SSH log only shows that the PECL mod­ule is open­ing a con­nec­tion and then clos­ing it, with Word­Press return­ing only the fol­low­ing to to the browser window.

Unable to locate Word­Press Con­tent direc­tory (wp-content).

I dug through how Word­Press han­dles upgrades, and tracked this all down to the /wp-admin/includes/class-wp-filesystem-ssh2.php file.

UPDATE 6/13/2009 @4:40PM EST

From what I found, the rewrite of the SSH/SFTP2 update func­tion hap­pened because the ssh2.sftp wrap­per was intro­duced. This replaced the older ver­sion of the func­tion which copied con­tents into temp files and pushed the data around. It was a dras­tic speed increase, but it doesn't bloody work on my sys­tem for one rea­son or another.

UPDATE 6/13/2009 @7:16PM EST

I've offi­cially cried "uncle!" and turned to the most wretched hive of scum and vil­lainy in blog­ging, the Word­Press forums (as well as their bug report­ing and tick­et­ing sys­tem). I also iden­ti­fied the patch which intro­duced the code which caused SSH2 sup­port to go fly­ing off the rails for me.

UPDATE 6/18/2009 @4:17PM EST

The Word­Press team has marked this bug as belong­ing to mile­stone 2.9. There is a slim chance that maybe I'll see some relief in 2.8.1, but more than likely they're going to yet again refac­tor how SSH2 works for auto­matic upgrades. If this changes, I will update this post accord­ingly. For now, I believe I may have to sim­ply let it be broken.

UPDATE 12/19/2009 @10:30PM EST

Months later, I worked out what the prob­lem was. Ulti­mately a con­flict caused by use of PHP's open_basedir and safe_mode kept the SSH2 mod­ule from access­ing resources it needed. The way the ssh2.sftp wrap­per works would bump into overly restric­tive basedir dec­la­ra­tions. If you are expe­ri­enc­ing this prob­lem and you check your error logs after turn­ing them up to "debug", you'll prob­a­bly find out what direc­tory or file is caus­ing this con­flict. It's ulti­mately moot, since things like safe_mode are dep­re­cated in PHP 5.3 and being out­right removed in PHP 6.

Oddly enough, updat­ing libssh2 to some­thing more up-to-date than the out­dated RPM pro­vided by Dag for Red­Hat Enter­prise Linux/CentOS made a HUGE speed dif­fer­ence. Def­i­nitely some­thing to look into if SSH updat­ing is slow for you.

Other than that, this round of upgrades has been mostly pain­less, and the hyped speed increases are not just hyper­bole. Word­Press 2.8 feels only slight under-baked beyond SSH2 hic­cups. I con­fess that I haven't had a chance to play with the redesigned side­bar wid­get admin­is­tra­tion yet though, as I haven't even fig­ured out how I want to imple­ment sup­port for side­bar wid­gets into this theme.

The bug that deletes some cus­tom fields if you update posts that have them is still there. No idea how to begin track­ing that one down, but I can state author­i­ta­tively that it's theme and plu­gin inde­pen­dent. Why am I link­ing to some dudes blog, and not the offi­cial Word­Press bug tracker? because I don't even know where Word­Press keeps its bug tracker.

I also had to reset Word­Press Blog stats because Word­Press was track­ing the wrong sub­do­main for all of my stats. The num­bers tal­lied up with Google Ana­lyt­ics and the AWF­Full log grinder, but the URLs were all effed up. I fixed the prob­lem on the WordPress.com back­end, and in the process lost months of aggre­gated history.

The upshot to this loss is that I hope to have a new round of search hit inspired com­men­tary ready to go in a week or two.