File consistency check
This page is for administrators and hosting teams. Every Exponential release ships share/filelist.md5, a list of
checksums of its files. Comparing the installation with it shows whether a file was changed, removed or left behind,
whether by an upgrade gone wrong or by an intruder
(File consistency check).
Contents
Running the check
In the administration: Setup > Upgrade check (/setup/systemupgrade), Check file consistency. It reads
share/filelist.md5 and the manifest of every active extension that carries one, groups the findings (modified,
missing, unreadable; files tracked but not listed; malformed lines), shows the manifest dates, and offers the result as
CSV or text (The upgrade check). Check database consistency compares the schema.
On the command line, from the document root the web server uses:
bash bin/shell/verifyfiles.sh # summary and the files that differ
bash bin/shell/verifyfiles.sh --quiet # exit status only: 0 = all files match
php bin/php/checkmanifest.php --all --extensions # same class as the admin page
php bin/php/checkmanifest.php --all --extensions --csv # findings as CSVWhen to run it
| Moment | Why |
|---|---|
| after every update | anything left behind or edited by hand shows at once |
weekly, from monitoring (--quiet, alert on exit status 1) | unnoticed changes |
| after an incident or a suspicious alert | to see which files an attacker touched |
| before a penetration test or an audit | to start from a known state |
Reading the findings
- Modified kernel file you did not change: treat as a possible compromise until explained. Compare with the release (the tag on GitHub) and look at the audit trail around the file's modification time.
- Modified file you did change (a local patch): move the change into an extension or an override; patched kernel files are lost at the next update.
- Missing file: an incomplete update or deployment.
- Files git tracks but the manifest does not list (a note, on an installation that is a git checkout): files added after the manifest was made; a file nobody can explain deserves a look.
Releases are immutable tags: a fix arrives as the next version, never as a changed copy, so the manifest of a version always describes the same files (SECURITY.md).
Limits
- It covers the files the manifests list: the kernel and extensions that ship a manifest. Your own extensions,
settings/overrideandvar/are not covered. - An attacker with write access could change the manifest too; keep a copy of the release's manifest off the server, or compare with the tag.
Related pages
- File consistency check
- The upgrade check
- Patching cadence
- Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.
Become an Exponential Partner
Partners share their information, provide funding, contribute back and develop the products with us, and that is how Exponential grows. A partner website and dashboard are planned for mid-2027: please become a partner today to speed up our growth rate and land new features faster.