wp-admin/includes/file.php:1534Retrieves the list of signing keys trusted by WordPress.
string[]One hook fires while wp_trusted_keys() runs, in this order:
Filters the valid signing keys used to verify the contents of files.
function wp_trusted_keys() { $trusted_keys = array(); if ( time() < 1617235200 ) { // WordPress.org Key #1 - This key is only valid before April 1st, 2021. $trusted_keys[] = 'fRPyrxb/MvVLbdsYi+OOEv4xc+Eqpsj+kkAS6gNOkI0='; } // TODO: Add key #2 with longer expiration. /** * Filters the valid signing keys used to verify the contents of files. * * @since 5.2.0 * * @param string[] $trusted_keys The trusted keys that may sign packages. */ return apply_filters( 'wp_trusted_keys', $trusted_keys );}Introduced in 5.2.0. Unchanged from 6.7.7 through 7.1.0.
Signature, return type and hooks compared across 5 parsed releases.
src/wp-admin/includes/file.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.