Akeeba Panopticon

Public CMS Core Files Checksums API

What is this?

We offer MD5, SHA-1, SHA-256, and SHA-512 checksums for the core files included in all published versions of Joomla!®. These are used by Akeeba Panopticon to verify the integrity of your installation, but they can also be used by anyone else.

Accessing the Checksums

The endpoint URL for the checksums is https://getpanopticon.com/checksums/cms/version/checksum_type.json.gz

The cms parameter is currently always joomla.

The version parameter is the CMS version, e.g. 5.0.0.

The checksum_type is one of md5, sha1, sha256, sha512, md5_squash, sha1_squash, sha256_squash, or sha512_squash. The *_squash versions have the corresponding checksum of the “squashed” version of the file. You can get the squashed version of a file using this function:

$squashed = preg_replace('#[\n\r\t\s\v]+#ms', ' ', $contents);

“Squashing” the contents of a PHP or JavaScript file ensures that the checksum will not change when a safe change takes place on the file: conversion between UNIX (LF) and Windows (CRLF) line endings, conversion between tabs and spaces, added/removed whitespace, added/removed blank lines.

If the cms, version, or checksum type you are looking for does not exist you will receive an HTTP 404 Not Found response.

The returned file is a GZip–encoded JSON file. You can convert its contents to a PHP array with:

$array = json_decode(gzdecode($fileContents), true);

The result is a string-indexed array where the key is the filename relative to the site's root, and the value is the checksum.

Only PHP, JavaScript, and INI files are included in the checksum results.

Download URLs

The endpoint https://getpanopticon.com/checksums/sources.json.gz serves a GZip-compressed JSON file with the download URLs of every Joomla! version published to date. The format is as follows:

[
  {
    "cms":"joomla",
    "version":"1.0.0",
    "url":"https:\/\/downloads.joomla.org\/cms\/joomla10\/1-0-0\/joomla_1-0-0-stable-tar-gz?format=gz"
  },
  ⋮
]

Do check the value of the cms key. Future versions of this file may include download resources for other CMS types.

Accuracy, and update frequency

The point-of-truth used to derive the download URLs is Joomla's downloads.joomla.org site. The official full installer ZIP files listed for each version in that site are used as the point-of-truth to derive the list of files and their checksums.

The information is updated approximately once per hour on our server. Our server is behind CloudFlare CDN, which adds another delay of up to one hour when serving data. Therefore, new releases may not appear on our endpoint for up to two hours.

No guarantees are made for the accuracy of the information provided by this endpoint beyond our assurance that they reflect the data provided by the official CMS source, as seen by our server at the time the information was processed.

Reproducible, auditable content

We believe in radical transparency. We hate black boxes.

The source code of the application used to generate the checksums is publicly available under the GNU Affero General Public License, version 3 or the license or, at your option, any later version.

Please note that the initial run of that application takes several hours and consumes a significant amount of bandwidth (around 7GiB in October 2023, when it was first released).

Legal notice

This site is not affiliated with or endorsed by the Joomla! Project. It is not supported or warranted by the Joomla! Project or Open Source Matters. The Joomla! logo is used under a limited license granted by Open Source Matters, the trademark holder in the United States and other countries.