I agree with the concept of a new hook - however it should not be used by plugins to do their own version check. This should be part of the plugin framework to have the feature to test a server URL for a newer version of the plugin, automatically download it (using the one click update code that is already there in core). Wordpress plugin management is a good example of a nice plugin admin UI.

• add sha1 integrity check for the download
  • api.piwik.org/1.1/getLatestversion/ returning both version number and hash
  • builds.piwik.org: releases with corresponding sha1.txt files
• allow user to manually upload the zip file; Piwik detects, prompts user, extracts, and installs; the zip file would be deleted after a successful update (current behavior)

Re- allow user to manually upload the zip file;

I saw some web softwares also exposing an interesting installation process: you download one php file, that will then fetch the .zip from piwik.org/latest.zip, unzip it on the server, and redirect the user to the install page. This is interesting especially to avoid the user to FTP upload the full release which is now 3MB zipped. Anyway, I dont think this is a high priority now as it means exposing both ways to install/download piwik (the classic way + this magic php file) which makes things a bit complicated to explain, but this is interesting.

re-sha1 this makes sense. If users complain more about this, we can consider doing it. So far, I have seen only one complaint and the zip unpacking will fail anyway, which is fine.

We have to generate sha1 hashes for WAG, so this isn't a stretch.

Re: manual upload, I was thinking along the lines of updates, but your idea for fresh installs sounds interesting. We have all the code...

see also: #1043

resolving for now - if one wants to specc a future plugin repository for Piwik plugins, it would be better to open a ticket dedicated to it. The improvements made in #1097 are also related to this ticket

can we maybe close this ticket and put requirements in #1116 ?