Can the uniqueness of the plugin file/plugin slug and version number be trusted?

Question

I am wanting to identify plugins and their contents, and am looking to see if I can avoid calculating the hash of all files in each plugin.

My immediate approach was to use the plugin slug or plugin file (see https://wordpress.stackexchange.com/a/290402/9702 for the distinction) and the version number.

However in the past I have come across plugins where the free version in the WordPress.org plugin repository and the paid-for version have shared the plugin slug and/or plugin file plus had overlapping version numbers. This is bad if you want to know which plugin is installed, because Foo v2.3 is no longer unique. Unfortunately I have forgotten which plugins did this.

Recently all examples I've seen of free/paid-for plugins have -pro appended to the plugin slug for the paid for version. Are there any you know of where the slug/plugin file is still reused for variants of the same plugin?

Answer 1

Not really. There's no 100% reliable way to guarantee that wordpress-seo/wp-seo.php on one site is the same plugin as wordpress-seo/wp-seo.php on another site, short of hashing the files, as you mentioned.

It is highly unlikely that they are different plugins, but since there is no centralised system for registering unique plugin names, it cannot be guaranteed with 100% certainty.

Plugins on the wordpress.org repository obviously have unique names, but there's no stopping a developer using the same slug for a plugin distributed elsewhere. This can actually cause problems, as WordPress may report an update available for an external plugin if there is a plugin with the same name in the wordpress.org repository with a higher version number.