src/WP_CLI/Core/CoreUpgrader.php
public function download_package( $package, $check_signatures = true ) {

		/**
		 * Filter whether to return the package.
		 *
		 * @since 3.7.0
		 *
		 * @param bool    $reply   Whether to bail without returning the package. Default is false.
		 * @param string  $package The package file name.
		 * @param object  $this    The WP_Upgrader instance.
		 */
		$reply = apply_filters(
			// phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- Override existing hook from Core.
			'upgrader_pre_download',
			false,
			$package,
			$this
		);
		if ( false !== $reply ) {
			return $reply;
		}

		// Check if package is a local or remote file. Bail if it's local.
		if ( ! preg_match( '!^(http|https|ftp)://!i', $package ) && file_exists( $package ) ) {
			return $package;
		}

		if ( empty( $package ) ) {
			return new WP_Error( 'no_package', $this->strings['no_package'] );
		}

		$filename  = pathinfo( $package, PATHINFO_FILENAME );
		$extension = pathinfo( $package, PATHINFO_EXTENSION );

		$temp = Utils\get_temp_dir() . uniqid( 'wp_' ) . ".{$extension}";
		register_shutdown_function(
			function () use ( $temp ) {
				if ( file_exists( $temp ) ) {
					unlink( $temp );
				}
			}
		);

		$cache      = WP_CLI::get_cache();
		$update     = $GLOBALS['wpcli_core_update_obj'];
		$cache_key  = "core/{$filename}-{$update->locale}.{$extension}";
		$cache_file = $cache->has( $cache_key );

		if ( $cache_file && false === stripos( $package, 'https://wordpress.org/nightly-builds/' )
			&& false === stripos( $package, 'http://wordpress.org/nightly-builds/' ) ) {
			WP_CLI::log( "Using cached file '{$cache_file}'..." );
			copy( $cache_file, $temp );
			return $temp;
		}

		/*
		 * Download to a temporary file because piping from cURL to tar is flaky
		 * on MinGW (and probably in other environments too).
		 */
		$headers = [ 'Accept' => 'application/json' ];
		$options = [
			'timeout'       => 600,  // 10 minutes ought to be enough for everybody.
			'filename'      => $temp,
			'halt_on_error' => false,
		];

		$this->skin->feedback( 'downloading_package', $package );

		/** @var Requests_Response|null $req */
		try {
			$response = Utils\http_request( 'GET', $package, null, $headers, $options );
		} catch ( Exception $e ) {
			return new WP_Error( 'download_failed', $e->getMessage() );
		}

		if ( ! is_null( $response ) && 200 !== (int) $response->status_code ) {
			return new WP_Error( 'download_failed', $this->strings['download_failed'] );
		}

		if ( false === stripos( $package, 'https://wordpress.org/nightly-builds/' ) ) {
			$cache->import( $cache_key, $temp );
		}

		return $temp;
	}
public function download_package( $package, $check_signatures = true ) {

		/**
		 * Filter whether to return the package.
		 *
		 * @since 3.7.0
		 *
		 * @param bool    $reply   Whether to bail without returning the package. Default is false.
		 * @param string  $package The package file name.
		 * @param object  $this    The WP_Upgrader instance.
		 */
		$reply = apply_filters(
			// phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- Override existing hook from Core.
			'upgrader_pre_download',
			false,
			$package,
			$this
		);
		if ( false !== $reply ) {
			return $reply;
		}

		// Check if package is a local or remote file. Bail if it's local.
		if ( ! preg_match( '!^(http|https|ftp)://!i', $package ) && file_exists( $package ) ) {
			return $package;
		}

		if ( empty( $package ) ) {
			return new WP_Error( 'no_package', $this->strings['no_package'] );
		}

		$filename  = pathinfo( $package, PATHINFO_FILENAME );
		$extension = pathinfo( $package, PATHINFO_EXTENSION );

		$temp = Utils\get_temp_dir() . uniqid( 'wp_' ) . ".{$extension}";
		register_shutdown_function(
			function () use ( $temp ) {
				if ( file_exists( $temp ) ) {
					unlink( $temp );
				}
			}
		);

		$cache      = WP_CLI::get_cache();
		$update     = $GLOBALS['wpcli_core_update_obj'];
		$cache_key  = "core/{$filename}-{$update->locale}.{$extension}";
		$cache_file = $cache->has( $cache_key );

		if ( $cache_file && false === stripos( $package, 'https://wordpress.org/nightly-builds/' )
			&& false === stripos( $package, 'http://wordpress.org/nightly-builds/' ) ) {
			WP_CLI::log( "Using cached file '{$cache_file}'..." );
			copy( $cache_file, $temp );
			return $temp;
		}

		/*
		 * Download to a temporary file because piping from cURL to tar is flaky
		 * on MinGW (and probably in other environments too).
		 */
		$headers = [ 'Accept' => 'application/json' ];
		$options = [
			'timeout'       => 600,  // 10 minutes ought to be enough for everybody.
			'filename'      => $temp,
			'halt_on_error' => false,
		];

		$this->skin->feedback( 'downloading_package', $package );

		/** @var Requests_Response|null $req */
		try {
			$response = Utils\http_request( 'GET', $package, null, $headers, $options );
		} catch ( Exception $e ) {
			return new WP_Error( 'download_failed', $e->getMessage() );
		}

		if ( ! is_null( $response ) && 200 !== (int) $response->status_code ) {
			return new WP_Error( 'download_failed', $this->strings['download_failed'] );
		}

		if ( false === stripos( $package, 'https://wordpress.org/nightly-builds/' ) ) {
			$cache->import( $cache_key, $temp );
		}

		return $temp;
	}
Caches the download, and uses cached if available.

@access public

@param string $package          The URI of the package. If this is the full path to an
existing local file, it will be returned untouched.
@param bool   $check_signatures Whether to validate file signatures. Default true.
@return string|WP_Error The full path to the downloaded package file, or a WP_Error object.