what is the purpose of site_key? In ROOT/modules/update/update.fetch.inc, there is the following code.

$site_key = drupal_hmac_base64($base_url, drupal_get_private_key());
$url = _update_build_fetch_url($project, $site_key);


_update_build_fetch_url() contains the following code.

  // Only append usage information if we have a site key and the project is
  // enabled. We do not want to record usage statistics for disabled projects.
  if (!empty($site_key) &amp;&amp; (strpos($project['project_type'], 'disabled') === FALSE)) {
    // Append the site key.
    $url .= (strpos($url, '?') !== FALSE) ? '&amp;' : '?';
    $url .= 'site_key=';
    $url .= rawurlencode($site_key);

    // Append the version.
    if (!empty($project['info']['version'])) {
      $url .= '&amp;version=';
      $url .= rawurlencode($project['info']['version']);
    }

    // Append the list of modules or themes enabled.
    $list = array_keys($project['includes']);
    $url .= '&amp;list=';
    $url .= rawurlencode(implode(',', $list));
  }


This function generates the URL to fetch information about project updates, returning a URL like http://updates.drupal.org/release-history/examples/7.x?site_key=FuSSIDdX3JtCJQV7F1hWK6WopklCLf0jjHFDC1Nevys&amp;version=7.x-1.x-dev&amp;list=ajax_example%2Cexamples.

Why does Drupal need site_key? How do I know the value of $base_url from site_key?
It's a unique value that allows to identify the site asking for updates. It is used on Drupal.org when giving the number of site using a module, which is shown in every project page.


  


Without that value, Drupal.org could not report the number of sites using a module, since it could not understand which site is asking for updates.

Since site_key is a crypted hash derived from $base_url, you cannot get the value of $base_url from its hash; that is how hash works. Hashes are used to save the passwords in the database; nobody can get the value of the password from the hash saved in the database.