6 ms·

While not exactly what you are asking, SRI does address that issue to a certain extent https://medium.com/binary-passion/gentlemen-please-fasten-your-scripts-1

• ChristianBundy 6y ago
  Does SRI allow signatures? I want to have a policy where any script signed by my Ed25519 key is valid, I don't want to have to hardcode the hash everywhere.
  • datalist 6y ago
    That not, hence "not exactly" but SRI still is nice add-on.
  • WealthVsSurvive 6y ago
    It doesn't, it's only for verifying that the thing is what it was when hashed and not who it's from. The funniest part of this discussion to me is that we're now discussing features of a, say it with me, a package manager! Only now we get to add them by hand.
    • datalist 6y ago
      To be honest, I am not sure what should be wrong with adding code by hand. Libraries were added manually by legions of developers long before one thought he'd need to create a downloadable left-pad "package". The whole package management issue is overrated.
• forty 6y ago
  Yes, the only missing thing is the page you initially download and contains all the hashes :)
  • datalist 6y ago
    Well, jQuery has the hashes on-site.