5 ms·
Does SRI allow signatures? I want to have a policy where any script signed by my Ed25519 key is valid, I don't want to have to hardcode the hash everywhere.
by ChristianBundy 6y ago
Does SRI allow signatures? I want to have a policy where any script signed by my Ed25519 key is valid, I don't want to have to hardcode the hash everywhere.
- datalist 6y agoThat not, hence "not exactly" but SRI still is nice add-on.
- WealthVsSurvive 6y agoIt doesn't, it's only for verifying that the thing is what it was when hashed and not who it's from. The funniest part of this discussion to me is that we're now discussing features of a, say it with me, a package manager! Only now we get to add them by hand.
- datalist 6y agoTo be honest, I am not sure what should be wrong with adding code by hand. Libraries were added manually by legions of developers long before one thought he'd need to create a downloadable left-pad "package". The whole package management issue is overrated.