3 ms·
"Enable content security policy" is something done by the web server (via a header in the response), so that doesn't solve the problem. In theory yes, you coul
by Ajedi32 4y ago
"Enable content security policy" is something done by the web server (via a header in the response), so that doesn't solve the problem.
In theory yes, you could probably create an extension that leverages Content Security Policy as a means of enforcing binary transparency. But at that point you'd basically just be implementing a slightly worse version of web packaging via an extension.
- pastage 4y agoFor me CSP is enough because the apps I need to trust only have one hash. So I do it manually. I will try to switch over to SXG trusting a signer is easier than having a list of trusted hashes, do you know if there some way to require/verify it that is visible on mobile? Web Packaging seems to be vaporware to some extent, and I need something that works now.