3 ms·
Deno and npm both store the hashes of all the dependencies you use in a lock file and verify them on future reinstalls.
by AgentME 2y ago
Deno and npm both store the hashes of all the dependencies you use in a lock file and verify them on future reinstalls.
- 8n4vidtmkvmk 2y agoThe lockfile is good, but I'm talking about this inline dependency syntax, # dependencies = ['requests', 'beautifulsoup4'] And likewise, Deno can import by URL. Neither include an integrity hash. For JS, I'd suggest import * as goodlib from 'https://verysecure.com/notmalicious.mjs' with { integrity="sha384-xxx" } which mirrors https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity#subresource_integrity_with_the_script_element https://developer.mozilla.org/en-US/docs/Web/Security/Subres... and https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/import/with https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe... The Python/UV thing will have to come up with some syntax, I don't know what. Not sure if there's a precedent for attributes.
- deleted 2y ago[deleted]