Frontend

Current rabbit hole: subresource integrity (SRI) and static file names with deterministic hashes.

(Anyone know how to configure a bundler to name and export JavaScript variables with the same names and in the same order?)

Writer. Building @pinatacloud. Working on simple static site hosting https://orbiter.host \ https://polluterofminds.com

DX Engineer | Head of Developer Relations at /pinata | Building orbiter.host | stevedylan.dev/links | opinions are my own

/frontend dev (HTML/CSS)・founder/decentralized data wrangler /blockhead・contributor /ethglobal /walletbeat・hackathon bounty hunter・music maker・dropout・nomad・25

@stevedylandev.eth @polluterofminds, curious if you’ve explored this at all.

Heard of it but haven't dug into it might. Seems like there might be a few Vite plugins out there but many of them are pretty outdated

Heard of it but haven't dug into it might. Seems like there might be a few Vite plugins out there but many of them are pretty outdated https://github.com/ElMassimo/vite-plugin-manifest-sri

In theory you could write a script to run post build that runs this for each file and then updates the script tags but definitely tricky

In theory you could write a script to run post build that runs this for each file and then updates the script tags but definitely tricky 

https://snippets.so/snip/XLPyoLrtoN

@polymutex.eth did find this Astro plugin which works for enabling SRI for a given build, but it doesn’t seem to address the issue of JavaScript build pipeline itself outputting slightly different code on each run. I think that may be a whole can of worms unto itself.

Contributor @ /walletbeat.

Censorship resistance requires privacy.

Yeah that is a bit weird. I think in theory even if the code is different each time, the hashes are still valid and could be validated because the hashes are made after the fact. I would personally test out a build and find a tool which tests the SRI in the browser

@polymutex.eth did find this Astro plugin which works for enabling SRI for a given build, but it doesn’t seem to address the issue of JavaScript build pipeline itself outputting slightly different code on each run. I think that may be a whole can of worms unto itself.

https://github.com/KindSpells/astro-shield