-
-
Notifications
You must be signed in to change notification settings - Fork 2.8k
Build: Generate sub-resource integrity hashes of the distribution files #2082
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
Looks cool. Did we discuss using a single sri file vs the 3 you added? |
No, we didn't. I just felt the need for separating and categorizing the hashes by component. |
I guess it would be easier for tool driven consumption when all hashes are contained in a single file. |
Make sense. I will update it this evening. |
@staabm |
Hi @staabm any comment on this PR? |
I love this change.
I guess we should.
we dont have this dist folder in our codebase on github.. I dont get what you mean here? |
I would like to see the hash on the website, next to the download link. |
We publish the
We can provide a link to the file in our docs. The file will be hosted here on GitHub, so everyone can access it without going to the website. |
ok cool. please go for it then. |
Updated the proposal to include the sri hashes file in tagged releases. |
Hi @staabm, Can we merge this PR? Does it need any other changes I need to do? |
Looks great, thanks |
With this, running
grunt release
will generate3 new files1 file in thedist
folder:sri-core.json
: contains the hashes ofjquery-validate.js
andjquery-validate.min.js
sri-additional.json
: contains the hashes ofadditional-methods.js
andadditional-methods.min.js
sri-localization.json
: contains the hashes of all JS files insidelocalization
folderjquery-validation-sri.json
: contains the hashes of all JS files insidedist
folderI can add those files to the list of distribution files in case we want to commit them to GitHub.
//c @staabm @vanillajonathan