Skip to content

[AssetMapper] Add integrity hashes to import maps #60362

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
javiereguiluz opened this issue May 6, 2025 · 5 comments · May be fixed by #60378
Open

[AssetMapper] Add integrity hashes to import maps #60362

javiereguiluz opened this issue May 6, 2025 · 5 comments · May be fixed by #60378

Comments

@javiereguiluz
Copy link
Member

Description

A few days ago, Firefox 138 added support for integrity hashes in import maps, so this feature is now widely supported. See https://caniuse.com/mdn-html_elements_script_type_importmap_integrity

We could add this feature to the import map generated by AssetMapper.

Example

See https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/script/type/importmap#integrity_metadata_map

This is how it looks in action. Today, AssetMapper generates the imports key and we'd need to also generate the integrity key of this hash:

<script type="importmap">
  {
    "imports": {
      "square": "./modules/shapes/square.js"
    },
    "integrity": {
      "./modules/shapes/square.js": "sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC"
    }
  }
</script>
@MatTheCat
Copy link
Contributor

I can work on that ✋
Which algorithm should we make the default?

@GromNaN
Copy link
Member

GromNaN commented May 7, 2025

You should use sha384 by default. It's the algorithm that is used on every examples on MDN and W3C.

@MatTheCat
Copy link
Contributor

Okay thanks; asked because of https://stackoverflow.com/a/52102596

@MatTheCat MatTheCat linked a pull request May 7, 2025 that will close this issue
@smnandre
Copy link
Member

Started things here some time ago... but it did not raise much passion, so I did not prioritize it

#58722

@MatTheCat
Copy link
Contributor

Woops sorry @smnandre didn’t think of checking PRs 😅

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

5 participants