You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
We obviously need SRI for the std modules used for some subcommands.
It won't suffice to just re-enable the lock flags for these subcommands and push this responsibility to users. The URLs (and the assumption of what they contain) are fixed at build time and masked from users. It only makes sense that the checksums should be built-in beside them and checked implicitly, IMO.
@nayeemrmn I agree. I would actually prefer we were able to include that source code in the binary - but there's the problem that prettier is quite big and would increase the executable size. I think your solution of having checksums at compile time is a good intermediate step.
We obviously need SRI for the std modules used for some subcommands.
It won't suffice to just re-enable the lock flags for these subcommands and push this responsibility to users. The URLs (and the assumption of what they contain) are fixed at build time and masked from users. It only makes sense that the checksums should be built-in beside them and checked implicitly, IMO.
Related: #200.
The text was updated successfully, but these errors were encountered: