Parcel: Subresource Integrity

[robsonsobral]

Feature Request

Hi! Does Parcel support Subresource Integrity?

🔦 Context

I'm still testing and reading about Parcel (yes, I started last weekend) and couldn't find anything about it.

💻 Code Sample

🌍 Your Environment

| Software | Version(s) |
| ---------------- | ---------- |
| Parcel |
| Node |
| npm/Yarn |
| Operating System |

[DeMoorJasper]

It currently does not

_{Sent with GitHawk}

[robsonsobral]

Thank you, @DeMoorJasper . 😞

[Taym95]

Hey @DeMoorJasper, I would like to work on this issue, if you don't mind I would like you to guide me a little bit!

[DeMoorJasper]

@Taym95 awesome, the html transforms are being done inside assets/HTMLAsset https://github.com/parcel-bundler/parcel/blob/master/src/assets/HTMLAsset.js

You might wanna look at how the name replacing got implemented, as this would need the hash of the final bundles. (and HTMLAsset only has access to asset hashes of the JS files) Not even sure this is possible, didn't realise it when I originally flagged this as good first issue

[Taym95]

Oops!

[mischnic]

Not even sure this is possible

HTMLPackager would have to run after all childBundles are completely packaged. That isn't the case.
First attempt here: https://github.com/parcel-bundler/parcel/tree/subres-integrity

[krnlde]

Mhm, I got the feeling SRI only makes sense when using CORS or external dependencies (like CDNs). What would be the benefits in checksuming the files in the same domain?

[jonathannen]

I've written a package to handle SRI for parcel: https://www.npmjs.com/package/parcel-plugin-subresource-integrity

Give it a try and feel free to ping me with an issue if you get stuck.

[muelli]

cool. it would really be nice if Parcel did it natively.