Closed
Description
Given the security implications of pyscript, it makes sense to recommend SRI when hotlinking pyscript.js:
<script
defer
src="https://pyscript.net/alpha/pyscript.js"
integrity="sha384-IwRwL1M346tP5zp9BKvjinCQC8x78+d+KCeRonZ6gO4XgSBop4cJegZ+SV++AhMR"
crossorigin="anonymous"
></script>
Integrity check was calculated successfully as follows:
$ curl https://pyscript.net/alpha/pyscript.js | openssl dgst -sha384 -binary | openssl base64 -A
IwRwL1M346tP5zp9BKvjinCQC8x78+d+KCeRonZ6gO4XgSBop4cJegZ+SV++AhMR
Of course this will create issues when updating pyscript.js, so these links really should be version-pinned (I assume that's what /alpha/ means in this context).