Support for Subresource Integrity Checks (SRI)

[mintuhouse]

Similar to https://github.com/rails/sprockets-rails#sri-support
Currently adding integrity: true passes the option as is

[brenogazzola]

Is there any further interest in this? From what I understand this was mainly created to ensure a CDN has not been compromised, so I'm not sure how much this helps with files served by Propshaft, since in theory those were created by the app and delivered through HTTPs?

[ryanfb]

A lot of people use CDNs with Rails by having a CDN asset subdomain that serves requests by caching assets proxied from the main domain. In this case, the files would be served by Propshaft to the CDN then re-distributed to end users, so being able to easily set SRI on JS/CSS assets is still needed to guard against CDN compromise (the HTML with the SRI attributes is still served from the main Rails domain instead of the CDN subdomain).

[brenogazzola]

@mintuhouse @ryanfb I've talked to the other maintainers, and for now we've decided to focus on Propshaft's main features (full support for no-build, better support for builders). This means that for features that might be desirable, but are not core, we recommend sticking to Sprockets. Therefore I'm closing this issue. We can however revisit this at a later date.