Add SRI to hotlinking examples

Given the security implications of pyscript, it makes sense to recommend SRI when hotlinking pyscript.js:

<script
    defer
    src="https://pyscript.net/alpha/pyscript.js"
    integrity="sha384-IwRwL1M346tP5zp9BKvjinCQC8x78+d+KCeRonZ6gO4XgSBop4cJegZ+SV++AhMR"
    crossorigin="anonymous"
></script>

Integrity check was calculated successfully as follows:

$ curl https://pyscript.net/alpha/pyscript.js | openssl dgst -sha384 -binary | openssl base64 -A
IwRwL1M346tP5zp9BKvjinCQC8x78+d+KCeRonZ6gO4XgSBop4cJegZ+SV++AhMR

Of course this will create issues when updating pyscript.js, so these links really should be version-pinned (I assume that’s what /alpha/ means in this context).

[mflaxman]

An example:

1. Webpage imports pyscript.js using only the recommended method: <script defer src="https://pyscript.net/alpha/pyscript.js"></script>
2. pyscript.net has previously been compromised to serve a malware version of pyscript.js
3. Code that is believed to do X actually does Y thanks to malware

This is not a theoretical example, let’s say you want to build an app that encrypts data. How could you know that you weren’t interacting with malware that was stealing your private keys? SRI is built to solve this problem (and many others).

[ckavidas]

the security implications of pyscript are the same as the security implications of JS and WASM right?

what is special or different about pyscript?

They are the same security implications that would exist with any third party dependency (example: bootstrap). SRI exists to help ensure the integrity of the software aka: “This software came from vendor_x (whom I have implicit trust in) because it included hash_y in the official release of the software”

This would certainly make people more comfortable about including pyscript in their websites since it would minimize the impact of the source of the pyscript files being compromised since any compromise would (in 99.999999999999999999999% of the time) produce a hash different from the one in the website thus failing the integrity check.