opened 01:34AM - 25 Sep 19 UTC
confirmed
idle
Running on Meteor 1.8.1 on Linux.
Reproduction: https://github.com/mitar/mete… or-issue10710
If you run it and open in the browser, you should see in Chrome an error like this;
```
Failed to find a valid digest in the 'integrity' attribute for resource 'http://localhost:3000/packages/akryum_vue-component-dev-client.js?hash=547603629037ec5c040db59841e0ae93a1918dcb' with computed SHA-256 integrity 'XAccToISWRkBlpCrMQXQr5epxqzYxV1ewlltT+Wowdg='. The resource has been blocked.
```
I have instrumented Meteor tool a bit and discovered that the difference between what is served by Meteor vs. what is used to compute the hash is the following:
```
7647c7647
< //# sourceMappingURL=socket.io.dev.js.map
---
>
```
So it looks like `sourceMappingURL` is added to the file, but SRI hash is not recomputed accordingly.
Reported first in 2019, still an issue today in Meteor core. The fix is pretty easy (I had to fix it for my newest version of Meteor-desktop). This was detected as it’s the underlying reason why DesktopHCP doesn’t work properly in Meteor-desktop.
Your attention to it is appreciated.