Webpack Subresource Integrity plugin for Embroider

Subresource Integrity (SRI) support for Ember applications using Embroider.

Motivation

The ember-cli-sri addon provided Subresource Integrity support for Ember applications. Nowadays the Ember community migrates to Embroider, which uses Webpack as bundler. The ember-cli-sri addon does not provide Ember applications using Embroider.

The webpack-subresource-integrity package is the de facto standard for Subresource Integrity support in Webpack ecosystem. Sadly, it cannot be used for Ember apps using Embroider (yet):

1. Some JavaScript and CSS files generated by an Embroider app are not managed through Webpack. Those are invisible to the webpack-subresource-integrity plugin.
2. The index.html file generated by Embroider is not managed by Webpack. This prevents using the HtmlWebpackPlugin for adding the integrity values calculated by webpack-subresource-integrityto the generatedindex.html`.

Usage

The webpack-subresource-integrity-embroider plugin should be added to Webpack build pipeline as any other Webpack plugin. To do so, add it to packagerOptions.webpackConfig.plugins array of your Embroider configuration in the ember-cli-build.js:

const EmberApp = require("ember-cli/lib/broccoli/ember-app");
const SubresourceIntegrityPlugin = require("webpack-subresource-integrity-embroider");

module.exports = function (defaults) {
  const app = new EmberApp(defaults, {});

  const { maybeEmbroider } = require("@embroider/test-setup");
  return maybeEmbroider(app, {
    packagerOptions: {
      webpackConfig: {
        plugins: [new SubresourceIntegrityPlugin()],
      },
    },
  });
};

License

This project is licensed under the MIT License.