Hacker News Reader

While not exactly what you are asking, SRI does address that issue to a certain extent

https://medium.com/binary-passion/gentlemen-please-fasten-yo...

Does SRI allow signatures? I want to have a policy where any script signed by my Ed25519 key is valid, I don't want to have to hardcode the hash everywhere.

That not, hence "not exactly" but SRI still is nice add-on.

It doesn't, it's only for verifying that the thing is what it was when hashed and not who it's from. The funniest part of this discussion to me is that we're now discussing features of a, say it with me, a package manager! Only now we get to add them by hand.

To be honest, I am not sure what should be wrong with adding code by hand.

Libraries were added manually by legions of developers long before one thought he'd need to create a downloadable left-pad "package".

The whole package management issue is overrated.

Yes, the only missing thing is the page you initially download and contains all the hashes :)

Well, jQuery has the hashes on-site.

Reply on news.ycombinator.com