alt Hacker News> Fundamentally: There is no way to lock webapps to reproducible builds.
One could absolutely use subresource integrity to lock one’s reference to a vendor’s subresource to a specific version. That’s what it’s there for.
Replies
rhodey • today at 8:25 PM
This only defers the issue to trusting that index.html is always trusted.
That's only meaningful if you are loading resources from a separate domain (e.g., a CDN or another subdomain).
There is no way to, for instance, only allow updates to a PWA from files signed by an offline key.