Add support for subresource integrity in imported module scripts

[yoavweiss]

What is the problem this feature will solve?

SRI support for ES module imports would enable using them in documents that require SRI for certain scripts for security or privacy reasons.

See problem statement by @guybedford.

HTML PR
Chromium CL + tests

What is the feature you are proposing to solve the problem?

See proposal by @guybedford.

What alternatives have you considered?

No response

[benjamingr]

@nodejs/loaders @GeoffreyBooth

(nit: ah, the irony of removing policies and landing this)

[GeoffreyBooth]

First we need to land support for import maps; there's a WIP PR for that. Then the SRI proposal for import maps needs to be accepted or at least advance to the equivalent of TC39 Stage 3. Then we can add support for it.

[guybedford]

This is a web specification, not a TC39 one - if there is question as to whether it belongs in Node.js, this is something that could potentially be brought up at the WinterCG meeting next Thursday.

[github-actions]

There has been no activity on this feature request for 5 months. To help maintain relevant open issues, please add the never-stale Issues and PRs exempt from automated stale handling. label or close this issue if it should be closed. If not, the issue will be automatically closed 6 months after the last non-automated comment.
For more information on how the project manages feature requests, please consult the feature request management document.

[github-actions]

There has been no activity on this feature request and it is being closed. If you feel closing this issue is not the right thing to do, please leave a comment.

For more information on how the project manages feature requests, please consult the feature request management document.