Generate integrity hash for scripts/link tags on the index.

[T4rk1n]

• Generate a sha384 hash from the local copy of the file.
• Format the tags with integrity and crossorigin attributes.
• Flattened the resources collection from the dist.
• Map external unpkg to local host file.

As the version of plotly.js hosted locally and externally was not the same, this breaks dash-core-components Graph component.

The files hosted locally must be downloaded from the external source so they match 1:1. Same for the component libs bundles, do npm publish first so you have the builds with the prepublish hook, then do python setup.py sdist and twine upload dist/* without rebuilding the bundles so they have the same hash, all version of dcc I tested had the right bundles, but it needs to be said somewhere.

Closes #422

[chriddyp]

This is very cool. We should note in our documentation and the changelog the browser support https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity#Browser_compatibility (not supported in IE. partial support in Edge, not sure what that means)

[T4rk1n]

@chriddyp I tested from ie11 and edge, it loaded, I think it just ignore the attribute.

[T4rk1n]

Tagging this as dash 2.0 as it breaks old versions of dcc that did not have the same plotly.js files. It's a nice feature, but not essential.

[rmarren1]

should this be hash((args, frozenset(kwargs.keys()), frozenset(kwargs.values()))?

frozenset(kwargs) gets a set of the keys, so function(1, 2, a=1) and function(1, 2, a=2) would produce the same hash.

[T4rk1n]

Good catch, the function it wraps doesn't have kwargs so it didn't impact it. I think frozenset(kwargs.items()) so the values and keys are grouped together in a tuple?

[rmarren1]

Yeah either one, it shouldn't matter for the hash 3. Nov 2018 11:06 by notifications@github.com <mailto:notifications@github.com>:

…

@T4rk1n> commented on this pull request. In > dash/_utils.py <#442 (comment)>> : > @@ -1,3 +1,24 @@+import functools+import hashlib+import base64+import pkgutil+++def memoize(func):+ results = {}++ @functools.wraps(func)+ def wrapper(*args, **kwargs):+ key = hash((args, frozenset(kwargs))) Good catch, the function it wraps doesn't have kwargs so it didn't impact it. I think frozenset(kwargs.items()) so the values and keys are grouped together in a tuple? — You are receiving this because your review was requested. Reply to this email directly, > view it on GitHub <#442 (comment)>> , or > mute the thread <https://github.com/notifications/unsubscribe-auth/AJy-LatroBxCjxBU25z9mfEyxRwpy4kMks5urbEPgaJpZM4YEj-r>> .

[alexcjohnson]

This has gotten stale - closing. Will likely need to be reimplemented if we pick this feature up again.

[mkhorton]

Tagging this as dash 2.0 as it breaks old versions of dcc that did not have the same plotly.js files. It's a nice feature, but not essential.

With Dash 2.0 on the horizon, has this feature been re-evaluated? It would give a lot more confidence if using third-party CDNs like unpkg.

[alexcjohnson]

It's not on our roadmap ATM, but if anyone wants to tackle it we'd be happy to review a PR!

[mkhorton]

@alexcjohnson Thanks for the response. Is the approach taken by this PR no longer feasible? It looks like a sensible approach.