[feat] script.integrity and import map

[loynoir]

Background

• There is Subresource Integrity for old days javascript.
• deno support import map, and invent own lock file.
• node not yet support import map.

Feat

Now, there is ESM. I think there should have a concept update combine two, in flavor of each dependency manager reinvent different lock file.

  "imports": {},
  "scopes": {},
  "integrity": {} | ./lock/file/relative/path/to/import/map,

Additional

As ESM system differ from legacy system, I think, should iter into the inner most dependency, and update field integrity or file flatly.

Related

nodejs/node#44830

Thoughts

• For relative path, should be compact for both filesystem and network.
• Maybe allow .integrity as a url. Maybe user can store their import map in their dotfile repo?
• Maybe design .integrity as an Array<Record<string,string>>, and when importId not uniq, throw error.

Security

Maybe split integrity outside import map ?

Like golang proxy.golang.org and sum.golang.org.

[jkrems]

Is this the same as https://github.com/guybedford/import-maps-extensions#integrity? If so, maybe this existing issue might be interesting: #221

[loynoir]

Kind of duplicate.