Subresource Integrity Hash Mismatch

[mgaudet]

Hey,

Giving this a shot, but getting SRI hash mismatches in my console:

GET
https://cdn.jsdelivr.net/npm/[email protected]/dist/mermaid.min.js
[HTTP/1.1 503 0ms]

11:32:00.832 None of the “sha256” hashes in the integrity attribute match the content of the subresource. The computed hash is “oXlHg6q3LSBdxTKxFw0b5j69zogWtXwhrLRRwV2rlpo=”.

[mgaudet]

I should note that's firefox.

Chrome says: " Subresource Integrity: The resource 'https://cdn.jsdelivr.net/npm/[email protected]/dist/mermaid.min.js' has an integrity attribute, but the resource requires the request to be CORS enabled to check the integrity, and it is not. The resource has been blocked because the integrity cannot be enforced."

This is self-hosted silverbullet.

[nightscape]

Are you on the latest version of Silverbullet? The fix for this issue was only merged about a week ago. It still doesn't work for me, but afair it's a different issue after the upgrade.

[mgaudet]

First thing I tried was upgrading both Silverbullet and Deno

M1MacBook:SilverBulletNotes mgaudet$ silverbullet upgrade
Now going to attempt an upgrade...
So, that's done. Now let's see if this actually did anything...
Nope. I hate to tell you this, but it looks like we're still running 0.10.1. This was a bit of a futile exercise. Let's try again soon some time.

[mjf]

$ silverbullet upgrade
Now going to attempt an upgrade...
So, that's done. Now let's see if this actually did anything...
Nope. I hate to tell you this, but it looks like we're still running 0.10.1. This was a bit of a futile exercise. Let's try again soon some time.

Also run updating the plugs.

In Firefox I see on console:

“https://cdn.jsdelivr.net/npm/[email protected]/dist/mermaid.min.js” \
is not eligible for integrity checks since it’s neither CORS-enabled nor same-origin.

Can crossorigin="anonymous" be added?

[nayard-ketty]

for newbies-not-developer who use self-hosted silverbullet with this plug, you can use this space-config:

mermaid:
  version: "11.4.1"
  integrity: "null"

Problem might be connected to this

[mgaudet]

That space-config does help this work in chrome, but I still get "is not eligible for integrity checks since it’s neither CORS-enabled nor same-origin." on Firefox.

[mgaudet]

(this may end up being fixed by a newer silverbullet release while spelunking through the code there)