waysact/webpack-subresource-integrity

Only include hashes for direct child chunks

MLoughry opened this issue · 4 comments

I'll probably try to take a crack at making a PR to do this myself, but figured I'd solicit some insight first.

Our product has ~1,500 JS assets, and so the SRI hashes alone account for ~80kB of bundle size in the entry chunk. Moreover, we're trying to integrate a large component from a partner team that has a lot of localization assets, doubling that number.

My thought is that, rather than have the SRI hashes for all assets in the entry chunk, each chunk could have the hashes for only its direct child assets (which would be merged in with the root manifest when the chunk is loaded). This is more or less how webpack implements chunk preloading/prefetching. While it does mean that some hashes will be duplicated, it could significantly reduce the size of the manifest in the entry chunk.

To do this, the code would topologically sort the chunk graph, and work backwards from leaf chunks to the entry chunk. The one caveat I can think of is if you have a chunk dependency cycle, since you can't update the manifest in the chunk once the asset has been hashed. In that case, we would need to also detect the cycle, and hoist the hashes to the direct parent(s) of any cycle.

Of course, this can all be done behind an option, so as not to impact small apps that wouldn't need this.

This would be a welcome feature, thanks! I can't see anything wrong with your plan. There is already some code in place to walk the dependency tree depth first which you could piggyback off of, IIRC (findChunks).

@jscheid I have a draft PR (without new tests) out now, before I disappear for the holidays. #172

Awesome, thanks! I'm also traveling and won't be able to take a proper look before next week.

This is now released in version 5.1.0.