Subresource Integrity support for Module Federation plugin chunks

[AmsterGet]

Hello!
I use webpack-subresource-integrity plugin together with webpack module federation and it throws an error during build process ERROR in webpack-subresource-integrity: Asset {assetName} contains unresolved integrity placeholders.

I may be missing something in the configuration, but it seems that hashes are not resolved for chunks generated by the WMF plugin.
Refers to this issue in the webpack repo.

Any help would be greatly appreciated.

Thank you in advance.

[jscheid]

We could add a mechanism to pass a URL-to-hash mapping as suggested here, and bake that into entry chunks (or ideally into all chunks which will load the URL when hashLoading: "lazy"). That would be useful for #167 as well.

Happy to take a look when I can find some time, in the meantime a PR for this is welcome.

[jscheid]

Could you provide a repro for the contains unresolved integrity placeholders error?

[AmsterGet]

You can reproduce it here for application-a and application-b builds.

[subeshb1]

Any updates on this?

[dmialeshka]

bump

[StavM]

any update on this ?

[brunos3d]

Hello, folks. I'm working at a Webpack plugin that generates a JSON stats file about module federated chunks in the application
https://github.com/valorkin/mf-loadable-adapter/tree/master/packages/loadable-adapters/src/federation-stats-plugin

Here is my PR adding the support to SriPlugin, my intent is to generate the JSON stats file within the integrity information, but I got the error mentioned above on this thread during my builds, here is a screenshot containing the output file which contains the unresolved SRI hashes

I believe we can use this approach to solve these lazy Sri Hashes:

• Add options to allow Module Federation Support. e.g: moduleFederation: true
• Add options to pass a set of URLs containing the remote URL / the endpoint of the federated-stats.json file, then make a fetch before the __webpack_require__.sriHashes which lazily gets the Sri hashes from the remotes we did like here.
• Add a warning to the Sri plugin which tells the user to use federation-stats-plugin and some documentation on readme showing how to use it.

I would appreciate it if we move this conversation forward 🚀

[jscheid]

@brunos3d without being too familiar with federation in Webpack, this does sound like a workable solution. PRs are welcome.

[sowtame]

bump

[yiluxiangbei87110]

Hello! I use webpack-subresource-integrity plugin together with webpack module federation and it throws an error during build process ERROR in webpack-subresource-integrity: Asset {assetName} contains unresolved integrity placeholders.

I may be missing something in the configuration, but it seems that hashes are not resolved for chunks generated by the WMF plugin. Refers to this issue in the webpack repo.

Any help would be greatly appreciated.

Thank you in advance.

Hello! I use webpack-subresource-integrity plugin together with webpack module federation and it throws an error during build process ERROR in webpack-subresource-integrity: Asset {assetName} contains unresolved integrity placeholders.

I may be missing something in the configuration, but it seems that hashes are not resolved for chunks generated by the WMF plugin. Refers to this issue in the webpack repo.

Any help would be greatly appreciated.

Thank you in advance.

Bro, I have also encountered this problem. Have you solved it?

[sowtame]

I fixed it here #220
please review

[SQReder]

bump

[sowtame]

hi, I made a temporary package @sowtame/webpack-subresource-integrity, supports wmf.
it's created from this pr

[rrosenshain-sc]

hi, I made a temporary package @sowtame/webpack-subresource-integrity, supports wmf. it's created from this pr

Hey @sowtame I tried using your package but I'm getting:

ERROR in webpack/runtime/compat
Cannot read properties of undefined (reading 'getChunkRootModules')