> Fundamentally: There is no way to lock webapps to reproducible builds.
One could absolutely use subresource integrity to lock one’s reference to a vendor’s subresource to a specific version. That’s what it’s there for.
One could absolutely use subresource integrity to lock one’s reference to a vendor’s subresource to a specific version. That’s what it’s there for.
There is no way to, for instance, only allow updates to a PWA from files signed by an offline key.