Local NTP: Deploy strict-dynamic CSP

chrome/browser/resources/local_ntp/local_ntp.js

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 
+// NOTE: If you modify this file, you also have to change its hash in
+// local_ntp.html and in LocalNtpSource::GetContentSecurityPolicyScriptSrc.

[Marc Treib, 2017/04/07 16:46:15]

This is somewhat inconvenient. The alternative would be to dynamically compute
and insert the checksum, like for config.js. We'd buy some development
convenience with a runtime cost though, so I kinda prefer the way it is.

[sfiera, 2017/04/10 08:53:21]

Is there a test that will fail straightforwardly if someone forgets?

[Marc Treib, 2017/04/10 10:11:18]

Yup, that's what the newly added LocalNTPSmokeTest is for, mostly.
It's in interactive_ui_tests, so it's somewhat debatable how "straightforward"
it is, but there you go.

[sfiera, 2017/04/10 10:28:53]

What does a failure look like? I would hope for something like “Expected:
kLocalNTPJSHash equals "sha-256-BaSe64=="; actual: "sha-256-bAsE64=="”, so if
everything is fine, you can copy the actual value and it's clear where to copy
it.

[Marc Treib, 2017/04/10 11:44:03]

"Failed to find a valid digest in the 'integrity' attribute for resource
'chrome-search://local-ntp/local-ntp.js' with computed SHA-256 integrity
'g38WaUaxnOIWY7E2LtLZ5ff9r5sn1dBj80jevt/kmx0='. The resource has been blocked."

So yup, should be good.

[sfiera, 2017/04/10 12:08:34]

To be sure, the printed value is the actual value, not the expected, right?

[Marc Treib, 2017/04/10 12:16:18]

It's the value you have to paste in to make things work, so I guess "expected".
Which is what you'd want, no?

+
+
 /**
  * @fileoverview The local InstantExtended NTP.
  */
 
 
 /**
  * Controls rendering the new tab page for InstantExtended.
  * @return {Object} A limited interface for testing the local NTP.
  */
 function LocalNTP() {
@@ skipping 656 matching lines @@
 return {
   init: init,  // Exposed for testing.
   listen: listen
 };
 
 }
 
 if (!window.localNTPUnitTest) {
   LocalNTP().listen();
 }