Local NTP: Deploy strict-dynamic CSP

chrome/browser/resources/local_ntp/local_ntp.js

Index: chrome/browser/resources/local_ntp/local_ntp.js
diff --git a/chrome/browser/resources/local_ntp/local_ntp.js b/chrome/browser/resources/local_ntp/local_ntp.js
index f30a67010313e5bd0e5047f5ef3ace27baacee30..8ba21d32b5aa53b73d264073f5ff1db0fe49d19c 100644
--- a/chrome/browser/resources/local_ntp/local_ntp.js
+++ b/chrome/browser/resources/local_ntp/local_ntp.js
@@ -3,6 +3,10 @@
 // found in the LICENSE file.
 
 
+// NOTE: If you modify this file, you also have to change its hash in
+// local_ntp.html and in LocalNtpSource::GetContentSecurityPolicyScriptSrc.

[Marc Treib, 2017/04/07 16:46:15]

This is somewhat inconvenient. The alternative would be to dynamically compute
and insert the checksum, like for config.js. We'd buy some development
convenience with a runtime cost though, so I kinda prefer the way it is.

[sfiera, 2017/04/10 08:53:21]

Is there a test that will fail straightforwardly if someone forgets?

[Marc Treib, 2017/04/10 10:11:18]

Yup, that's what the newly added LocalNTPSmokeTest is for, mostly.
It's in interactive_ui_tests, so it's somewhat debatable how "straightforward"
it is, but there you go.

[sfiera, 2017/04/10 10:28:53]

What does a failure look like? I would hope for something like “Expected:
kLocalNTPJSHash equals "sha-256-BaSe64=="; actual: "sha-256-bAsE64=="”, so if
everything is fine, you can copy the actual value and it's clear where to copy
it.

[Marc Treib, 2017/04/10 11:44:03]

"Failed to find a valid digest in the 'integrity' attribute for resource
'chrome-search://local-ntp/local-ntp.js' with computed SHA-256 integrity
'g38WaUaxnOIWY7E2LtLZ5ff9r5sn1dBj80jevt/kmx0='. The resource has been blocked."

So yup, should be good.

[sfiera, 2017/04/10 12:08:34]

To be sure, the printed value is the actual value, not the expected, right?

[Marc Treib, 2017/04/10 12:16:18]

It's the value you have to paste in to make things work, so I guess "expected".
Which is what you'd want, no?

+
+
 /**
  * @fileoverview The local InstantExtended NTP.
  */