Re: Security use cases for packaging

Would it be possible to meet the security goals without assuming that the
response body is part of the package? See [1] for background on why that's
beneficial.. at least for performance side of the story. I'm picturing a
package description where each resource has a SRI token, plus a signature
to authenticate the tree of resources / package description itself?

[1] http://lists.w3.org/Archives/Public/public-web-perf/2015Jan/0008.html

On Fri, Jan 30, 2015 at 9:27 AM, Devdatta Akhawe <dev.akhawe@gmail.com>
wrote:

> > Maybe the code from the downloaded package has to be run from a local
> origin like chrome://*.
>
> Doesn't the same issue that Chris raised still exist? You need a unit
> of isolation that says "only code signed with this public key runs in
> this isolation compartment". Chrome extensions have that model.
> Whether we achieve this via origins, COWLs, or origin+key as the
> identifier, is a separate question, but Chris' high level bit remains true.
>
> cheers
> dev
>
>