It would be good if we can verify the hash of the loaded WASM binary so that we can be sure it:
is the one we intend to use for that version of the SDK
hasn't been tampered with in any way
We have a couple of issues we will need to discuss regarding how to handle this:
Right now, we use WebAssembly.compileStreaming() with a fetch request to start compiling the WASM module while it is downloading. I'm not sure if we can get any hashable data from a WebAssembly.Module (e.g. access to an ArrayBuffer of compiled data)
If not, we may have to unfortunately only allow a URL to be passed as a wasmSrc and not accept a precompiled WebAssembly.Module. We would then probably have to drop WebAssembly.compileStreaming() in favor of doing a fetch + WebAssembly.compile in the web worker so that we can take advantage of Request.integrity.
This will also require us to add a build process step where we get the SHA-256 of the expected WASM binary and stamp it into the SDK.
It would be good if we can verify the hash of the loaded WASM binary so that we can be sure it:
We have a couple of issues we will need to discuss regarding how to handle this:
WebAssembly.compileStreaming()
with afetch
request to start compiling the WASM module while it is downloading. I'm not sure if we can get any hashable data from aWebAssembly.Module
(e.g. access to an ArrayBuffer of compiled data)wasmSrc
and not accept a precompiledWebAssembly.Module
. We would then probably have to dropWebAssembly.compileStreaming()
in favor of doing afetch
+WebAssembly.compile
in the web worker so that we can take advantage ofRequest.integrity
.