<p dir="auto">While its a neat feature, to load scripts as if they were in a web browser, in the examples I've come across, I didn't see anything similar to the javascript 'integrity' attribute to ensure the remote source code matches the loaded remote code.</p>
<p dir="auto">Does Deno have such a feature?  If so, disregard the rest - if not, my question is as such:</p>
<p dir="auto">Lets say some deno code (Package A) exists in the wild, that depends on deno scripts from:</p>
<p dir="auto"><a href="https://ahungry.com/deno-package.ts" rel="nofollow">https://ahungry.com/deno-package.ts</a> (this could be example.com, but I'm not sure that does expire)</p>
<p dir="auto">Unlike a central repository similar to npm (which has its own problems), domain names are not permanent, and are time expired.</p>
<p dir="auto">If ahungry.com was to expire, and a malicious actor then registered it, and hosted a malicious deno-package.ts script on their remote end, a problem arises - how does Deno ensure the user doesn't run this altered code?</p>
<p dir="auto">If this is not the first time the user has executed Package A, perhaps its not going to be an issue until the user runs the deno upgrade (remote packages) command, at which point Deno could detect the TLS fingerprint of the remote is now different.</p>
<p dir="auto">But, for a first time user of Package A, that has never run 'deno' before, and therefore has no hidden cache of deno packages - wouldn't it eagerly pull in and execute this code?</p>
<p dir="auto">NPM is not suspect to this same problem, unless they expired npm packages yearly and were to allow anyone to claim other's slots after this time period (which would seem ridiculous in the context of package hosting).</p>
<p dir="auto">I don't know if this already came up, but if security is a major concern and referencing modules via http(s) should be possible, then maybe there should be a way to use <a href="https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity" rel="nofollow">subresource integrity</a> to ensure that the downloaded module isn't tampered with.</p>
<p dir="auto">It could be part of the hash, like</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="import { test } from &quot;https://unpkg.com/deno_testing@0.0.5/testing.ts#sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC&quot;"><pre class="notranslate"><code class="notranslate">import { test } from "https://unpkg.com/deno_testing@0.0.5/testing.ts#sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC"
</code></pre></div>
<p dir="auto">That would be very explicit, although not compatible to semver ranges.</p>