title: can't execute inline event handler because it violates the Content Security Policy directive
body: <p>I'm trying to create an alarm/timer extension. Never used extensions before and run into this problem error message:</p>
  
  <p>"Refused to execute inline event handler because it violates the following Content Security Policy directive:
  "script-src 'self' <a href="https://apis.google.com" rel="nofollow noreferrer">https://apis.google.com</a>". Either the 'unsafe-inline' keyword, a hash ('sha256-...'),
  or a nonce ('nonce-...') is required to enable inline execution."</p>
  
  <p>It appears to be referring to the 'onended' event in my background.js code.</p>
  
  <p>I found this which is a similar problem:</p>
  
  <p><a href="https://stackoverflow.com/questions/36622181/how-to-fix-chrome-extension-inline-javascript-invocation-error">How to fix chrome-extension inline JavaScript invocation error?</a></p>
  
  <p>I'm not sure how to get the fixes to work though on account of me being very newbie.</p>
  
  <p>I tried adding this to my manifest.json file but it didn't do anything:
  "content_security_policy":"script-src 'self' <a href="https://apis.google.com" rel="nofollow noreferrer">https://apis.google.com</a>; object-src 'self'"</p>
  
  <p>I then read some of this but unsure how to actually get the hash of the code:
  <a href="https://www.w3.org/TR/2015/CR-CSP2-20150721/#script-src-hash-usage" rel="nofollow noreferrer">https://www.w3.org/TR/2015/CR-CSP2-20150721/#script-src-hash-usage</a></p>
  
  <p>The above link says:</p>
  
  <p>"You can obtain the digest of a string on the command line simply via the openssl program"</p>
  
  <p>I'm not sure where/what the openssl program is though. How would i go about getting this hash?</p>
  
  <p>What should the text look like in the manifest.json "content_security_policy": for this hash information?</p>
  
  <pre><code>chrome.runtime.onMessage.addListener(function(response){
  
    myInterval = setInterval(function(){
  
    var audio = new Audio("Gentle-wake-alarm-clock.mp3");
    audio.setAttribute("onended",
    "function(){alert('your ' + response + ' second alert has ended')}");
    audio.play();
    clearInterval(myInterval);
    }, response * 1000);
  
  })
  </code></pre>
  
  <p>my manifest.json file:</p>
  
  <pre><code>{
      "name": "timer",
      "version": "1.0",
      "description": "Build a timer!",
      "manifest_version": 2,
      "permissions": ["storage"],
      "options_page": "options.html",
  
      "browser_action": {
        "default_popup": "timerpopup.html",
        "default_icon": "green alarm.png"
      },
  
      "background": {
        "scripts": ["background.js"],
        "persistent": false
      },
  
      "content_security_policy":"script-src 'self' https://apis.google.com; object-src 'self'"
  
  
  }
  </code></pre>