Add SRI to tracking code

[Twisterado]

Hi, thank you all for this awesome project!

I'd like to propose the idea of using SRI (Subresource Integrity) to make my websites just a bit more secure. This feature allows browsers to verify the integrity of loaded scripts (like the tracking script by umami) with the help of a hash.
More information on this can be found at mdn web docs.

The hash could be calculated automatically and added to the tracking code shown in the settings. This would make it a lot more convenient.

Just one drawback occurred to me: whenever the tracking script is changed (e.g. when updating umami?), the hash would have to be updated (manually) on the page containing the tracking code.
Maybe this is no big issue as the script is not updated too often or there is some better idea?

[mikecao]

Because you are hosting the tracking code on your own server, I don't know how useful this would be. With the addition of environment variables, this will change the hash every time. It's going to be more trouble for most people.

[Twisterado]

I see.
I do think it could still be useful for some users. Maybe it would be possible to add it as an option (with a checkbox when the tracking code is copied)? Also if the hash could be queried via the API, it would be possible to update it automatically on your websites.