feat: subresource integrity hashes for link and script tags

[troglodyne-bot]

What

Adds integrity="sha384-..." attributes to all <link rel="stylesheet">, <link rel="preload">, and <script> tags in header.tx.

Why

Subresource Integrity (SRI) lets browsers verify that fetched resources haven't been tampered with. Even for same-origin assets, this provides defense-in-depth against injection attacks that might serve a modified JS or CSS file. Closes #301.

How

• Trog::Renderer::html::sri_hash($url_path) — reads www/$url_path from disk, returns sha384-<base64>. Caches via state %cache (process lifetime). Returns '' for missing files so the integrity attribute is omitted rather than emitted empty.
• Trog::Renderer::Base::render() gains an extra_functions option that html.pm uses to inject sri_hash into the top-level Xslate renderer.
• header.tx calls sri_hash() per resource, conditionally emitting the attribute only when the hash is non-empty (so bundled files like reveal.css and obsidian.min.css, not checked in, get no attribute).

Testing

6 new tests in t/Trog-Renderer-html.t: correct SHA-384 for an existing file, caching behavior, empty return for missing/non-absolute/undef inputs.

The hash value is cross-verified against an independent Digest::SHA + MIME::Base64 computation.

[teodesian]

Would very much prefer we simply add render_it as a key to $options{extra_functions} prior to the XSlate::new call here.

[teodesian]

More concisely stated as

my $digestor = Digest::SHA->new(384);
$digestor->addfile($file);
return $cache{$url_path} = 'sha384-'.encode_base64($digestor->digest);

[teodesian]

@troglodyne-bot rebase

[troglodyne-bot]

Rebase with requested adjustments

Branch koan/sri-integrity-hashes was rebased onto master and review feedback was applied.

Changes applied

---

• Base.pm: Set $options{extra_functions}{render_it} = $options{child_renderer} before Text::Xslate->new, then pass $options{extra_functions} directly as function. Removes the inline hash merge, per @teodesian's request.
• html.pm: Replaced slurp + functional sha384() with Digest::SHA->new(384)->addfile($file)->digest OO pattern, per @teodesian's suggestion. Changed use Digest::SHA qw(sha384) to use Digest::SHA since the functional import is no longer needed. Kept '' as second arg to encode_base64 to suppress the trailing newline (required for valid SRI attribute values).

Stats

4 files changed, 90 insertions(+), 17 deletions(-)

Actions performed

• Already-solved check: negative (confidence=high, reasoning=No SRI-related code (sri_hash, integrity=, sha384) exists anywhere in the master branch.)
• Rebased koan/sri-integrity-hashes onto upstream/master
• Applied review feedback
• Pre-push CI check: no CI runs found
• Force-pushed koan/sri-integrity-hashes to origin
• CI check enqueued in ## CI (async)

CI status

CI will be checked asynchronously.

---

Automated by Kōan