first commit

local/compile_web.py

@@ -0,0 +1,15 @@
+"""Hash only trusted source inline scripts at image build time for strict CSP."""
+import base64
+import hashlib
+import os
+from pathlib import Path
+import re
+
+root=Path('/build')
+hashes=[]
+for html in [root/'dtf-site.html',*(root/'local/static').glob('*.html')]:
+    for attributes,body in re.findall(r'<script\b([^>]*)>(.*?)</script>',html.read_text(),re.S|re.I):
+        if not re.search(r'\bsrc\s*=',attributes,re.I):
+            hashes.append("'sha256-"+base64.b64encode(hashlib.sha256(body.encode()).digest()).decode()+"'")
+template=Path(os.environ.get('NGINX_TEMPLATE', root/'local/nginx.conf.template')).read_text()
+(root/'default.conf.template').write_text(template.replace('@SCRIPT_HASHES@',' '.join(hashes)))