.dockerignore

@@ -3,6 +3,11 @@
 # stage of the Dockerfile.
 .git/
 bin/
+# Third-party browser assets are fetched and hash-verified inside the build by
+# script/fetch-assets. Excluding any host copy keeps a developer's working tree
+# from supplying the bytes that get shipped. The script and its
+# static/vendor.sha256 manifest stay in the context.
+static/js/alpine.min.js
 *.md
 LICENSE
 .editorconfig

.gitignore

@@ -45,3 +45,8 @@ temp/
 
 # CI cache barrier, written into the build context by the check workflow
 .ci-fingerprint
+
+# Third-party browser assets, fetched and hash-verified by
+# script/fetch-assets against static/vendor.sha256. Not committed:
+# REPO_POLICIES.md forbids minified bundles in version control.
+/static/js/alpine.min.js 

Dockerfile

@@ -32,7 +32,7 @@ FROM golang:1.26.1-bookworm@sha256:4465644228bc2857a954b092167e12aa59c006a349228
 # Depend on lint stage passing
 COPY --from=lint /src/go.sum /dev/null
 
-RUN apt-get update && apt-get install -y --no-install-recommends make && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y --no-install-recommends make curl ca-certificates && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /build
 
@@ -44,6 +44,14 @@ RUN go mod download
 # the lint stage above.
 COPY . .
 
+# Fetch the third-party browser assets the UI serves. They are not committed
+# (REPO_POLICIES.md forbids minified bundles in version control) and
+# .dockerignore keeps any host copy out of the build context, so this step is
+# the only way they enter the image. Each download is checked against a
+# hardcoded sha256 and the build fails on mismatch; make test re-checks the
+# hashes against the bytes go:embed actually put in the binary.
+RUN script/fetch-assets
+
 # Run tests and build
 RUN make test
 RUN make build

Makefile

@@ -1,4 +1,4 @@
-.PHONY: bootstrap setup test lint fmt fmt-check check build run dev deps docker clean hooks css
+.PHONY: bootstrap setup assets test lint fmt fmt-check check build run dev deps docker clean hooks css
 
 # Default target
 .DEFAULT_GOAL := check
@@ -9,6 +9,9 @@ bootstrap:
 setup:
 	@script/setup
 
+assets:
+	@script/fetch-assets
+
 test:
 	@script/test
 

README.md

@@ -40,6 +40,7 @@ make docker
 ```bash
 make bootstrap  # Install all dependencies (idempotent)
 make setup      # Bootstrap + install git pre-commit hook
+make assets     # Fetch + verify third-party browser assets
 make fmt        # Format code (gofmt + goimports)
 make lint       # Run golangci-lint
 make test       # Run tests with race detection
@@ -247,6 +248,8 @@ them. We provide:
 - `script/setup` — make a fresh clone ready for development
   (bootstrap, then install-precommit)
 - `script/projectname` — output the project name ("webhooker")
+- `script/fetch-assets` — download the third-party browser assets into
+  `static/`, verifying each against its pinned sha256
 - `script/test` — run the test suite
 - `script/lint` — run golangci-lint
 - `script/fmt` — format all code (writes)
@@ -260,6 +263,27 @@ them. We provide:
 - `script/install-precommit` — install the git pre-commit hook that
   runs `script/precommit`
 
+## Third-party browser assets
+
+The web UI serves one third-party script, Alpine.js. It is **not** committed:
+a minified bundle in the tree is unreviewable, and `REPO_POLICIES.md` bars
+both committed build artifacts and unpinned external references.
+
+Instead `script/fetch-assets` downloads it from a pinned URL, checks the
+download against a hardcoded sha256, and installs it under `static/`. The
+sha256 of every installed asset is recorded in `static/vendor.sha256`, and
+`static/vendor_test.go` re-hashes the bytes `go:embed` put in the binary
+against that manifest — so the pin is enforced on what actually ships, not
+merely written down. Any mismatch fails the build.
+
+`make bootstrap` runs the fetch for local development, and the Dockerfile
+runs it in the build stage; `.gitignore` and `.dockerignore` keep the
+artifact out of both the repo and the build context.
+
+To move to a new version: update the version, URL, and tarball sha256 in
+`script/fetch-assets` and the asset sha256 in `static/vendor.sha256`, then
+run `make assets && make check`.
+
 ## Rationale
 
 Webhook integrations between services are inherently fragile. The

internal/server/static_assets_test.go

@@ -0,0 +1,50 @@
+package server_test
+
+import (
+	"net/http"
+	"regexp"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"sneak.berlin/go/webhooker/templates"
+)
+
+// TestBaseTemplateScriptsAreServed walks every /s/ script the base
+// template loads on each page and fetches it through the real router.
+// Alpine.js is fetched at build time rather than committed, so nothing
+// in the repo guarantees it is present: this is the check that the page
+// still gets the JavaScript it asks for.
+func TestBaseTemplateScriptsAreServed(t *testing.T) {
+	t.Parallel()
+
+	// scriptSrc matches the src of every <script> tag pointing at the
+	// /s/ static mount.
+	scriptSrc := regexp.MustCompile(`<script[^>]+src="(/s/[^"]+)"`)
+
+	base, err := templates.Templates.ReadFile("base.html")
+	require.NoError(t, err)
+
+	matches := scriptSrc.FindAllStringSubmatch(string(base), -1)
+	require.NotEmpty(t, matches, "base.html should load scripts from /s/")
+
+	env := newTestEnv(t)
+
+	for _, m := range matches {
+		src := m[1]
+		t.Run(src, func(t *testing.T) {
+			t.Parallel()
+
+			w := env.get(src, nil)
+
+			require.Equalf(
+				t, http.StatusOK, w.Code,
+				"base.html loads %s but the server does not serve it", src,
+			)
+			assert.NotEmptyf(
+				t, w.Body.Bytes(), "%s is served but empty", src,
+			)
+		})
+	}
+}

script/bootstrap

@@ -5,7 +5,8 @@
 # or apk (detected in that order); assumes NOTHING is present (not git,
 # make, or go). golangci-lint is packaged in nix, brew, and apk; on apt
 # it is installed from a hash-verified GitHub release archive (never
-# curl | sh).
+# curl | sh). Finishes by running script/fetch-assets, which installs the
+# hash-pinned third-party browser assets the repo does not commit.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
@@ -115,6 +116,11 @@ main() {
 
     go mod download
 
+    # Third-party browser assets are not committed; fetch and verify them
+    # so a fresh clone can build and test.
+    if missing curl; then pkg_install curl curl curl curl; fi
+    "$ROOT/script/fetch-assets"
+
     echo "bootstrap complete"
 }
 

script/fetch-assets

@@ -0,0 +1,104 @@
+#!/bin/sh
+# script/fetch-assets: download the third-party browser assets the web UI
+# ships and install them under static/. Minified bundles are not committed
+# (REPO_POLICIES.md: no build artifacts in version control), so the build
+# fetches them here. Every download is verified against a hardcoded sha256
+# before it is installed, and any mismatch aborts. Idempotent: an asset
+# already present with its pinned hash is left alone.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+# The sha256 of each installed asset lives in static/vendor.sha256, in
+# sha256sum(1) format, with paths relative to static/. That file is the
+# single source of truth: this script verifies against it, and
+# static/vendor_test.go asserts the bytes embedded into the binary match
+# it, so the hash cannot rot into a value nothing checks.
+MANIFEST="static/vendor.sha256"
+
+# Alpine.js 3.14.9, 2026-08-17. Fetched from registry.npmjs.org, the
+# publisher of record; the jsDelivr and unpkg copies are mirrors of this
+# same tarball. dist/cdn.min.js is the browser build Alpine publishes for
+# a <script> tag.
+ALPINE_VERSION="3.14.9"
+ALPINE_URL="https://registry.npmjs.org/alpinejs/-/alpinejs-${ALPINE_VERSION}.tgz"
+# sha256 of alpinejs-3.14.9.tgz
+ALPINE_TARBALL_SHA256="97dad7c0c81e659cfc8e7700055da9770f8186187cb9a8a76efb57e00d5ce52a"
+ALPINE_MEMBER="package/dist/cdn.min.js"
+ALPINE_DEST="js/alpine.min.js"
+
+sha256_of() {
+    if command -v sha256sum >/dev/null 2>&1; then
+        sha256sum "$1" | cut -d' ' -f1
+    else
+        shasum -a 256 "$1" | cut -d' ' -f1
+    fi
+}
+
+# expected_sha256 <path-relative-to-static>
+expected_sha256() {
+    awk -v want="$1" '$2 == want { print $1; found = 1 }
+        END { if (!found) exit 1 }' "$ROOT/$MANIFEST"
+}
+
+# verify <file> <expected-sha256> <what>
+verify() {
+    actual="$(sha256_of "$1")"
+    if [ "$actual" != "$2" ]; then
+        echo "fetch-assets: sha256 mismatch for $3" >&2
+        echo "  expected: $2" >&2
+        echo "  actual:   $actual" >&2
+        exit 1
+    fi
+}
+
+# up_to_date <path-relative-to-static> <expected-sha256>
+up_to_date() {
+    [ -f "$ROOT/static/$1" ] || return 1
+    [ "$(sha256_of "$ROOT/static/$1")" = "$2" ]
+}
+
+fetch_alpine() {
+    want="$(expected_sha256 "$ALPINE_DEST")"
+
+    if up_to_date "$ALPINE_DEST" "$want"; then
+        echo "fetch-assets: static/$ALPINE_DEST already at $want"
+        return 0
+    fi
+
+    echo "fetch-assets: fetching Alpine.js $ALPINE_VERSION from $ALPINE_URL"
+    tmp="$(mktemp -d)"
+    trap 'rm -rf "$tmp"' EXIT INT TERM
+    curl -fsSL -o "$tmp/alpine.tgz" "$ALPINE_URL"
+    verify "$tmp/alpine.tgz" "$ALPINE_TARBALL_SHA256" "alpinejs-${ALPINE_VERSION}.tgz"
+    tar -xzOf "$tmp/alpine.tgz" "$ALPINE_MEMBER" >"$tmp/alpine.min.js"
+    verify "$tmp/alpine.min.js" "$want" "$ALPINE_MEMBER from alpinejs-${ALPINE_VERSION}.tgz"
+
+    mkdir -p "$(dirname "$ROOT/static/$ALPINE_DEST")"
+    cp "$tmp/alpine.min.js" "$ROOT/static/$ALPINE_DEST"
+    rm -rf "$tmp"
+    trap - EXIT INT TERM
+    echo "fetch-assets: installed static/$ALPINE_DEST ($want)"
+}
+
+# Re-check every manifest entry against what is now on disk, so an entry
+# no script installs fails loudly instead of passing silently.
+verify_manifest() {
+    while read -r want path; do
+        case "$want" in '' | '#'*) continue ;; esac
+        if [ ! -f "$ROOT/static/$path" ]; then
+            echo "fetch-assets: $MANIFEST lists static/$path, which is missing" >&2
+            exit 1
+        fi
+        verify "$ROOT/static/$path" "$want" "static/$path"
+    done <"$ROOT/$MANIFEST"
+}
+
+main() {
+    cd "$ROOT"
+    fetch_alpine
+    verify_manifest
+    echo "fetch-assets: all assets in $MANIFEST verified"
+}
+
+main "$@"

static/js/alpine.min.js

@@ -1,5 +0,0 @@
-(()=>{var nt=!1,it=!1,W=[],ot=-1;function Ut(e){Rn(e)}function Rn(e){W.includes(e)||W.push(e),Mn()}function Wt(e){let t=W.indexOf(e);t!==-1&&t>ot&&W.splice(t,1)}function Mn(){!it&&!nt&&(nt=!0,queueMicrotask(Nn))}function Nn(){nt=!1,it=!0;for(let e=0;e<W.length;e++)W[e](),ot=e;W.length=0,ot=-1,it=!1}var T,N,$,at,st=!0;function Gt(e){st=!1,e(),st=!0}function Jt(e){T=e.reactive,$=e.release,N=t=>e.effect(t,{scheduler:r=>{st?Ut(r):r()}}),at=e.raw}function ct(e){N=e}function Yt(e){let t=()=>{};return[n=>{let i=N(n);return e._x_effects||(e._x_effects=new Set,e._x_runEffects=()=>{e._x_effects.forEach(o=>o())}),e._x_effects.add(i),t=()=>{i!==void 0&&(e._x_effects.delete(i),$(i))},i},()=>{t()}]}function ve(e,t){let r=!0,n,i=N(()=>{let o=e();JSON.stringify(o),r?n=o:queueMicrotask(()=>{t(o,n),n=o}),r=!1});return()=>$(i)}var Xt=[],Zt=[],Qt=[];function er(e){Qt.push(e)}function te(e,t){typeof t=="function"?(e._x_cleanups||(e._x_cleanups=[]),e._x_cleanups.push(t)):(t=e,Zt.push(t))}function Ae(e){Xt.push(e)}function Oe(e,t,r){e._x_attributeCleanups||(e._x_attributeCleanups={}),e._x_attributeCleanups[t]||(e._x_attributeCleanups[t]=[]),e._x_attributeCleanups[t].push(r)}function lt(e,t){e._x_attributeCleanups&&Object.entries(e._x_attributeCleanups).forEach(([r,n])=>{(t===void 0||t.includes(r))&&(n.forEach(i=>i()),delete e._x_attributeCleanups[r])})}function tr(e){for(e._x_effects?.forEach(Wt);e._x_cleanups?.length;)e._x_cleanups.pop()()}var ut=new MutationObserver(mt),ft=!1;function ue(){ut.observe(document,{subtree:!0,childList:!0,attributes:!0,attributeOldValue:!0}),ft=!0}function dt(){kn(),ut.disconnect(),ft=!1}var le=[];function kn(){let e=ut.takeRecords();le.push(()=>e.length>0&&mt(e));let t=le.length;queueMicrotask(()=>{if(le.length===t)for(;le.length>0;)le.shift()()})}function m(e){if(!ft)return e();dt();let t=e();return ue(),t}var pt=!1,Se=[];function rr(){pt=!0}function nr(){pt=!1,mt(Se),Se=[]}function mt(e){if(pt){Se=Se.concat(e);return}let t=[],r=new Set,n=new Map,i=new Map;for(let o=0;o<e.length;o++)if(!e[o].target._x_ignoreMutationObserver&&(e[o].type==="childList"&&(e[o].removedNodes.forEach(s=>{s.nodeType===1&&s._x_marker&&r.add(s)}),e[o].addedNodes.forEach(s=>{if(s.nodeType===1){if(r.has(s)){r.delete(s);return}s._x_marker||t.push(s)}})),e[o].type==="attributes")){let s=e[o].target,a=e[o].attributeName,c=e[o].oldValue,l=()=>{n.has(s)||n.set(s,[]),n.get(s).push({name:a,value:s.getAttribute(a)})},u=()=>{i.has(s)||i.set(s,[]),i.get(s).push(a)};s.hasAttribute(a)&&c===null?l():s.hasAttribute(a)?(u(),l()):u()}i.forEach((o,s)=>{lt(s,o)}),n.forEach((o,s)=>{Xt.forEach(a=>a(s,o))});for(let o of r)t.some(s=>s.contains(o))||Zt.forEach(s=>s(o));for(let o of t)o.isConnected&&Qt.forEach(s=>s(o));t=null,r=null,n=null,i=null}function Ce(e){return z(B(e))}function k(e,t,r){return e._x_dataStack=[t,...B(r||e)],()=>{e._x_dataStack=e._x_dataStack.filter(n=>n!==t)}}function B(e){return e._x_dataStack?e._x_dataStack:typeof ShadowRoot=="function"&&e instanceof ShadowRoot?B(e.host):e.parentNode?B(e.parentNode):[]}function z(e){return new Proxy({objects:e},Dn)}var Dn={ownKeys({objects:e}){return Array.from(new Set(e.flatMap(t=>Object.keys(t))))},has({objects:e},t){return t==Symbol.unscopables?!1:e.some(r=>Object.prototype.hasOwnProperty.call(r,t)||Reflect.has(r,t))},get({objects:e},t,r){return t=="toJSON"?Pn:Reflect.get(e.find(n=>Reflect.has(n,t))||{},t,r)},set({objects:e},t,r,n){let i=e.find(s=>Object.prototype.hasOwnProperty.call(s,t))||e[e.length-1],o=Object.getOwnPropertyDescriptor(i,t);return o?.set&&o?.get?o.set.call(n,r)||!0:Reflect.set(i,t,r)}};function Pn(){return Reflect.ownKeys(this).reduce((t,r)=>(t[r]=Reflect.get(this,r),t),{})}function Te(e){let t=n=>typeof n=="object"&&!Array.isArray(n)&&n!==null,r=(n,i="")=>{Object.entries(Object.getOwnPropertyDescriptors(n)).forEach(([o,{value:s,enumerable:a}])=>{if(a===!1||s===void 0||typeof s=="object"&&s!==null&&s.__v_skip)return;let c=i===""?o:`${i}.${o}`;typeof s=="object"&&s!==null&&s._x_interceptor?n[o]=s.initialize(e,c,o):t(s)&&s!==n&&!(s instanceof Element)&&r(s,c)})};return r(e)}function Re(e,t=()=>{}){let r={initialValue:void 0,_x_interceptor:!0,initialize(n,i,o){return e(this.initialValue,()=>In(n,i),s=>ht(n,i,s),i,o)}};return t(r),n=>{if(typeof n=="object"&&n!==null&&n._x_interceptor){let i=r.initialize.bind(r);r.initialize=(o,s,a)=>{let c=n.initialize(o,s,a);return r.initialValue=c,i(o,s,a)}}else r.initialValue=n;return r}}function In(e,t){return t.split(".").reduce((r,n)=>r[n],e)}function ht(e,t,r){if(typeof t=="string"&&(t=t.split(".")),t.length===1)e[t[0]]=r;else{if(t.length===0)throw error;return e[t[0]]||(e[t[0]]={}),ht(e[t[0]],t.slice(1),r)}}var ir={};function y(e,t){ir[e]=t}function fe(e,t){let r=Ln(t);return Object.entries(ir).forEach(([n,i])=>{Object.defineProperty(e,`$${n}`,{get(){return i(t,r)},enumerable:!1})}),e}function Ln(e){let[t,r]=_t(e),n={interceptor:Re,...t};return te(e,r),n}function or(e,t,r,...n){try{return r(...n)}catch(i){re(i,e,t)}}function re(e,tLine truncated
-
-${r?'Expression: "'+r+`"
-
-`:""}`,t),setTimeout(()=>{throw e},0)}var Me=!0;function ke(e){let t=Me;Me=!1;let r=e();return Me=t,r}function R(e,t,r={}){let n;return x(e,t)(i=>n=i,r),n}function x(...e){return sr(...e)}var sr=xt;function ar(e){sr=e}function xt(e,t){let r={};fe(r,e);let n=[r,...B(e)],i=typeof t=="function"?$n(n,t):Fn(n,t,e);return or.bind(null,e,t,i)}function $n(e,t){return(r=()=>{},{scope:n={},params:i=[]}={})=>{let o=t.apply(z([n,...e]),i);Ne(r,o)}}var gt={};function jn(e,t){if(gt[e])return gt[e];let r=Object.getPrototypeOf(async function(){}).constructor,n=/^[\n\s]*if.*\(.*\)/.test(e.trim())||/^(let|const)\s/.test(e.trim())?`(async()=>{ ${e} })()`:e,o=(()=>{try{let s=new r(["__self","scope"],`with (scope) { __self.result = ${n} }; __self.finished = true; return __self.result;`);return Object.defineProperty(s,"name",{value:`[Alpine] ${e}`}),s}catch(s){return re(s,t,e),Promise.resolve()}})();return gt[e]=o,o}function Fn(e,t,r){let n=jn(t,r);return(i=()=>{},{scope:o={},params:s=[]}={})=>{n.result=void 0,n.finished=!1;let a=z([o,...e]);if(typeof n=="function"){let c=n(n,a).catch(l=>re(l,r,t));n.finished?(Ne(i,n.result,a,s,r),n.result=void 0):c.then(l=>{Ne(i,l,a,s,r)}).catch(l=>re(l,r,t)).finally(()=>n.result=void 0)}}}function Ne(e,t,r,n,i){if(Me&&typeof t=="function"){let o=t.apply(r,n);o instanceof Promise?o.then(s=>Ne(e,s,r,n)).catch(s=>re(s,i,t)):e(o)}else typeof t=="object"&&t instanceof Promise?t.then(o=>e(o)):e(t)}var wt="x-";function C(e=""){return wt+e}function cr(e){wt=e}var De={};function d(e,t){return De[e]=t,{before(r){if(!De[r]){console.warn(String.raw`Cannot find directive \`${r}\`. \`${e}\` will use the default order of execution`);return}let n=G.indexOf(r);G.splice(n>=0?n:G.indexOf("DEFAULT"),0,e)}}}function lr(e){return Object.keys(De).includes(e)}function pe(e,t,r){if(t=Array.from(t),e._x_virtualDirectives){let o=Object.entries(e._x_virtualDirectives).map(([a,c])=>({name:a,value:c})),s=Et(o);o=o.map(a=>s.find(c=>c.name===a.name)?{name:`x-bind:${a.name}`,value:`"${a.value}"`}:a),t=t.concat(o)}let n={};return t.map(dr((o,s)=>n[o]=s)).filter(mr).map(zn(n,r)).sort(Kn).map(o=>Bn(e,o))}function Et(e){return Array.from(e).map(dr()).filter(t=>!mr(t))}var yt=!1,de=new Map,ur=Symbol();function fr(e){yt=!0;let t=Symbol();ur=t,de.set(t,[]);let r=()=>{for(;de.get(t).length;)de.get(t).shift()();de.delete(t)},n=()=>{yt=!1,r()};e(r),n()}function _t(e){let t=[],r=a=>t.push(a),[n,i]=Yt(e);return t.push(i),[{Alpine:K,effect:n,cleanup:r,evaluateLater:x.bind(x,e),evaluate:R.bind(R,e)},()=>t.forEach(a=>a())]}function Bn(e,t){let r=()=>{},n=De[t.type]||r,[i,o]=_t(e);Oe(e,t.original,o);let s=()=>{e._x_ignore||e._x_ignoreSelf||(n.inline&&n.inline(e,t,i),n=n.bind(n,e,t,i),yt?de.get(ur).push(n):n())};return s.runCleanups=o,s}var Pe=(e,t)=>({name:r,value:n})=>(r.startsWith(e)&&(r=r.replace(e,t)),{name:r,value:n}),Ie=e=>e;function dr(e=()=>{}){return({name:t,value:r})=>{let{name:n,value:i}=pr.reduce((o,s)=>s(o),{name:t,value:r});return n!==t&&e(n,t),{name:n,value:i}}}var pr=[];function ne(e){pr.push(e)}function mr({name:e}){return hr().test(e)}var hr=()=>new RegExp(`^${wt}([^:^.]+)\\b`);function zn(e,t){return({name:r,value:n})=>{let i=r.match(hr()),o=r.match(/:([a-zA-Z0-9\-_:]+)/),s=r.match(/\.[^.\]]+(?=[^\]]*$)/g)||[],a=t||e[r]||r;return{type:i?i[1]:null,value:o?o[1]:null,modifiers:s.map(c=>c.replace(".","")),expression:n,original:a}}}var bt="DEFAULT",G=["ignore","ref","data","id","anchor","bind","init","for","model","modelable","transition","show","if",bt,"teleport"];function Kn(e,t){let r=G.indexOf(e.type)===-1?bt:e.type,n=G.indexOf(t.type)===-1?bt:t.type;return G.indexOf(r)-G.indexOf(n)}function J(e,t,r={}){e.dispatchEvent(new CustomEvent(t,{detail:r,bubbles:!0,composed:!0,cancelable:!0}))}function D(e,t){if(typeof ShadowRoot=="function"&&e instanceof ShadowRoot){Array.from(e.children).forEach(i=>D(i,t));return}let r=!1;if(t(e,()=>r=!0),r)return;let n=e.firstElementChild;for(;n;)D(n,t,!1),n=n.nextElementSibling}function E(e,...t){console.warn(`Alpine Warning: ${e}`,...t)}var _r=!1;function gr(){_r&&E("Alpine has already been initialized on this page. Calling Alpine.start() more than once can cause problems."),_r=!0,document.body||E("Unable to initialize. Trying to load Alpine before `<body>` is available. Did you forget to add `defer` in Alpine's `<script>` tag?"),J(document,"alpine:init"),J(document,"alpine:initializing"),ue(),er(t=>S(t,D)),te(t=>P(t)),Ae((t,r)=>{pe(t,r).forEach(n=>n())});let e=t=>!Y(t.parentElement,!0);Array.from(document.querySelectorAll(br().join(","))).filter(e).forEach(t=>{S(t)}),J(document,"alpine:initialized"),setTimeout(()=>{Vn()})}var vt=[],xr=[];function yr(){return vt.map(e=>e())}function br(){return vt.concat(xr).map(e=>e())}function Le(e){vt.push(e)}function $e(e){xr.push(e)}function Y(e,t=!1){return j(e,r=>{if((t?br():yr()).some(i=>r.matches(i)))return!0})}function j(e,t){if(e){if(t(e))return e;if(e._x_teleportBack&&(e=e._x_teleportBack),!!e.parentElement)return j(e.parentElement,t)}}function wrLine truncated

static/vendor.sha256

@@ -0,0 +1 @@
+3ed1eed252488921df65e363d6715deb04d7f92aaedb9e52199fdf73cb1e0ad3  js/alpine.min.js

static/vendor_test.go

@@ -0,0 +1,92 @@
+package static_test
+
+import (
+	"bufio"
+	"crypto/sha256"
+	"encoding/hex"
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"sneak.berlin/go/webhooker/static"
+)
+
+const manifestPath = "vendor.sha256"
+
+// fetchHint is appended to every failure here: the assets the manifest
+// covers are fetched by the build, not committed, so a fresh clone that
+// has not run script/fetch-assets fails this test and should be told why.
+const fetchHint = "run `script/fetch-assets` (or `make assets`) to install " +
+	"the pinned third-party assets"
+
+// TestVendoredAssetsMatchManifest asserts that every asset listed in
+// static/vendor.sha256 is embedded in the binary with exactly the pinned
+// bytes. script/fetch-assets verifies the same hashes at download time;
+// this test verifies them again on what actually ships, so a build that
+// skipped, cached, or subverted the fetch cannot produce a binary serving
+// unpinned third-party JavaScript.
+func TestVendoredAssetsMatchManifest(t *testing.T) {
+	t.Parallel()
+
+	entries := readManifest(t)
+	require.NotEmpty(t, entries, "%s lists no assets", manifestPath)
+
+	for path, want := range entries {
+		t.Run(path, func(t *testing.T) {
+			t.Parallel()
+
+			data, err := static.Static.ReadFile(path)
+			require.NoErrorf(
+				t, err,
+				"%s is listed in %s but is not embedded; %s",
+				path, manifestPath, fetchHint,
+			)
+
+			sum := sha256.Sum256(data)
+			got := hex.EncodeToString(sum[:])
+			require.Equalf(
+				t, want, got,
+				"embedded %s does not match its pinned sha256 in %s; %s",
+				path, manifestPath, fetchHint,
+			)
+		})
+	}
+}
+
+// readManifest parses static/vendor.sha256, which is in sha256sum(1)
+// format with paths relative to static/.
+func readManifest(t *testing.T) map[string]string {
+	t.Helper()
+
+	f, err := os.Open(manifestPath)
+	require.NoError(t, err, "opening %s", manifestPath)
+
+	defer func() { require.NoError(t, f.Close()) }()
+
+	entries := make(map[string]string)
+	scanner := bufio.NewScanner(f)
+
+	for scanner.Scan() {
+		line := strings.TrimSpace(scanner.Text())
+		if line == "" || strings.HasPrefix(line, "#") {
+			continue
+		}
+
+		fields := strings.Fields(line)
+		require.Lenf(
+			t, fields, 2,
+			"%s: malformed entry %q, want \"<sha256>  <path>\"",
+			manifestPath, line,
+		)
+
+		sum, path := fields[0], fields[1]
+		require.Lenf(t, sum, 64, "%s: %q is not a sha256", manifestPath, sum)
+		entries[path] = sum
+	}
+
+	require.NoError(t, scanner.Err(), "reading %s", manifestPath)
+
+	return entries
+}