# Vendored browser libraries

One file, pinned by hash. The /play page refuses to render if the file on disk
does not match the hash recorded in app/vendor.py, and the script tag carries
the same hash as Subresource Integrity, so the browser refuses to run it if it
changed in transit. No third party host is ever contacted.

## ethers 6.17.0, dist/ethers.umd.min.js

- Source: https://registry.npmjs.org/ethers/-/ethers-6.17.0.tgz
- npm tarball integrity (as published by the registry): sha512-BpyrpIPJ3ydEVow8zGaz1DuPS7YU8DcWxuBnY9a0UA/lvAPwrMr+EPXsfrul628SRaekPNeIM4UFh/91GWZang==
- File: package/dist/ethers.umd.min.js, 526551 bytes, copied unmodified
- sha256: 532950515fd29ae9f7a21ceb2b68100815024d7944c3d5a92246d5b900bd703b
- SRI: sha384-lApM4ELRuFNT7NgNqnXB2zFWgSDdhVvmnOHov2DPJz/2zuNpZImXBeklFr18ilvi
- Licence: MIT, see ETHERS_LICENSE.md
- Checked for eval: the file contains no eval( and no new Function( (the three
  "new Function" matches are the FunctionFragment class). It runs under a CSP
  with no unsafe-eval and no unsafe-inline.

To re-verify

    curl -sL https://registry.npmjs.org/ethers/-/ethers-6.17.0.tgz | sha512sum
    sha256sum app/static/vendor/ethers.umd.min.js

To upgrade, repeat the steps above with the new version, update app/vendor.py
and this file, and run the tests. The hash test fails until both agree.