feat(@angular/build): emit debug ids for stable subresource integrity hashes by IchordeDionysos · Pull Request #33110 · angular/angular-cli

angular-robot

Enable generating sub-resource integrity hashes when using error tracking tools relying on Debug IDs linking generated code files with source maps.

Closes #33108

PR Checklist

Please check to confirm your PR fulfills the following requirements:

The commit message follows our guidelines: https://github.com/angular/angular-cli/blob/main/CONTRIBUTING.md#-commit-message-guidelines
Tests for the changes have been added (for bug fixes / features)
Docs have been added / updated (for bug fixes / features)

PR Type

What kind of change does this PR introduce?

Bugfix
Feature
Code style update (formatting, local variables)
Refactoring (no functional changes, no api changes)
Build related changes
CI related changes
Documentation content changes
Other... Please describe:

What is the current behavior?

When Angular generates source maps, they only include a link to the source map URL and no Debug ID:

console.log(1);
//# sourceMappingURL=foo.js.map

The source map file also does not contain a debug ID:

{ "version": 3, "debugId": "old", "mappings": "" }

Issue Number: #33108

What is the new behavior?

When Angular generates source maps, in addition to the source map URL, generated files will also include a Debug ID above the sourceMappingURL:

console.log(1);
//# debugId=11111111-2222-5333-9444-555555555555
//# sourceMappingURL=foo.js.map

In addition the source map file will include the matching Debug ID:

{ "version": 3, "debugId": "old", "mappings": "", "debugId": "11111111-2222-5333-9444-555555555555" }

Does this PR introduce a breaking change?

Other information

I'm happy to hear if there are concerns with this particular approach and which alternative solutions might be a better solution.

This allows error tracking to more reliably map generated code files to their corresponding stack traces.
Error tracking tools have historically solved this by running post-processing scripts that generate and inject Debug IDs after the framework build script and before deployment.

However, this approach will break any integrity hash that Angular generated for SRI as the file content will have changed.

This PR is part of a two fold effort to enable SRI for our specific integration of Angular.

The first PR, implementing support for dynamically loaded files can be found here, and should be merged first: #33109