Where verifyScriptSignature can be used?

[ilteoood]

Looking at the code, it seems that verifyScriptSignature can be used just for code downloaded from the remote.
Is that right?

if so, it would be great to specify it into the doc.
Honestly, to me it would be great even if the signature could be verified while using the getFileSystemURL method, to potentially avoid anti-tampering.

Any ideas?

[jbroma]

It can be used for any kind of script - both for local & remote. You should be able to set it via ScriptManager.shared.addResolver()

[jbroma]

https://re-pack.dev/api/plugins/code-signing#enable-verification

[ilteoood]

Yes I did that, but if I load the script using the getFileSystemUrl function and load it using a strict way it seems to be ignored.
Which makes sense, because I see that the check is made only in the RemoteScriptLoader

[jbroma]

oh you're right - we can totally add that to unify the behaviour between the both - would you like to contribute PR for this?

[ilteoood]

This has been implemented by #1186