Is Subresource Integrity any useful for inline JavaScript?

Question

I'm reading about Subresource Integrity and understand it's meant for verifying external files. I guess it's no surprise I couldn't find any reference to inline JavaScript from either MDN or W3C.

So, is it safe to say that the SRI-related attributes, integrity and crossorigin, are completely useless for inline JavaScript ?

Answer 1

So, is it safe to say that the SRI-related attributes integrity and crossorigin are completely useless for inline JavaScript?

Yes, because those attributes are only useful for a script element that has a src attribute:

https://html.spec.whatwg.org/multipage/scripting.html#attr-script-integrity

The integrity attribute represents the integrity metadata for requests which this element is responsible for. The value is text. The integrity attribute must not be specified when embedding a module script or when the src attribute is not specified. [SRI]

Also as noted in the question, that’s also made clear by the description in MDN:

https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity

Subresource Integrity (SRI) is a security feature that enables browsers to verify that files they fetch (for example, from a CDN) are delivered without unexpected manipulation. It works by allowing you to provide a cryptographic hash that a fetched file must match.