Apologies for not being logged in earlier. I've fixed this bug with a one line commit on my GitLab account: https://gitlab.com/obsessivefacts/librejs/-/commit/372f192bd2a003744fb60403d5b8e11d12e7f92e

Explanation here:

LibreJS' ResponseTextFilter class in ResponseProcessor.js will overwrite remote files with the output ultimately provided by get_script in main_background.js. Typically this adds a comment to the top of the file saying

> /* LibreJS: script accepted. */

This is fine in most cases, but in the case of a Subresource Integrity Hash (https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity) it breaks the hash sum of the script causing the browser to reject it as "tampered with."

Subresource Integrity Hash is a crucial security feature for sites that use CDN or may otherwise have an untrustworthy remote script embed.

The fix is simply to NOT rewrite and re-encode the remote script when we see this "script accepted" comment at the beginning. Doing this will not unblock any scripts that should be blocked, will not break any of the Jasmine tests, will not break reports, and will actually speed up the entire page loading process as we are not unnecessarily re-encoding data.