comment #1:

> I'll take a look later this week.  Feel free to follow up / ping me.

Thank you!

When reading a site with an inline script that has correct license headers, LibreJS prefixes the script with:

/* LibreJS: script accepted. */

This changes the script hash and therefore breaks the CSP validation in the site.

This happens not on the initial load of the page, but at the second loading.

It does not happen if all scripts on the page are accepted.

When adding a note to a script tag, this note should be added before the script tag not inside it. Any change to the content of the script tag changes the hash and therefore blocks execution of the script.

To reproduce most easily (sorry for using github here):

$ git clone https://github.com/freenet/browser.git freenetbrowser && cd freenetbrowser && ./bootstrap.sh --prefix=$HOME/.local && make install && ~/.local/bin/freenetbrowser --install USK@~22K5-BaMq8px171N6okVmdI2g9zjLBxs422HshMEgY,lwYlSm7ynpitof79fD4RtmzTx9fbPnid72vTPIdzmq0,AQACAAE/stream-radiocc-again/10/

During the first run, it will load the inline script.
Once the page is loaded, hit F5.
Now the inline script is no longer accepted.

Likely related to https://savannah.gnu.org/bugs/?58131