adding hashing script for safer inline

csp-hash.py

@@ -0,0 +1,28 @@
+#!/usr/bin/env python3
+"""Print CSP sha256-... tokens for index.html's inline <style>/<script> blocks.
+
+Re-run this after editing index.html's inlined CSS/JS (i.e. after the
+re-minify/re-inline step described in the README), then paste the printed
+values into the nginx server block's Content-Security-Policy header.
+"""
+import base64
+import hashlib
+import pathlib
+import re
+
+html = pathlib.Path(__file__).with_name("index.html").read_text(encoding="utf-8")
+
+
+def csp_token(text):
+    digest = hashlib.sha256(text.encode("utf-8")).digest()
+    return "'sha256-" + base64.b64encode(digest).decode("ascii") + "'"
+
+
+style_match = re.search(r"<style[^>]*>(.*?)</style>", html, re.S)
+script_match = re.search(r"<script>(.*?)</script>", html, re.S)
+
+if not style_match or not script_match:
+    raise SystemExit("Couldn't find both an inline <style> and <script> block in index.html")
+
+print("style-src :", csp_token(style_match.group(1)))
+print("script-src:", csp_token(script_match.group(1)))