Lunr.js for offline search with default CDN is not working

[pankeshpatel]

I am trying to enable Lunr.js offline search in my hugo site with docsy theme.

I have enabled the following in my config.toml file

# Enable Lunr.js offline search
offlineSearch = true
offlineSearchSummaryLength = 70
offlineSearchMaxResults = 10

and disabled the following algolia_docsearch , gcs_engine_id

when I run locally on my mac, the search functionality works.

however, when I deployed it on S3 bucket by CloudFront, it gave me the following error

Refused to load the script 'https://unpkg.com/lunr@2.3.8/lunr.min.js' because it violates the following Content Security Policy directive: "script-src 'self' https://code.jquery.com https://stackpath.bootstrapcdn.com https://cdnjs.cloudflare.com". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

Upon some trial and test, I have realized that this CDN 'https://unpkg.com/lunr@2.3.8/lunr.min.js causes an issue.

When I add the following CDN manually on my pages and upload to S3 bucket, the search function works.

<script src="https://cdnjs.cloudflare.com/ajax/libs/lunr.js/2.3.9/lunr.min.js" integrity="sha512-4xUl/d6D6THrAnXAwGajXkoWaeMNwEKK4iNfq5DotEbLPAfk6FSxSP3ydNxqDgCw1c/0Z1Jg6L8h2j+++9BZmg==" crossorigin="anonymous" referrerpolicy="no-referrer"></script>

My hugo with docsy them project use the following this submodules https://github.com/google/docsy/tree/2bedb2ff278eddba4a7fc4441ca6bf7a42caeb68

This submodule by default puts "https://unpkg.com/lunr@2.3.8/lunr.min.js" CDN and does not allow me to change it to "https://cdnjs.cloudflare.com/ajax/libs/lunr.js/2.3.9/lunr.min.js"

My question is how could I resolve this CDN issue to enable "offline-search"

The submodule overwrites my changes. So it prevents me from putting any content security meta tag. https://github.com/google/docsy/tree/2bedb2ff278eddba4a7fc4441ca6bf7a42caeb68