SRI test treats same registrable domain + scheme as same origin

What information was incorrect, unhelpful, or incomplete?

The SRI test in subresource-integrity.js uses registrable domain (eTLD+1, via tldts/Public Suffix List) plus scheme to test for equivalent origins, not the actual origin.

src.domain === parse(requests.site.hostname).domain treats any host on the site's registrable domain as a "secure origin":

• Host too loose: cdn.example.com, evil.example.com, www.example.com all collapse to example.com, so a script from a different subdomain is exempted from the SRI penalty. That's same-site, not same-origin.
• Port ignored; scheme is only used for the separate "secure scheme" check, not origin identity.

The assumption that controlling a registrable domain implies controlling all its subdomains fails under subdomain takeover and delegated/vendor-hosted subdomains — the cross-origin resources SRI is meant to protect.

What did you expect to see?

Equivalent origin compared as exact scheme + host + port. A different subdomain is a distinct origin.

Do you have any supporting links, references, or citations?

• https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy
• https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity

Do you have anything more you want to share?

Raised by the security team: "the tests seem to be using public suffix and scheme to test for equivalent origins. This is not correct." Pre-existing, independent of the protocol-relative-URL work on 464-protocol-relative-urls-with-https.