CSP - installing webpart from Site Collection app catalog or Tenant app catalog in classic experience does't populate Trusted script sources with external links

[RafalUrbanski]

What type of issue is this?

Question

What SharePoint development model, framework, SDK or API is this about?

💥 SharePoint Framework

Target SharePoint environment

SharePoint Online

What browser(s) / client(s) have you tested

• 💥 Internet Explorer
• 💥 Microsoft Edge
• 💥 Google Chrome
• 💥 FireFox
• 💥 Safari
• mobile (iOS/iPadOS)
• mobile (Android)
• not applicable
• other (enter in the "Additional environment details" area below)

Additional environment details

• SPFx version: 1.18

Issue description

Based on the CSP documentation, external files added to the externals section in ./config/config.json should be automatically pulled and added to the Trusted Script Sources list. I tested this, and it works as expected when using the Tenant App Catalog in modern view. However, when using the classic view, our CDN source is listed during installation, but the Trusted Script Sources list is not automatically updated.
Is there any chance this will be fixed or updated?

I also tried adding an app with entries in the externals section to the Site Collection App Catalog. The behavior was similar to what we observed with the Tenant App Catalog in classic mode: CDN links were listed during installation but were not automatically added to the Trusted Script Sources list.
What behavior should we expect in the case of the Site Collection App Catalog?

I am asking these questions as we are preparing for March, when CSP will become mandatory.
@jansenbe

[jansenbe]

@RafalUrbanski : what you've reporting is correct, today the auto population is not working when the classic tenant app catalog UX is used, nor does it work for site collection app catalogs. While the former is evaluated for fixing, the latter (auto populating trusted script sources from site collection app catalog) will not. As a workaround for the latter case one can manually/scripted add the needed trusted script sources.

I'll update the docs to clarify this