Subresource Integrity & Supply Chain Hardening

Every CDN-hosted library, every npm package, every third-party widget is a potential injection vector. A single compromised CDN edge node or maintainer account can silently backdoor millions of sites — bypassing traditional perimeter defences by exploiting the implicit trust modern apps extend to upstream registries and delivery networks.

Subresource Integrity (SRI) is the browser’s answer: embed a base64-encoded cryptographic hash in your <script> or <link> tag, and the browser refuses to execute any resource whose bytes don’t match — no exceptions.

This reference covers the complete supply chain hardening stack across 89 pages:

• Hash algorithms and encoding — SHA-256 vs SHA-384 vs SHA-512, collision resistance, the base64 rules that trip up hand-built hashes, and how browsers verify
• Build-time automation — generating and injecting hashes in Webpack 5, Vite, Rollup and esbuild pipelines, or straight from the command line
• CI/CD integrity gates — hash manifests as build artifacts, failing the pipeline on digest drift, and verifying that the deployed origin serves exactly the bytes you signed off
• CDN trust mapping — per-origin policies, jsDelivr and unpkg pinning, cross-origin resource sharing rules, and the edge transforms that silently rewrite your bytes
• Dynamic loading — keeping integrity checks intact when scripts, ES modules, import maps, lazy-loaded chunks, workers and WebAssembly load at runtime
• Third-party tags — what to do about analytics and tag managers that ship continuously and cannot carry a static hash
• Dependency auditing — lockfile analysis, CycloneDX and SPDX SBOMs, Sigstore and SLSA provenance, registry hardening, continuous monitoring, and vulnerability triage
• Runtime policy enforcement — CSP nonces and hash-based policies, Trusted Types for DOM XSS, violation telemetry, and how to layer all three into one coherent script policy

Start with Core SRI Fundamentals if you’re new to the topic, or jump straight to the section most relevant to your current work. Once hashes are generated, CI/CD Integrity Gates keeps them honest release after release, and Unified Script Policy Architecture shows how SRI, Content Security Policy and Trusted Types combine into a single defensible boundary.