README

SRI Integrity Hash helper

Loader/Loaders

This is a small class to make interacting with SRI hashes a bit simpler and easier.

Most use cases will want to use the Loaders class (see example below).

Standard Format

Out of the box, assets can be loaded, provided they are in the following format:

{
    "scriptName": {
        "src": "script-src.js",
        "integrity": "sha512-test"
    },
    "anotherScriptName": {
        "src": "another-script-src.js",
        "integrity": "sha512-test"
    }
}

This can be easily generated from Webpack using the library webpack-assets-manifest.

Other formats

In the case that other formats are provided or desired, a new Loader implementing LoaderInterface may be passed to the Loaders class.

Example

use DDM\SRIIntegrityHash\Loaders;

$loaders = new Loaders();

$file = $loaders->getFile('example/assets.json', 'common.js');

echo sprintf("Loaded %s from %s\n", $file->filename, $file->namespace);
echo sprintf("Script tag: %s\n", $file->toScript());

Using other loaders

By default, the file loader (DDM\SRIIntegrityHash\FileLoader) will be used. You can register other autoloaders if you are loading via another source.

Generator

A script and set of classes exists for generating new asset maps. A command is present in bin/console.php which can be used to output JSON, usually to put into its own file. It takes any number of arguments and generates hashes for those files. See below for script usage.

Script usage

If running from this repository:

php bin/sri-assets-generator generate --file=https://apis.google.com/js/api.js --file=https://apis.google.com/js/api-mock.js

If running from a composer installation:

./vendor/bin/sri-assets-generator ...

Arguments

--file — Pass any number of files with --file arguments.
--ignore-ssl — Ignore SSL verification in FileReader

Defining a script in composer.json

If you want a quick and easy way to do the above, you might want to define a scripts entry in your composer.json.

{
  ...
  "scripts": {
    "generate-assets-map": "sri-assets-generator generate --file=https://apis.google.com/js/api.js"
  }
}

Reading from other sources

If you'd like to read from other sources — say, a JSON file with a list of hashes, or an API result, or the database, or something other than just using file_get_contents, you can create a new Reader implementing ReaderInterface. It can be passed in with as Generator::read(ReaderInterface, resource).

mattmontgomery / sri-integrity-hashes

Maintainers

Details