ihashgen
Generate Intergrity hash for the use of CDN, which can be used via CLI or Node packages. (Haven't tested on web)
Name: ihashgen
Version
Stable
- ihashgen@1.1.3
- ihashgen@1.1.4 [Added typings]
- ihashgen@1.1.5 [Added inquirer]
- ihashgen@1.1.6 [Code refactor]
- ihashgen@1.1.7 [Shows file sizes in bytes]
Why use SRI?
https://news.ycombinator.com/item?id=14111499
unpkg website was compromised, so you don't want to risk your website to be phished or whatsoever, a simple intergrity hash check will solve this issue.
Problem Solved
Initially, I wanted to use unpkg for cdn alongside alongside with checksum for intergrity, but I found out that I need to run follwing bash command in order to generate hash. Therefore, I decided to write a CLI tools to "automate" that.
curl https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css | openssl dgst -sha384 -binary | openssl base64 -A
With intergrity checksum, eventhough the CDN is compromised, but your website are still safe from it.
console on webpage when the checksum is not the same
Inspired from srihash.org
Usage
Installation
Install with npm or yarn
npm install -g ihashgen # yarn global add ihashgen
Using it
as Dependency
node.js
ihashgen is a function in typescript
;
CLI tools
General
> ihashgen --version1.1.3> ihashgen --helpUsage: ihashgen [options] [command] Options: -V, --version output the version number -h, --help output usage information Commands: generate|g [options] <cdn_url> generate links based on url given
Generate
use ihashgen g <cdn_url>
or ihashgen generate <cdn_url>
> ihashgen g --helpUsage: generate|g [options] <cdn_url> generate links based on url given Options: -t, --type [css/js] specify file type -a, --algo [sha384] specify hashing algorithm -h, --help output usage information
Use command ihashgen generate <cdn_url>
,
-t
or--type
(file type) is set to default to check the url string ends with js or css-a
or--algo
(hashing algorithm used) is set to sha384
> ihashgen g https://unpkg.com/react@16.0.0/umd/react.production.min.js -t js -a sha384Generatring hashes
Library
- Typescript
- Node.js
CLI
- commander
- chalk
- ora
- inquirer
Test
- Jest
Library used
- Crypto-Js
- Axios
Development
yarn test
to run unit test.yarn prod
to generate for NPM. (This command works on Linux/Unix based machine)yarn sample
to run a sample cli command to ihashgen
Roadmaps
- Support other hashing algorithm
- Better CLI with inquirer
- Create webpack configuration for dynamic-cdn-webpack-plugin
License
MIT