Failed to find a valid digest in the 'integrity' attribute for resource #224

robinboening · 2015-11-14T12:26:13Z

I get this error on heroku (not locally)

Failed to find a valid digest in the 'integrity' attribute for resource 'http://rubyissues.herokuapp.com/assets/rubyissues-dc683ef8d41f45e5fdafceda1a26598f.css' with computed SHA-256 integrity 'vGH6uxiZBXnDr46nPJPx2/V82if1Sij2FDhPgXSk6xI='. The resource has been blocked.

It seems to be similar to this: ember-cli/ember-cli#5040, but I can not fix it by adding an empty integrity attribute to the link tag. (I can see another integrity attribute is added automatically)

I am posting here because I broke the issue down to one of the @import statements in my app.scss:
The @import 'ember-paper'; - When I remove this line its working.

Seems to be an issue in chrome only. No problem when using Firefox.

The text was updated successfully, but these errors were encountered:

mike1o1 · 2015-11-14T22:54:03Z

I had a similar issue running in production, and just ended up adding the empty integrity tag to every script and link tag. It resolved it for me. Don't think there's much we can do on our end here.

Here is what my index works, and this is working fine for me. Did you add it to all tags?

Note I haven't tested with the latest ember-cli, but this is working for me

<!DOCTYPE html>
<html>
  <head>
    <meta charset="utf-8">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <title>Client</title>
    <meta name="description" content="">
    <meta name="viewport" content="width=device-width, initial-scale=1">

    {{content-for 'head'}}

    <link rel="stylesheet" href="assets/vendor.css" integrity="">
    <link rel="stylesheet" href="assets/client.css" integrity="">

    {{content-for 'head-footer'}}
  </head>
  <body layout="row">
    {{content-for 'body'}}

    <script src="assets/vendor.js" integrity=""></script>
    <script src="assets/client.js" integrity=""></script>

    {{content-for 'body-footer'}}
  </body>
</html>

mansona · 2016-01-14T10:14:18Z

This issue is probably caused by some encoding problem somewhere in the included files, take a look here to follow the progress of the bug jonathanKingston/ember-cli-sri#5 .

The simplest way to "solve" this while we're waiting for it to get fixed is to just remove the "ember-cli-sri": "^1.0.1", line from your package.json and it will no longer add the integrity attribute 👍

jonathanKingston · 2016-01-27T20:08:00Z

@mansona you will have trouble in old Chrome's if you don't have >1.1 anyway as that was actually Chromes issue. Removing security really isn't a good solution here please can I ask you not to advocate that. The bug you linked to talks about the issue there.

However all these issues are gone and actually ember-cli-sri is back in the stance of never disabling itself any more as Chrome has a stable implementation of SRI. Can I ask all three of you to ember install ember-cli-sri@2.0.0? Also removing any integrity=""'s from files unless they are generated on the fly (like testem.js)

That way you all get better security and this issue can be closed if it's ok. 😄

mival · 2016-02-11T17:44:15Z

I have also this issue. I am using ember-cli 2.3.0-beta.2, ember-paper 0.2.11, ember-cli-sri 2.0.0. Testing in Chrome 48.0.2564.109 Windows/Linux and Firefox 44.0.1 Linux and integrity check fails. After disabling ember-paper integrity check is working fine. Currently for me only working solution is disabling ember-cli-sri.

jonathanKingston · 2016-02-11T22:41:40Z

@mival do you have any other addons installed that might output the shape of your code before publishing?

mival · 2016-02-12T10:28:03Z

@jonathanKingston I use new ember-cli generated app and only install ember-paper. Config files attached.

bower.json.txt
package.json.txt

DanChadwick · 2016-02-25T12:17:35Z

@jonathanKingston - I have the identical issue, using ember-cli-sri@2.0.0. I removed node_modules, bower_components, dist, and temp; npm and bower cache clean; npm and bower install. The hashes on the .js files are fine, but those on the style sheets are not, in both FireFox 44.0.2 and Chrome 48. Windows 10. I'm wondering if it is related to the sass or less build process. I'm also using ember-table, which uses less. I'm happy to provide any additional data or try any experiments to help diagnose this.

jonathanKingston · 2016-02-26T12:21:23Z

@DanChadwick yeah less and/or sass could be running after sri calculation which certainly would give you a bad time. There has been an update to fix unicode issues but I can't see that solving anything for you. A smaller example would help right now as my time is a little limited. Thanks!

miguelcobain/ember-paper#224

ehntoo · 2016-03-17T14:43:15Z

I also hit this issue today. I don't have any dependencies on LESS, so this may be an issue with SASS alone?

For my app, disabling SRI entirely was an acceptable solution, so that's the route I've taken for now. I'd be willing to help test out fixes if anyone else needs a test subject, though.

JeffreyRuder · 2016-03-18T02:38:18Z

I've also run into this issue recently. I likewise disabled SRI since the app is not being used in a production environment.

MiguelMadero · 2016-04-06T13:40:49Z

I got the same today, with the latest of everything and sri#^2.1.0. That's an OS project see https://github.com/MiguelMadero/ember-cli-bundle-loader-consumer, so it could help as a good test case.

Since this is just a demo, I simply blanked the integrity attribute

chbonser · 2016-04-14T20:02:04Z

I ran into this same issue today (css files fail for SRI check in any browser when using ember cli 2.4 and ember paper). Here is what I discovered...

ember-paper runs autoprefixer in a postprocessTree hook. ember-cli-sri runs its magic in the same hook. Because ember-cli-sri was before ember-paper in my package.json, sri runs before autoprefixer. Oops.

As a short term fix, rather than blank the integrity attribute you can move ember-paper before ember-cli-sri in your package json.

I'll submit a PR shortly to ensure that ember-paper installs after ember-cli-sri so that the package.json order doesn't matter.

DanChadwick · 2016-04-14T20:20:13Z

@chbonser: Awesome! Can you submit the PR against branch wip/v1.0.1, where development is focused?

chbonser · 2016-04-14T20:33:47Z

@DanChadwick did you mean wip/v1.0.0?

DanChadwick · 2016-04-14T20:34:46Z

@chbonser: Just planning ahead. 😜 Yes.

chbonser · 2016-04-14T20:48:14Z

See PR #337. The build failed but it doesn't look like something that I caused. Please let me know if you need anything else from me.

miguelcobain · 2016-04-15T16:36:08Z

Closed by #337

elwayman02 added a commit to elwayman02/ember-data-echonest that referenced this issue Feb 29, 2016

Disable ember-cli-sri for now

75c1967

miguelcobain/ember-paper#224

miguelcobain closed this as completed Apr 15, 2016

kalebdf mentioned this issue Apr 25, 2016

Should Run Before SRI Integrity Generation Semantic-Org/Semantic-UI-Ember#96

Closed

zacstewart mentioned this issue May 13, 2016

Should run before SRI Integrity Generation cibernox/ember-power-select#503

Closed

nwestbury mentioned this issue Jun 3, 2016

Differences between packaged and developed application? adopted-ember-addons/ember-electron#68

Closed

benjaminkreen mentioned this issue Aug 28, 2017

APERTA-11128 Bugs/ember cli sri fix Aperta-project/Aperta#3413

Merged

5 tasks

Gan-Jason mentioned this issue Jul 27, 2019

Can i set up the comment below the article? funkydan2/alpha-church#14

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Failed to find a valid digest in the 'integrity' attribute for resource #224

Failed to find a valid digest in the 'integrity' attribute for resource #224

robinboening commented Nov 14, 2015

mike1o1 commented Nov 14, 2015

mansona commented Jan 14, 2016

jonathanKingston commented Jan 27, 2016

mival commented Feb 11, 2016

jonathanKingston commented Feb 11, 2016

mival commented Feb 12, 2016

DanChadwick commented Feb 25, 2016

jonathanKingston commented Feb 26, 2016

ehntoo commented Mar 17, 2016

JeffreyRuder commented Mar 18, 2016

MiguelMadero commented Apr 6, 2016

chbonser commented Apr 14, 2016

DanChadwick commented Apr 14, 2016

chbonser commented Apr 14, 2016

DanChadwick commented Apr 14, 2016 •

edited

Loading

chbonser commented Apr 14, 2016

miguelcobain commented Apr 15, 2016

Failed to find a valid digest in the 'integrity' attribute for resource #224

Failed to find a valid digest in the 'integrity' attribute for resource #224

Comments

robinboening commented Nov 14, 2015

mike1o1 commented Nov 14, 2015

mansona commented Jan 14, 2016

jonathanKingston commented Jan 27, 2016

mival commented Feb 11, 2016

jonathanKingston commented Feb 11, 2016

mival commented Feb 12, 2016

DanChadwick commented Feb 25, 2016

jonathanKingston commented Feb 26, 2016

ehntoo commented Mar 17, 2016

JeffreyRuder commented Mar 18, 2016

MiguelMadero commented Apr 6, 2016

chbonser commented Apr 14, 2016

DanChadwick commented Apr 14, 2016

chbonser commented Apr 14, 2016

DanChadwick commented Apr 14, 2016 • edited Loading

chbonser commented Apr 14, 2016

miguelcobain commented Apr 15, 2016

DanChadwick commented Apr 14, 2016 •

edited

Loading