Subresource Integrity
Pin a released version and verify downloaded files against trusted expected bytes.
Published v2.1.1 reference
These SHA-384 values were computed from the approved v2.1.1 release ZIP, cross-checked with its published SRI.txt and compared byte-for-byte with the versioned CDN files on 2026-10-12. GitHub release downloads require access to the private source repository; the CDN files and the hashes below are public.
| File | Integrity |
|---|---|
| focus-ui.css | sha384-L89gOIZylesOkfz2j2Bcfub2w47fR77Zdf+3ru/lp8xRNors7iJuxfdo/eODC34X |
| focus-ui.js | sha384-QfJMgIfXQZ49FTKu8bbIL7EO65UF72ATw7hwrk447acLAgmASOupyjqQh+AO64fZ |
| focus-ui.min.js | sha384-iUMwqkYI3CKz5rdvu93jxzOMhmhuW154RquKbJtSVGIyEhNvAzCQRQkzZgiQvx4Y |
| focus-ui.esm.js | sha384-3QF/lFf4h45RZCTZpe8tyOCCctk7FwAzxmHvSS6fXP7wKDQyXKkHnc8RMpc8UWTB |
HTML usage
Use crossorigin="anonymous" for cross-origin integrity checks. The CDN must send an appropriate CORS response; the checked versioned assets support anonymous cross-origin loads.
<link rel="stylesheet"
href="https://cdn.focus-ui.de/v2.1.1/focus-ui.css"
integrity="sha384-L89gOIZylesOkfz2j2Bcfub2w47fR77Zdf+3ru/lp8xRNors7iJuxfdo/eODC34X"
crossorigin="anonymous">
<script defer src="https://cdn.focus-ui.de/v2.1.1/focus-ui.min.js"
integrity="sha384-iUMwqkYI3CKz5rdvu93jxzOMhmhuW154RquKbJtSVGIyEhNvAzCQRQkzZgiQvx4Y"
crossorigin="anonymous"></script>Historical v2.0.0 reference
The following hashes were computed from the published v2.0.0 ZIP and verified against the pinned CDN bytes. Keep them paired with v2.0.0 URLs; they do not describe v2.1.1 or unreleased dev builds.
| File | Integrity |
|---|---|
| focus-ui.css | sha384-D7X0gF1+ziNGfdkLmE5yx3ttB7EjaxF+fc6h06iPmNkAu6Pzee/GcgdZzgJRNiWV |
| focus-ui.js | sha384-za2gdEv7hvS5K/vvOFr3K/KkxJijiJqdraUx8/wR1fGKjTYU35HUTTChtx+KTQHo |
| focus-ui.min.js | sha384-XAPpQn2K20UWENWT92uR4+Kk8BN7jgVTWvkfWiOtCoO0MmvlOgj8LBueELLhB/sc |
| focus-ui.esm.js | sha384-9N0/rH8gjpnl2MsrAyyYRV4ZmRqK2iH6BASLiUay6lqbpMiq3NP4yZQw041TtSsV |
Choose the expected hash independently
SRI detects a mismatch against an expected hash; it does not prove the original release is safe. Obtain and review release files through a trusted channel before pinning their hashes. Metadata served by the same CDN is convenient for lookup but is not an independent trust anchor if that CDN is compromised.
The historical v2.0.0 release had a ZIP without SRI.txt at verification. Releases v2.1.0 and v2.1.1 include generated SRI.txt assets, and the CDN versions.json contains SHA-384 integrity fields for published versions. Do not assume every historical release is signed or immutable.
Compute hashes for another release
Download and extract the approved release ZIP, then hash the exact asset bytes. Do not reuse hashes from one version for another version or for latest/.
openssl dgst -sha384 -binary focus-ui.min.js | openssl base64 -A
# Prefix the resulting base64 value with sha384- in the integrity attribute.Diagnose integrity failures
Check the version URL, expected bytes, CORS headers and crossorigin attribute. A changed file requires a new reviewed hash. When an integrity check fails, browsers block the resource; do not remove the check merely to hide the error.
Reference: MDN Subresource Integrity.