How to update/rotate SRI Hashes with Azure Appservice?

[Unbuckle]

Hey,
we are running Privatebin in an Azure App Service. After updating the service to the newest Privatebin Version (e.g. updating all the relevant files), the page seems to continuously load. After checking the console, it told me "Failed to find a valid digest in the 'integrity' attribute for resource XYZ with computed SHA-512 integrity". The Wiki told me to update the SRI hashes, but having deployed this as an App service from GitLab I am not quite sure how I can approach this. I am no programmer, so this is above my understanding. Could someone help me out?

[elrido]

If you haven't knowingly changed any of the javascript files yourself (beyond updating) there is no need to generate new SRI hashes. The likely explanation is an issue with your webserver or reverse proxy caching the site (or telling your browser they haven't changed, even though they have). In a normal setup I'd recommend to just restart the various web services, but I have no idea how you'd do that in Azure. I'd recommend searching for the Azure service name and "cache" online to see how to get these flushed.

[Unbuckle]

My question then is, what counts as a "change" that would trigger the SRI Hashes to not digest right? Because I did not just copy every file over. We have our own design on the page, so I was a bit more selective not to mess that up. So the Configuration.php and yourpage.php were not copied over, would not copying these mess up the SRI hashing too?

I just tried flushing the cache (this is done by restarting the app service) however there was no change, still receiving the same error logs. Oh, and also we are not using any proxy for the test app service, so no Cloudflare or other services in the way that could be the reason for this behavior.

Sorry if these questions sound dumb, I am just grasping at straws here.

[rugk]

There are no dumb questions, this place is here for asking questions. So…

My question then is, what counts as a "change" that would trigger the SRI Hashes to not digest right

Well any bit-level change to the .js files. We have actually a lot of FAQ questions on that topic, because many services like to change that files even on-transit.
I also updated to FAQ you probably read to clarify it and add some pointers. The reasons could e.g. be a line ending or an added empty line in an editor like nano.

[Unbuckle]

Okay, thank you! That might have happened during the updating process. I will try to re-hash all the signatures (which is kind of tedious on Windows) and update this thread accordingly if there are still problems. Thanks so far for the help! :)

[rugk]

As said, I'd recommend fixing the root problem, i.e. that your updating process does not break the signatures. If it is Windows, I again can only recommend checking that the line endings are not mangled with.

[Unbuckle]

My updating process is manually copying files/contents. I have no automatic way of doing this yet, during this process I may have changed something. I'd rather try to figure out the SRI Hashing problem for now so I can deploy the new update and figure out the rest later on.

I now rotated each Hash listed in the .php file on my local machine and pushed the new version of the file to git. However when I now load the page it still tells me "None of the “sha512” hashes in the integrity attribute match the content of the subresource." It also still lists the "old" hashes for some reason in the error. The way I rotated the Hashes was to write a small node.js script which newly hashed the files, is this a valid way?

Another error that gets thrown is: "The hash contained in the integrity attribute has the wrong length."

Oh and I also cleared the caches everywhere and used an Incognito-tab, so caching shouldnt be the problem.

[rugk]

The way I rotated the Hashes was to write a small node.js script which newly hashed the files, is this a valid way?

We can hardly debug your node script without you sharing it.

From what i'd say, if you want the really easiest solution, it is probably the second one listed here, i.e. acessing your site in a browser and pasting the code into your developer console:
https://github.com/PrivateBin/PrivateBin/wiki/Development#subresource-integrity-for-javascript-resources

(Though I just tried it and it did not work on privatebin.net? What's wrong there…)

Okay so alternative, as also docu,ented there, just paste the URL to tehn JS files here: https://www.srihash.org/

"The hash contained in the integrity attribute has the wrong length."

Are you sure you choose/used SHA-512 hashes? If not, redo it that way (or change the HTML but well)...

My updating process is manually copying files/contents.

Alternatively, just copy it again and make sure to not change anything like line endings etc.