CDNJS supplied integrity attributes (sri hash) is not correct.

[MenaceSan]

The CDNJS supplied sri hash does not match the file.

I use the "Copy SRI hash" button for example on:
https://cdnjs.com/libraries/moment.js
for
https://cdnjs.cloudflare.com/ajax/libs/moment.js/2.29.2/moment.min.js
it gives:
"sha512-Wkxbeuy81yHqZNrMurMURCOCMzkJqaFYnvToublHiOGoVXQ2DS1lOUjKwstbe0GwELrRb9sicdV2y6GiAnVxuw=="

Using
https://www.srihash.org/
gives:
"sha512-/dnQ7rkQ8MP18TeZF3eIsh6WNjju/2SUoSMUX0lhA8yi68GqpesIp4X84EQM+XayllmkC2Dr37uqCAXSgS74rA=="

The www.srihash.org value matches the file. The cdnjs value does not.

[yacine-harbi]

The displayed hash (that is: sha512-Wkxbeuy81yHqZNrMurMURCOCMzkJqaFYnvToublHiOGoVXQ2DS1lOUjKwstbe0GwELrRb9sicdV2y6GiAnVxuw==)
corresponds to the hash of https://momentjs.com/downloads/moment.min.js. The file hosted on cdnjs and the one on momentjs.com are different.

There's no problem with the non minified version.

[MenaceSan]

yes, Thanks for confirming. So CDNJS is hosting a modified or incorrect file. Thats not good. its minified so its a bit hard to inspect but i'll try to inspect it and find the difference. i'm curious now.
update.
its a different version of moment that is the result of a different pass of the minifier. so all the names have changed and the code has some updates as well. with more work. i could figure out which version it actually is i assume.
But it is certainly not the minified version of the file is says it is ? or the orignal site is wrong ? coulf go either way. need more work to figure that out.

[MattIPv4]

👋 We run our own minifier on assets, which should be happening before the SRI hash calculation is performed, but it looks like we have a bug somewhere.

A similar issue is being tracked in #14080

[kierenpitts]

I think this is currently happening for moment.min.js version 2.29.4 too. The SRI reported on CDNJS is:
sha512-CryKbMe7sjSCDPl18jtJI5DR5jtkUWxPXWaLCst6QjH8wxDexfRJic2WRmRXmstr2Y8SxDDWuBO6CQC6IE4KTA==
but the file being delivered via cdnjs has a hash of:
sha512-+H4iLjY3JsKiF2V6N366in5IQHj2uEsGV7Pp/GRcm0fn76aPAk5V8xB6n8fQhhSonTqTXs/klFz4D0GIn6Br9g==

[jpmeijers]

It's a year later and I'm experiencing this same issue.

Failed to find a valid digest in the 'integrity' attribute for resource 'https://cdnjs.cloudflare.com/ajax/libs/moment.js/2.29.4/moment.min.js' with computed SHA-512 integrity '+H4iLjY3JsKiF2V6N366in5IQHj2uEsGV7Pp/GRcm0fn76aPAk5V8xB6n8fQhhSonTqTXs/klFz4D0GIn6Br9g=='. The resource has been blocked.

From https://cdnjs.com/libraries/moment.js the import code should be:

<script src="https://cdnjs.cloudflare.com/ajax/libs/moment.js/2.29.4/moment.min.js" integrity="sha512-CryKbMe7sjSCDPl18jtJI5DR5jtkUWxPXWaLCst6QjH8wxDexfRJic2WRmRXmstr2Y8SxDDWuBO6CQC6IE4KTA==" crossorigin="anonymous" referrerpolicy="no-referrer"></script>

[CyberPunkCodes]

Still happening. I just took the hash from srihash and moved along. Typically not the ideal solution, however I trust CDNJS and that it's just a bug.. that they still haven't fixed.. and not that there is some funky business going on.

@MattIPv4 I would hope the bug has been fixed by now but that someone just didn't update, or re-process, the SRI hash for moment? Worst case it should be a simple database edit to put the correct hash in there.

[bneijt]

Same issue today:
Copied from CDNjs:

<script src="https://cdnjs.cloudflare.com/ajax/libs/moment.js/2.29.4/moment.min.js" integrity="sha512-CryKbMe7sjSCDPl18jtJI5DR5jtkUWxPXWaLCst6QjH8wxDexfRJic2WRmRXmstr2Y8SxDDWuBO6CQC6IE4KTA==" crossorigin="anonymous" referrerpolicy="no-referrer"></script>

and then Firefox fails to load the resource

None of the “sha512” hashes in the integrity attribute match the content of the subresource. The computed hash is “+H4iLjY3JsKiF2V6N366in5IQHj2uEsGV7Pp/GRcm0fn76aPAk5V8xB6n8fQhhSonTqTXs/klFz4D0GIn6Br9g==”.

same for Chrome:

Failed to find a valid digest in the 'integrity' attribute for resource 'https://cdnjs.cloudflare.com/ajax/libs/moment.js/2.29.4/moment.min.js' with computed SHA-512 integrity '+H4iLjY3JsKiF2V6N366in5IQHj2uEsGV7Pp/GRcm0fn76aPAk5V8xB6n8fQhhSonTqTXs/klFz4D0GIn6Br9g=='. The resource has been blocked.

Meanwhile other CDNs are hosting other js files:

<script src="https://cdn.jsdelivr.net/npm/moment@2.29.4/moment.min.js" integrity="sha512-ukcAlrvzygTzyq3b2Tk3eHj/BeixHZgXFA3uFZlOyRGAel1nkRhTvfFKVGUjl0iS/gy3n8TQ8BPar5X0WqmU1A==" crossorigin="anonymous"></script>
<script src="https://unpkg.com/browse/moment@2.29.4/min/moment.min.js" integrity="sha512-jsPn8g8QGm9E/SX0mS18wYF3tP2uoumM5d0BVscQuV1WiXiNf8aoRZSy/5hhe8zCTG2Rmx+rtWoVrHLGinda1g==" crossorigin="anonymous"></script>

I worked around the integrity issue of CDNjs by just updating the hash in the script tag to what is actually being hosted instead:

<script src="https://cdnjs.cloudflare.com/ajax/libs/moment.js/2.29.4/moment.min.js" integrity="sha512-+H4iLjY3JsKiF2V6N366in5IQHj2uEsGV7Pp/GRcm0fn76aPAk5V8xB6n8fQhhSonTqTXs/klFz4D0GIn6Br9g==" crossorigin="anonymous" referrerpolicy="no-referrer"></script>

Update:
There are quite some issues on this, it's not the only library that is impacted. #14210 and #14080
I think Cloudflare still has to decide whether it considers the content of the library immutable or the hash to be immutable ;)