I am trying to add subresource integrity hashes for the gtag script that my web application uses. My issue is that no matter what hash I use for SRI, the browser always fails the SRI check for the gtag.
Is there a workaround for this so that I get the safety of SRI for gtag script?
I downloaded the gtag script using curl curl https://www.googletagmanager.com/gtag/js -o gtag.js. I then calculate the sha384 hash using this shasum -b -a 384 gtag.js | awk '{ print $1 }' | xxd -r -p | base64 command
I would expect the hash calculated using the command above to match with the script downloaded from the url.