Tracker versioning and Subresource Integrity

How the hosted pa.js tracker is updated, and how to self-host a pinned copy with a Subresource Integrity (SRI) hash when your security policy requires it.

# Tracker versioning and Subresource Integrity

> How the hosted pa.js tracker is updated, and how to self-host a pinned copy with a Subresource Integrity (SRI) hash when your security policy requires it.

## One stable URL

`https://privatusstats.com/js/pa.js` always serves the current tracker. There
are no versioned script URLs and we don't publish hashes for it. Updates
are backwards compatible: attributes, the JavaScript API and the request
format don't change in breaking ways under the same URL. Tracker changes
are listed in the [changelog](/changelog).

## Subresource Integrity (SRI)

SRI pins a script to an exact hash. Because `pa.js` is updated in place,
an `integrity` attribute on the hosted URL would break the tracker at the
next release. If your security policy requires SRI:

1. **Self-host a copy** of `pa.js` from your own domain. It is MIT
   licensed.
2. Compute the hash:

```sh
   curl -s https://privatusstats.com/js/pa.js -o pa.js
   echo "sha384-$(openssl dgst -sha384 -binary pa.js | openssl base64 -A)"
   ```

3. Reference your copy with the hash and point hits at us with
   `data-api`:

```html
   <script defer src="/assets/pa.js"
           integrity="sha384-…" crossorigin="anonymous"
           data-site="pa_YOURSITEID"
           data-api="https://privatusstats.com"></script>
   ```

Modules are loaded from `data-api`, not from your copy's location, and
they are loaded without an `integrity` attribute. So with the setup above,
any module you add in `data-modules` (for example `vitals` or `clicks`)
comes from `https://privatusstats.com/js/` and is not covered by your SRI hash.
If your policy requires every script to be pinned, leave out
`data-modules` or set it to `engage` only (engagement tracking is built
into `pa.js` and loads no extra file).

Your copy doesn't update itself. Download it again and recompute the
hash when you want new tracker features.

Vis som Markdown

One stable URL#

https://privatusstats.com/js/pa.js always serves the current tracker. There are no versioned script URLs and we don't publish hashes for it. Updates are backwards compatible: attributes, the JavaScript API and the request format don't change in breaking ways under the same URL. Tracker changes are listed in the changelog.

Subresource Integrity (SRI)#

SRI pins a script to an exact hash. Because pa.js is updated in place, an integrity attribute on the hosted URL would break the tracker at the next release. If your security policy requires SRI:

Self-host a copy of pa.js from your own domain. It is MIT licensed.
Compute the hash:

   curl -s https://privatusstats.com/js/pa.js -o pa.js
   echo "sha384-$(openssl dgst -sha384 -binary pa.js | openssl base64 -A)"

Reference your copy with the hash and point hits at us with data-api:

html

   <script defer src="/assets/pa.js"
           integrity="sha384-…" crossorigin="anonymous"
           data-site="pa_YOURSITEID"
           data-api="https://privatusstats.com"></script>

Modules are loaded from data-api, not from your copy's location, and they are loaded without an integrity attribute. So with the setup above, any module you add in data-modules (for example vitals or clicks) comes from https://privatusstats.com/js/ and is not covered by your SRI hash. If your policy requires every script to be pinned, leave out data-modules or set it to engage only (engagement tracking is built into pa.js and loads no extra file).

Your copy doesn't update itself. Download it again and recompute the hash when you want new tracker features.