The name is not nearly enough. I could serve a jquery-1.11.1.js file that has my own proprietary modifications. A checksum could fix this. However, what about when minified JavaScript is served, as is often the case? What source code corresponds exactly to the "binary" (minified source)? People use different minifiers/uglifiers with different settings. And then there's the issue of minifying all of your source files and then concatenating them into a single file. It's a tough problem.