It should definitely require the full hash. And to make it generic...

<script hash="sha-1/fa26be19de6bff93f70bc2308434e4a440bbad02" name="angular.js@1.2.10" src="xxx"></script>

The name attribute would be purely aesthetic, so no reason for a version attribute. SHA-1 is good enough for git content-addressed-storage, it's good enough for browsers.