The release-integrity manifest records deterministic repository-relative paths, byte sizes, and SHA-256 values for files in the root-deployable package, with its self-exclusion stated explicitly.
When a listed file has the recorded byte size and SHA-256 value, it is byte-identical to the file covered by this packaged release. The manifest also makes unexpected missing or additional package files detectable against its stated scope.
The JSON manifest excludes itself because a file cannot contain its own final cryptographic hash without creating a recursive definition. The transport ZIP is outside the web-root package and is verified separately at handoff.
Package hashes do not prove what is live on a production server, who authored or executed a change, autonomous machine operation, external factual correctness, legal identity or ownership, or the authority of a cited source.
The release identity recorded by the static JSON artifact.
Regular files listed under the release-integrity contract, excluding the manifest itself.
Total bytes represented by the listed files.
Each listed file has one deterministic digest and byte size.
Extract the root package, choose a listed path from release-manifest.json, recompute its byte size and SHA-256 digest, then compare both values with that file's manifest record. On systems with common command-line tools, a single file can be checked with:
wc -c includes/site.php
sha256sum includes/site.phpFor a complete verification, iterate over every object in the manifest's files array, reject duplicate or missing paths, and require both bytes and sha256 to match. Also compare the extracted package's regular-file set against the manifest plus its documented exclusions.
release-manifest.json — Self-exclusion avoids recursive hashing of the manifest’s own final bytes.