Release manifest reference

Every release ships manifest.json (schema edapack.manifest/1) at the package root and inside each platform tarball. It is the machine-readable record of what went into the build.

Example

{
  "schema": "edapack.manifest/1",
  "package": "verilator-bin",
  "release": {
    "version": "5.038.20260607",
    "tag": "v5.038.20260607",
    "built_at": "2026-06-07T12:00:00Z",
    "trigger": "schedule",
    "recipe_sha": "…"
  },
  "inputs_digest": "sha256:…",
  "inputs": [
    { "name": "verilator", "role": "core", "repo": "https://github.com/verilator/verilator",
      "ref": "master", "resolved_sha": "abc123…", "version": "5.038", "tracked": true },
    { "name": "bitwuzla", "role": "dependency", "repo": "…",
      "ref": "main", "resolved_sha": "def456…", "version": null, "tracked": true }
  ],
  "platforms": [
    { "os": "linux", "arch": "x86_64", "libc": "glibc_2.28",
      "image": "quay.io/pypa/manylinux_2_28_x86_64" }
  ],
  "skills": [
    { "name": "verilator", "version": "5.038", "binaries": ["verilator"] }
  ]
}

Fields

Field	Meaning
package	The tool package, e.g. verilator-bin.
release.version	<core_version>.<YYYYMMDD> — the date component is assigned only when a release is actually published.
release.trigger	schedule, workflow_dispatch, or push.
release.recipe_sha	The tool repo’s commit at build time (folded into the digest).
inputs_digest	sha256:<hex> over tracked inputs + recipe_sha; the change-gate key.
inputs[]	One entry per input: name, role (core/dependency), repo, ref, resolved_sha, version, tracked.
platform / platforms[]	Per-tarball single platform; top-level manifest aggregates all into platforms[].
skills[]	The Agent Skills shipped in the release (mirrors skills/index.json).

The authoritative schema is schemas/manifest.schema.json.

Reading a release’s inputs

gh release download v5.038.20260607 --repo edapack/verilator-bin --pattern manifest.json
jq '.inputs[] | {name, version, resolved_sha}' manifest.json