Repository format/package/Manifest

The Manifest is a file containing checksums for files in the ebuild directory.

A Manifest can be generated by running:

File format
The Manifest2 file is a plain text file. Each line of the file has the following format:

    [  ...]


 * type
 * The type of the particular file. This could be:


 * EBUILD
 * An ebuild file
 * MISC
 * Another file in the ebuild directory
 * AUX
 * A file in the files/ subdirectory
 * DIST
 * A distfile — a file fetched as sources by the ebuild


 * filename
 * The name of the file.


 * size
 * The size of the file as decimal number, in bytes.


 * hash-type
 * The type of hash in the following field.


 * hash
 * The checksum of the file as hexadecimal number, of type specified by .

Hash types
The hashes currently supported by portage are:


 * MD5,
 * SHA1,
 * SHA256 (SHA-2),
 * SHA512 (SHA-2),
 * RMD160 (RIPEMD),
 * WHIRLPOOL.

Until July 4th, 2012, hashes used in the main gentoo-x86 repository were: RMD160, SHA1 and SHA256. On that date the used hashes changed to: SHA1, SHA256 and WHIRLPOOL (source: gentoo-dev-announce: New Manifest hashes).

Thin Manifest
A Thin Manifest is a Manifest file in which checksums are stored only for distfiles (DIST type) and not for files inside the repository. The motivation for that is whenever the repository is fetched through a VCS which ensures local file integrity already.

Thin Manifests are enabled in a repository through thin-manifests entry of layout.conf.

Manifest signing
A Manifest file may contain a PGP signature which can be used to verify the authenticity of hash entries (and thus all files listed in the Manifest). The OpenPGP ASCII armored message format is used for the Manifest file then.

The Manifest signing is enabled by default if portage has a GPG key set. It can be disabled explicitly for a repository through sign-manifests entry of layout.conf.