Function manifest_sha256 

pub fn manifest_sha256(bytes: &[u8]) -> String

Hex sha256 over the raw manifest bytes, used as the supply-chain integrity check. The index pins this value; install recomputes it over the fetched bytes and refuses on mismatch.