Where it sits, relative to the sysroot root. Relative because an absolute path is a fact
about the machine that built it, and two hosts have different ones.
What it came out of, named so that the same manifest can be produced again. A release name
and version rather than a URL, because a URL moves and a release does not.
Where that release was fetched from, which is the field section 13.5 asks for by name.
The URL of the release rather than of the file, because what anybody checking this does is
download the release and look inside it, and because a per file URL would be a claim about
somebody else’s directory layout. It is here in spite of a URL moving and a release not,
which is the reason Input::source exists and is not replaced by this: the two fields
answer what it is and where it was got, and only the first of those is still true in ten
years.