Verify a package

Anyone who receives a closeout package can check that it is exactly what was sent: no file missing, none changed. The first two steps need only Python 3; the third needs ruumica.

Before you start

• The package folder, or its ZIP unpacked into a folder.
• The manifest_sha256 the sender gave you separately.

The examples use a package exported as in Export a closeout package:

$ asbuilt export --project ee-demo --profile ee.default.v1 --frozen-at 2026-01-01T00:00:00Z --out closeout --allow-grid-absent 'ee.*' --allow-unverified-profile
…
manifest_sha256 d0b2a38e6d15840031a1bf30c8defc48c72994c218b2bd569fc0da82c178e3df

Steps

1. Compare the fingerprint of manifest.json with the manifest_sha256 you were given:

   $ sha256sum closeout/manifest.json
   d0b2a38e6d15840031a1bf30c8defc48c72994c218b2bd569fc0da82c178e3df  closeout/manifest.json
   

2. Check every file the manifest lists against its fingerprint:

   $ cd closeout && python3 -I -c 'import hashlib, json; m = json.load(open("manifest.json")); bad = [e["path"] for e in m["entries"] if hashlib.sha256(open(e["path"], "rb").read()).hexdigest() != e["sha256"]]; print(len(m["entries"]) - len(bad), "of", len(m["entries"]), "files match", *bad)'
   13 of 13 files match
   

   A file that does not match is named after the count.

3. With ruumica and the project’s raw files, rebuild every file from the package’s own package.json, without the database. The result must have the same manifest_sha256:

   $ asbuilt export --from-package closeout/package.json --profile ee.default.v1 --out rebuilt --allow-grid-absent 'ee.*' --allow-unverified-profile
   …
   manifest_sha256 d0b2a38e6d15840031a1bf30c8defc48c72994c218b2bd569fc0da82c178e3df
   

Check

Step 1 prints the manifest_sha256 you were given, and step 2 reports every file matching. Then the package is complete and unchanged.

What can go wrong

You see	Meaning	Do
A different fingerprint in step 1	manifest.json is not the one that was sent.	Ask the sender for the package again.
A file named in step 2	That file was changed or damaged.	Ask the sender for the package again.
A different manifest_sha256 in step 3	The rebuild used another profile, another tool version, or different raw files.	Use the profile and tool versions listed in manifest.json.