Release Manifest Snapshot Generator

Create a deterministic baseline manifest from a known-good public static release, then feed that manifest directly into Release Integrity & Deployment Auditor for later deployment verification.

Unlike a generic URL hashing tool, this Actor snapshots a set of relative release assets under one base URL and records decoded SHA-256, decoded/transfer sizes, MIME type, content encoding, Cache-Control, CORS, ETag and Last-Modified.

The generated MANIFEST key-value-store record uses the exact schema consumed by Release Integrity Auditor: baseUrl plus path, sha256, size and contentType.

Example input:

{
  "baseUrl": "https://raw.githubusercontent.com/nodejs/node/v22.22.0/",
  "paths": ["LICENSE", "README.md"],
  "releaseId": "node-v22.22.0-snapshot",
  "concurrency": 4,
  "timeoutSecs": 30,
  "maxObjectDecodedMb": 16,
  "maxTotalDecodedMb": 10
}

Safety and limits

Only public HTTP(S) targets are supported. URL credentials, private/reserved addresses, transition/tunnel ranges and unsafe redirects are rejected. Each redirect target is resolved and validated again. The Actor does not accept cookies, arbitrary request headers, login credentials, proxy settings or browser execution.

v0.1 supports at most 100 relative paths and 100 decoded MiB per run. Each asset is capped at 64 decoded MiB. Queries, fragments, absolute paths and traversal in asset paths are rejected.

Pricing

Every run has a $0.00005 start event. A complete successful snapshot then uses one scope-tier event:

• small: up to 20 assets and 10 decoded MiB — $0.005
• medium: up to 100 assets and 100 decoded MiB — $0.020

Incomplete snapshots still return diagnostics but do not emit a successful snapshot event. The Actor checks the run spending limit before fetching assets.

Support

Use the Issues tab on this Actor's Apify page with a run ID and a non-sensitive minimal reproduction. Never post credentials or private URLs.