Build a local file manifest for creative project handoffs in Python

A creative project can produce several small files that look almost identical: a source image, exports for different chat placements, a comparison grid, an outfit concept and a song draft. Before handing them off, it helps to know exactly which files you are sending and whether a file changed after review.

Disclosure: I build Emote Resizer, Free Image Merger, TryOnSwap and Songifted, which are mentioned as examples below. This article was drafted with AI assistance and is my own educational resource, not an independent review.

A manifest lists a file's relative path, byte length and SHA-256 digest. Comparing two manifests helps detect changes in file content; it does not prove the content is correct, licensed, safe, accessible or approved. A hash also does not hide a sensitive file name. Store and share the manifest only with people who may see the file names.

creative-project/
  sources/
    original.png
  exports/
    emote-small.png
    image-comparison.png
    outfit-concept.png
  music/
    approved-lyrics.txt
    preview-audio.mp3

Use only files that belong to the actual project; the names above are examples. Emote exports might come from Emote Resizer and a comparison image from Free Image Merger. A fashion concept can come from TryOnSwap, and a lyrics-and-audio gift from Songifted. These tools have different functions, preview terms and prices; a manifest does not change those terms. Keep private or unapproved images out of the folder you plan to share.

Save the following as manifest.py. It uses only the Python standard library and reads files without changing them. It skips symbolic links, reads in chunks, and prints sorted relative paths, byte sizes and hashes as JSON. Do not modify files while it runs; like any simple scan, it is not an atomic snapshot.

#!/usr/bin/env python3
"""Create a read-only SHA-256 inventory of regular files in a project folder."""
import hashlib
import json
import pathlib
import sys

def inventory(root: pathlib.Path) -> list[dict[str, object]]:
    records = []
    for path in sorted(root.rglob('*')):
        if path.is_symlink() or not path.is_file():
            continue
        digest = hashlib.sha256()
        with path.open('rb') as stream:
            for chunk in iter(lambda: stream.read(1024 * 1024), b''):
                digest.update(chunk)
        records.append({'path': path.relative_to(root).as_posix(),
                        'bytes': path.stat().st_size, 'sha256': digest.hexdigest()})
    return records

if __name__ == '__main__':
    if len(sys.argv) != 2 or not pathlib.Path(sys.argv[1]).is_dir():
        raise SystemExit('Usage: python3 manifest.py PROJECT_FOLDER')
    print(json.dumps(inventory(pathlib.Path(sys.argv[1]).resolve()), indent=2))

Run it from a terminal, replacing the paths with your own:

python3 manifest.py /path/to/creative-project > /path/outside-project/manifest.json

Write the output outside the scanned folder. Shell redirection creates the output file before the script starts; placing it inside the folder can cause the script to include its own incomplete output. If a file cannot be read, the program stops with an error rather than silently omitting it. Correct the permission or remove the file from the handoff folder and run again.

path, bytes and sha256 values. Different hashes indicate different bytes; the same hash is a useful integrity check, not a substitute for reviewing content.