Build a local file manifest for creative project handoffs in Python

A developer published a Python script that builds a read-only SHA-256 manifest of a creative project folder, recording each regular file's relative path, byte length and hash as sorted JSON using only the standard library. The script skips symbolic links, reads files in chunks, and halts on unreadable files rather than silently omitting them; the author notes the output should be written outside the scanned folder to avoid capturing its own incomplete output.

A creative project can produce several small files that look almost identical: a source image, exports for different chat placements, a comparison grid, an outfit concept and a song draft. Before handing them off, it helps to know exactly which files you are sending and whether a file changed after review. Disclosure: I build Emote Resizer, Free Image Merger, TryOnSwap and Songifted, which are mentioned as examples below. This article was drafted with AI assistance and is my own educational resource, not an independent review. A manifest lists a file's relative path, byte length and SHA-256 digest. Comparing two manifests helps detect changes in file content; it does not prove the content is correct, licensed, safe, accessible or approved. A hash also does not hide a sensitive file name. Store and share the manifest only with people who may see the file names. creative-project/ sources/ original.png exports/ emote-small.png image-comparison.png outfit-concept.png music/ approved-lyrics.txt preview-audio.mp3 Use only files that belong to the actual project; the names above are examples. Emote exports might come from Emote Resizer https://emoteresize.com/ and a comparison image from Free Image Merger https://freeimagemerger.com/ . A fashion concept can come from TryOnSwap https://tryonswap.com/ , and a lyrics-and-audio gift from Songifted https://songifted.com/ . These tools have different functions, preview terms and prices; a manifest does not change those terms. Keep private or unapproved images out of the folder you plan to share. Save the following as manifest.py . It uses only the Python standard library and reads files without changing them. It skips symbolic links, reads in chunks, and prints sorted relative paths, byte sizes and hashes as JSON. Do not modify files while it runs; like any simple scan, it is not an atomic snapshot. bash /usr/bin/env python3 """Create a read-only SHA-256 inventory of regular files in a project folder.""" import hashlib import json import pathlib import sys def inventory root: pathlib.Path - list dict str, object : records = for path in sorted root.rglob ' ' : if path.is symlink or not path.is file : continue digest = hashlib.sha256 with path.open 'rb' as stream: for chunk in iter lambda: stream.read 1024 1024 , b'' : digest.update chunk records.append {'path': path.relative to root .as posix , 'bytes': path.stat .st size, 'sha256': digest.hexdigest } return records if name == ' main ': if len sys.argv = 2 or not pathlib.Path sys.argv 1 .is dir : raise SystemExit 'Usage: python3 manifest.py PROJECT FOLDER' print json.dumps inventory pathlib.Path sys.argv 1 .resolve , indent=2 Run it from a terminal, replacing the paths with your own: python3 manifest.py /path/to/creative-project /path/outside-project/manifest.json Write the output outside the scanned folder. Shell redirection creates the output file before the script starts; placing it inside the folder can cause the script to include its own incomplete output. If a file cannot be read, the program stops with an error rather than silently omitting it. Correct the permission or remove the file from the handoff folder and run again. path , bytes and sha256 values. Different hashes indicate different bytes; the same hash is a useful integrity check, not a substitute for reviewing content.