Build a local file manifest for creative project handoffs in Python

A creative project can produce several small files that look almost identical: a source image, exports for different chat placements, a comparison grid, an outfit concept and a song draft. Before handing them off, it helps to know exactly which files you are sending and whether a file changed after review.

Disclosure: I build Emote Resizer, Free Image Merger, TryOnSwap and Songifted, which are mentioned as examples below. This article was drafted with AI assistance and is my own educational resource, not an independent review.

What a manifest can and cannot do

A manifest lists a file's relative path, byte length and SHA-256 digest. Comparing two manifests helps detect changes in file content; it does not prove the content is correct, licensed, safe, accessible or approved. A hash also does not hide a sensitive file name. Store and share the manifest only with people who may see the file names.

Example folder structure

creative-project/
  sources/
    original.png
  exports/
    emote-small.png
    image-comparison.png
    outfit-concept.png
  music/
    approved-lyrics.txt
    preview-audio.mp3

Use only files that belong to the actual project; the names above are examples. Emote exports might come from Emote Resizer and a comparison image from Free Image Merger. A fashion concept can come from TryOnSwap, and a lyrics-and-audio gift from Songifted. These tools have different functions, preview terms and prices; a manifest does not change those terms. Keep private or unapproved images out of the folder you plan to share.

Generate an inventory locally

Save the following as manifest.py. It uses only the Python standard library and reads files without changing them. It skips symbolic links, reads in chunks, and prints sorted relative paths, byte sizes and hashes as JSON. Do not modify files while it runs; like any simple scan, it is not an atomic snapshot.

#!/usr/bin/env python3
"""Create a read-only SHA-256 inventory of regular files in a project folder."""
import hashlib
import json
import pathlib
import sys


def inventory(root: pathlib.Path) -> list[dict[str, object]]:
    records = []
    for path in sorted(root.rglob('*')):
        if path.is_symlink() or not path.is_file():
            continue
        digest = hashlib.sha256()
        with path.open('rb') as stream:
            for chunk in iter(lambda: stream.read(1024 * 1024), b''):
                digest.update(chunk)
        records.append({'path': path.relative_to(root).as_posix(),
                        'bytes': path.stat().st_size, 'sha256': digest.hexdigest()})
    return records


if __name__ == '__main__':
    if len(sys.argv) != 2 or not pathlib.Path(sys.argv[1]).is_dir():
        raise SystemExit('Usage: python3 manifest.py PROJECT_FOLDER')
    print(json.dumps(inventory(pathlib.Path(sys.argv[1]).resolve()), indent=2))

Run it from a terminal, replacing the paths with your own:

python3 manifest.py /path/to/creative-project > /path/outside-project/manifest.json

Write the output outside the scanned folder. Shell redirection creates the output file before the script starts; placing it inside the folder can cause the script to include its own incomplete output. If a file cannot be read, the program stops with an error rather than silently omitting it. Correct the permission or remove the file from the handoff folder and run again.

Review and compare

1. Open the files in the folder and check names, spelling, dimensions, consent, visual details and playback. Keep an approved reference copy.
2. Generate a manifest after the review. If you later receive or copy the files, generate another manifest from the received folder and compare the path, bytes and sha256 values. Different hashes indicate different bytes; the same hash is a useful integrity check, not a substitute for reviewing content.
3. Keep the source and export separate. Avoid committing sensitive images, lyrics, manifests or private names to a public repository.
4. Check the target service's current specifications and purchase conditions before promising a format or a free download. This sample script does not upload anything or alter product sites.

Comments

[Stefan]

A small compare command would make this handy for the person receiving the files. Show added, missing and changed paths, with the hashes kept in the JSON for reference. If an export is missing from the handoff, I'd want that called out without having to compare two lists by eye.