fix npe when manifest is ignored
bump guava to 15.0 and globalize
fix wrong manifest tamper logic
eliminate signing logging redundancy