create manifest with SHA1 checksums