manifest: add password