Chisel Manifest¶

The Chisel manifest is a ZSTD-compressed file which lists the metadata about installed packages, slices and files. The uncompressed file is in the “jsonwall” format - a collection of JSON objects, one-per-line.

When building fine-grained and yet functional root file systems, Chisel creates this manifest as a way for ensuring file-level integrity and trace all the installed package slices, in a format that 3rd party tools (such as SBOM generators and vulnerability scanners) can work with.

Location of the manifest¶

Chisel manifests may be generated anywhere in the newly created root file system. To specify the location, Chisel must be instructed to install a slice where at least one of its contents points to a path with the property generate: manifest.

When such a slice is installed, a manifest.wall file is generated at the specified path. If there are multiple paths of this kind being installed, a manifest will be created in each one of them.

Pre-defined location¶

There is a pre-defined slice named base-files_chisel that is available in all supported Ubuntu releases in the chisel-releases repository .

package: base-files
slices:
  chisel:
    contents:
      /var/lib/chisel/**: {generate: manifest}
  ...

Installing the base-files_chisel slice produces a manifest at /var/lib/chisel/manifest.wall.

Manifest format¶

The uncompressed manifest is a “jsonwall” file. This is a custom database file format where there is one JSON object per line. All JSON objects (except the header) are sorted in a lexicographic order, according to the “kind” of object, to optimize for searching and iterating over the manifest.

Header¶

The “jsonwall” header is a single JSON object on the first line of the file. For example:

{"jsonwall":"1.0","schema":"1.0","count":84}

Where:

Field	Type	Required	Description
`jsonwall`	`string`	Required	Version of jsonwall.
`schema`	`string`	Required	Schema version that Chisel manifest uses.
`count`	`integer`	Required	Number of JSON entries in this file, including the header itself.

Packages¶

For each package installed, a JSON object with "kind":"package" is present in the manifest. For example:

{"kind":"package","name":"hello","version":"2.10-3build1","sha256":"e68cf4365b7aa9c4e2af4af6eee1710d6f967059b7b4af62786e8870d7366333","arch":"amd64"}

Where:

Field	Type	Required	Description
`kind`	`string`	Required	Type of JSON object – must always be `package` for packages.
`name`	`string`	Required	Name of the package.
`version`	`string`	Required	Version of the package.
`sha256`	`string`	Required	Digest of the package (in hex format).
`arch`	`string`	Required	Architecture of the package.

Slices¶

For each slice installed in the file system, a JSON object with "kind":"slice" is present in the manifest. For example:

{"kind":"slice","name":"hello_bins"}

Where:

Field	Type	Required	Description
`kind`	`string`	Required	Type of JSON object – must always be `slice` for slices.
`name`	`string`	Required	Name of the slice, in the `pkg_slice` format.

Paths¶

For each path (file, directory, symlink, etc.) that Chisel installs in the file system, a JSON object with "kind":"path" is present in the manifest. For example:

{"kind":"path","path":"/etc/ssl/certs/ca-certificates.crt","mode":"0