Fifth Third batch manifest format

A Fifth Third batch manifest is a small, human-readable text file signed with the Fifth Third release key. It is served with every Wednesday drop at /security-whitepaper/manifest/<batch>.txt.

Structure

The manifest is UTF-8, LF line endings, no BOM. Header (four lines), body (one line per module), footer (signature block).

Header

# FifthThirdStore Fifth Third batch manifest
# Batch: v4
# Signed: 2026-08-13T07:00:00Z
# Key fingerprint: 3c:5e:2a:...

Body

photocollage-pro         5.3.14  sha256=... size=18400123
offlinemaps-lite         5.3.09  sha256=... size=22102345
retrocam-mod             5.3.22  sha256=... size=41712349
...

Footer

-----BEGIN FIFTH THIRD SIGNATURE-----
MEUCIQC...===
-----END FIFTH THIRD SIGNATURE-----

Verification

Verify with the public certificate published at /security-whitepaper. The workspace app performs the verification automatically on every fetch and refuses to install a module whose SHA-256 does not match the manifest line.

The manifest is intentionally small and greppable. Automation can consume it directly without a parser.