A build manifest is a record tied to a software build or artifact event. In this context, it is a vendor-specific metric rather than a standard OCI object name. It may represent a completed build, a rebuilt variant, or metadata generated during artifact production. In container supply chains, manifests help describe what was built, which inputs were used, and how the result should be identified or verified.
Build manifests matter because attackers often target the build pipeline, not just the final image. If an adversary can alter source, dependencies, build steps, or signing keys, they can produce a malicious artifact that still looks legitimate. Defenders use manifests alongside signatures, provenance attestations, SBOMs, and digest pinning to prove integrity and trace origin. At scale, a large number of build-manifest events usually signals automation and rapid release flow, but security still depends on trustworthy verification, not on the count itself.