A signed manifest is a cryptographically protected record that describes content and its provenance, such as who created it, what transforms were applied, and which files or payloads it refers to. The signature binds that metadata to a specific signer or key, so any later change to the manifest can be detected.
In cyber security, signed manifests matter because they let systems verify origin and integrity instead of trusting labels alone. They are used in content authenticity frameworks and software supply chains to check whether data was produced by an approved source and whether its history is intact. In practice, defenders may validate the signature before accepting content, while attackers may try to strip, replace, or forge metadata to hide manipulation. A signed manifest is useful evidence, but it is only as strong as key management, implementation quality, and the parts of the pipeline that preserve it.