We need to be more formal about where we get patches from, and more specifically what version. Let's assume they're also stored in a git repository that we fetch, instead of copying them from "wherever the manifest is". This meshes nicely with splitting between manifest.json and snapshot.json.