One file (or archive) a source is built from.
An artifact is either downloadable (it carries a url) or operator-supplied
(an operator has placed it in the cache by hand) -- never both and never
neither, so a manifest cannot describe an artifact the pipeline has no way
to obtain.