Disclosed herein is technology to capture and distribute a state of a file system that updates, removes, or adds a computer program to a computing device. An example method may include: analyzing a program package associated with a plurality of objects of a computer program; determining a state of a file system after an installation of the program package; generating a manifest that corresponds to the computer program and represents the state of the file system after the installation, the manifest comprising a hash tree that comprises object identification data of an object of the plurality of objects of the computer program; and providing the manifest to one or more computing devices.