Every bundle carries its own Bundle ID in its Rhizome manifest. The Bundle ID together with the Bundle version uniquely identify an indivisible unit of content in the Rhizome file distribution system.
Every Rhizome manifest is signed using the cryptographic secret key (Rhizome Bundle Secret) that was used to produce the Bundle ID public key. This means that forged manifests can easily be detected because the signature is either missing or does not verify. Only the possessor of the secret key can publish an update to the bundle having the same Bundle ID and a new version number.