When a new VMware Cloud Foundation (VCF) binary is published for download, its filename, size, and checksum are generated and updated in the VCF manifest files, including productVersionCatalog.json (PVC) and its corresponding signature file, productVersionCatalog.sig.
Whether you use the VCF Download Tool (VCFDT) to download the binaries for a local VCF Offline Depot or the VCF Installer to connect directly to Broadcom's download portal, the manifest file is automatically used to verify that the binaries match their expected checksums, preventing corrupted downloads or, worse, compromised software from being deployed.
For those using the VCFDT, below is a typical folder structure (/PROD/COMP) that is automatically created to store all VCF downloads:



