from: manifest
to: sec
evidence:
 - file: "manifest/mfg_manifest.go"
   contains "    "github.com/apache/mynewt-artifact/sec""