I had assumed that the s256 hash in targets.json was the hash of the Image’s manifest file. However having hashed the Images manifest file, this does not appear to be the case. So if not the manifest, then what exactly is getting hashed?
Going to answer my own question here in case anybody else is curious. The sha256 value in the targets.json file is the base64-encoded digest of the image (which is itself a sha256 hash).