Problem
A successful upload response does not prove that the public Release asset contains the intended bytes. R1 required a separate download and SHA-256 comparison before the publication could be treated as complete.
Required change
Release publication tooling must make post-upload verification a mandatory final step.
Acceptance criteria
- The local archive SHA-256 is verified before upload.
- The release tag and target commit are verified before publication.
- After upload, the named asset is downloaded into a fresh temporary directory.
- The downloaded bytes are hashed independently.
- The remote hash must equal the published expected SHA-256.
- Temporary verification files are removed whether verification succeeds or fails.
- The success banner is emitted only after the remote hash matches.
- Existing releases and assets are handled restart-safely without duplicate upload.
- Tests cover missing, duplicate, corrupt, and correctly uploaded assets.
Evidence boundary
The release helper must not recreate, modify, or repackage the source evidence archive.
Problem
A successful upload response does not prove that the public Release asset contains the intended bytes. R1 required a separate download and SHA-256 comparison before the publication could be treated as complete.
Required change
Release publication tooling must make post-upload verification a mandatory final step.
Acceptance criteria
Evidence boundary
The release helper must not recreate, modify, or repackage the source evidence archive.