fix: recompute all sha hashes

.github/workflows/release.yml

@@ -325,6 +325,42 @@ jobs:
           echo "EOF" >> "$GITHUB_OUTPUT"
 
           cp dist-manifest.json "$BUILD_MANIFEST_NAME"
+      # The sha256.sum and dist-manifest.json generated by `dist build --artifacts=global`
+      # use checksums from the per-target dist-manifest.json, which were computed BEFORE
+      # Windows code signing. Since signing changes file contents, those checksums are
+      # stale for Windows artifacts (.zip and .msi). Recompute from the actual files.
+      - name: Recompute checksums for signed artifacts
+        shell: bash
+        run: |
+          cd target/distrib
+
+          # Recompute sha256.sum from actual artifact files
+          if [ -f sha256.sum ]; then
+            : > sha256.sum.new
+            for f in *.tar.gz *.zip *.msi; do
+              if [ -f "$f" ]; then
+                hash=$(sha256sum "$f" | awk '{print $1}')
+                echo "$hash *$f" >> sha256.sum.new
+              fi
+            done
+            mv sha256.sum.new sha256.sum
+            echo "Recomputed sha256.sum:"
+            cat sha256.sum
+          fi
+
+          # Patch dist-manifest.json with correct checksums
+          if [ -f global-dist-manifest.json ]; then
+            for f in *.tar.gz *.zip *.msi; do
+              if [ -f "$f" ]; then
+                hash=$(sha256sum "$f" | awk '{print $1}')
+                jq --arg file "$f" --arg hash "$hash" \
+                  '(.artifacts[$file].checksums.sha256) = $hash' \
+                  global-dist-manifest.json > global-dist-manifest.json.tmp
+                mv global-dist-manifest.json.tmp global-dist-manifest.json
+              fi
+            done
+            echo "Patched checksums in global-dist-manifest.json"
+          fi
       - name: "Upload artifacts"
         uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with: