Hash the approved release
After the final export, record the exact filename, byte size, and SHA-256 checksum in your release manifest. Treat any later rename, recompression, or re-export as a new artifact that needs a new checksum.
Keep the manifest beside the approved archive. A checksum copied from an earlier build cannot prove that today’s package is correct.
Download through the buyer path
Use the same public link a buyer will use, allow normal redirects, and save the response as a new file. Check that the response is a download—not an error page with a successful-looking URL.
Compare both byte size and SHA-256 with the manifest. A matching name or file count is useful context, but it is not an integrity check.
Stop on any mismatch
Do not publish or promote a mismatched file. Keep the approved archive unchanged, identify whether the host served an old build or the release was rebuilt, then upload through the platform’s official workflow and verify again.
Record the verification time and public URL without storing buyer data, access tokens, or signed private links in the manifest.