Use one delivery asset verification pass

internal/delivery/assets.go

@@ -1,10 +1,7 @@
 package delivery
 
 import (
-	"crypto/sha256"
-	"encoding/hex"
 	"fmt"
-	"io"
 	"os"
 	"path/filepath"
 
@@ -53,22 +50,6 @@ func declaredBuildAssets(result internalbuild.Result) ([]gitea.ExpectedAsset, er
 		if !info.Mode().IsRegular() {
 			return nil, fmt.Errorf("build artifact %q is not a regular file", artifact.Filename)
 		}
-		file, err := os.Open(artifact.Path)
-		if err != nil {
-			return nil, fmt.Errorf("open build artifact %q: %w", artifact.Filename, err)
-		}
-		hash := sha256.New()
-		_, copyErr := io.Copy(hash, file)
-		closeErr := file.Close()
-		if copyErr != nil {
-			return nil, fmt.Errorf("hash build artifact %q: %w", artifact.Filename, copyErr)
-		}
-		if closeErr != nil {
-			return nil, fmt.Errorf("close build artifact %q: %w", artifact.Filename, closeErr)
-		}
-		if artifact.SHA256 != hex.EncodeToString(hash.Sum(nil)) {
-			return nil, fmt.Errorf("build artifact %q does not match its declared SHA-256 digest", artifact.Filename)
-		}
 		assets = append(assets, gitea.ExpectedAsset{
 			Filename: artifact.Filename,
 			SHA256:   artifact.SHA256,

internal/delivery/assets_test.go

@@ -47,20 +47,6 @@ func TestDeclaredBuildAssetsGenerateManifestFromBuildResult(t *testing.T) {
 	}
 }
 
-func TestDeclaredBuildAssetsRejectsTamperedArtifact(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "app-v1.2.3-linux-amd64")
-	if err := os.WriteFile(path, []byte("changed bytes"), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	_, err := declaredBuildAssets(internalbuild.Result{
-		Version: "v1.2.3", BinaryName: "app", Targets: []internalbuild.Target{{OS: "linux", Arch: "amd64"}},
-		Artifacts: []internalbuild.Artifact{{Path: path, Filename: filepath.Base(path), Target: internalbuild.Target{OS: "linux", Arch: "amd64"}, SHA256: assetDigest([]byte("original bytes"))}},
-	})
-	if err == nil || !strings.Contains(err.Error(), "SHA-256") {
-		t.Fatalf("declaredBuildAssets() error = %v, want digest mismatch", err)
-	}
-}
-
 func TestDeclaredBuildAssetsRejectsArtifactDeclarationMismatch(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "app-v1.2.3-linux-arm64")
 	contents := []byte("built application")