fix: unblock release desktop and universal builds (#1522)

scripts/release/verify-desktop-assets.sh

@@ -34,6 +34,20 @@ if [ ! -d "$ASSETS_DIR" ]; then
   exit 1
 fi
 
+verify_checksum() {
+  local assets_dir="$1"
+  local checksum_file="$2"
+
+  if command -v shasum >/dev/null 2>&1; then
+    (cd "$assets_dir" && shasum -a 256 -c "$checksum_file")
+  elif command -v sha256sum >/dev/null 2>&1; then
+    (cd "$assets_dir" && sha256sum -c "$checksum_file")
+  else
+    echo "Missing checksum tool: need shasum or sha256sum" >&2
+    return 1
+  fi
+}
+
 shopt -s nullglob
 
 for platform in "${REQUIRED_PLATFORMS[@]}"; do
@@ -50,10 +64,7 @@ for platform in "${REQUIRED_PLATFORMS[@]}"; do
       echo "Missing desktop checksum: $checksum_file" >&2
       exit 1
     fi
-    (
-      cd "$ASSETS_DIR"
-      shasum -a 256 -c "$(basename "$checksum_file")" >/dev/null
-    ) || {
+    verify_checksum "$ASSETS_DIR" "$(basename "$checksum_file")" >/dev/null || {
       echo "Checksum verification failed for: $artifact" >&2
       exit 1
     }

scripts/release/write-sha256.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+# Write a SHA-256 checksum file for a release artifact.
+set -euo pipefail
+
+usage() {
+  cat <<'EOF'
+Usage: write-sha256.sh <artifact> [checksum-file]
+
+Writes a checksum file using the portable "<sha256>  <filename>" format. The
+filename in the checksum is always the artifact basename so the file can be
+verified from the artifact directory on Linux, macOS, or Windows runners.
+EOF
+}
+
+if [ "${1:-}" = "-h" ] || [ "${1:-}" = "--help" ]; then
+  usage
+  exit 0
+fi
+
+if [ "$#" -lt 1 ] || [ "$#" -gt 2 ]; then
+  usage >&2
+  exit 2
+fi
+
+artifact="$1"
+checksum_file="${2:-$artifact.sha256}"
+
+if [ ! -f "$artifact" ]; then
+  echo "Missing artifact: $artifact" >&2
+  exit 1
+fi
+
+artifact_dir="$(cd "$(dirname "$artifact")" && pwd -P)"
+artifact_name="$(basename "$artifact")"
+checksum_dir="$(dirname "$checksum_file")"
+mkdir -p "$checksum_dir"
+
+tmp="${checksum_file}.tmp.$$"
+trap 'rm -f "$tmp"' EXIT
+
+if command -v shasum >/dev/null 2>&1; then
+  (cd "$artifact_dir" && shasum -a 256 "$artifact_name") > "$tmp"
+elif command -v sha256sum >/dev/null 2>&1; then
+  (cd "$artifact_dir" && sha256sum "$artifact_name") > "$tmp"
+else
+  echo "Missing checksum tool: need shasum or sha256sum" >&2
+  exit 1
+fi
+
+mv "$tmp" "$checksum_file"
+trap - EXIT