site.tar.gz is attested but absent from checksums.txt, so the release manifest no longer covers every asset; wants a deliberate decision rather than a silent gap

site.tar.gz is attested but absent from checksums.txt, so the release manifest no longer covers every asset; wants a deliberate decision rather than a silent gap

Remedy grounds (2026-09-29)

• GoReleaser's default checksum file covers all published binaries, archives, packages and source archives, with extra_files to add more: https://goreleaser.com/customization/checksum/ (consulted 2026-09-29), so full coverage is the common default; the owed ruling decides whether abcd follows it.
• Rejected: rewriting checksums.txt after publication, which would invalidate the attestation already made over it.