Handle nested release evidence checksums

backend/tests/test_rc11_release_package.py

@@ -74,6 +74,9 @@ def test_release_package_signature_and_checksums_fail_closed(tmp_path: Path) ->
     package.mkdir()
     evidence = package / "readiness.txt"
     evidence.write_text("passed\n", encoding="utf-8")
+    nested_checksums = package / "backup" / module.CHECKSUMS_NAME
+    nested_checksums.parent.mkdir()
+    nested_checksums.write_text("backup evidence\n", encoding="utf-8")
     identity = "geointel-release"
     namespace = "geointel-release"
     (package / module.SIGNERS_NAME).write_text(

scripts/build_release_package.py

@@ -114,7 +114,7 @@ def verify_checksums(package_dir: Path) -> None:
     actual_paths = {
         path.relative_to(package_dir).as_posix()
         for path in package_files(package_dir, include_generated=True)
-        if path.name != CHECKSUMS_NAME
+        if path.relative_to(package_dir).as_posix() != CHECKSUMS_NAME
     }
     if expected_paths != actual_paths:
         raise RuntimeError(