diff -r 571747cb64f4 -r bb51e92ff481 .isurus-ci.yml
--- a/.isurus-ci.yml	Thu Jul 16 10:29:20 2026 -0500
+++ b/.isurus-ci.yml	Sat Jul 18 16:14:50 2026 -0500
@@ -33,8 +33,8 @@
   tag: "$CI_TAG"
   title: "repoman $CI_TAG"
   assets:
-    - dist/*.tar.gz
-    - dist/*.sha256
+    - path: dist/*.tar.gz
+      description: "Linux x86_64 binary bundle — unpack and run ./install.sh (no reefc or make required)"
   secret: ISURUS_RELEASE_TOKEN
   when:
     event: [tag]
diff -r 571747cb64f4 -r bb51e92ff481 scripts/package-binary.sh
--- a/scripts/package-binary.sh	Thu Jul 16 10:29:20 2026 -0500
+++ b/scripts/package-binary.sh	Sat Jul 18 16:14:50 2026 -0500
@@ -4,7 +4,9 @@
 #
 # Produces:
 #   dist/repoman-<version>-linux-amd64.tar.gz
-#   dist/repoman-<version>-linux-amd64.tar.gz.sha256
+#
+# No checksum file: Isurus CI computes and publishes SHA-256/512/MD5 for every
+# release asset automatically.
 #
 # The bundle mirrors a real `make install` tree (bin/ + share/repoman/...) under a
 # usr/local/ prefix, plus a standalone install.sh so end users need no reefc/make.
@@ -66,8 +68,4 @@
 mkdir -p "$dist"
 tar -czf "$dist/$name.tar.gz" -C "$stage" "$name"
 
-# Checksum file references the bare filename so it verifies from inside dist/.
-( cd "$dist" && sha256sum "$name.tar.gz" > "$name.tar.gz.sha256" )
-
 echo "built: $dist/$name.tar.gz"
-cat "$dist/$name.tar.gz.sha256"