RPM postprocessing can rewrite ELF symbol metadata in already finalized release binaries, making the installed binaries differ from the release tarball. Disable RPM stripping across community and enterprise package specs so packaging preserves the original bytes.

Release package tests now compare the SHA-256 hashes of installed mongod and mongos with the hashes verified against the release archive, before invoking either binary. The checks use the existing provenance eligibility and skip controls. Regression coverage includes modified or missing binaries, incomplete hash sets, Docker transport, and validation order for apt, yum, and zypper.