Fix release hash validation on older Python

scripts/release/generate_updates.py

@@ -38,8 +38,11 @@ def read_packaged_manifest(xpi_path: Path) -> dict:
 
 
 def sha256_digest(xpi_path: Path) -> str:
+    digest = hashlib.sha256()
     with xpi_path.open('rb') as xpi_file:
-        return hashlib.file_digest(xpi_file, 'sha256').hexdigest()
+        for block in iter(lambda: xpi_file.read(1024 * 1024), b''):
+            digest.update(block)
+    return digest.hexdigest()
 
 
 def update_about_plugin_link(xpi_path: Path) -> None:

scripts/release/validate_release.py

@@ -38,6 +38,14 @@ def find_latest_signed_xpi() -> tuple[str, Path]:
     return max(candidates, key=lambda candidate: version_key(candidate[0]))
 
 
+def sha256_digest(xpi_path: Path) -> str:
+    digest = hashlib.sha256()
+    with xpi_path.open('rb') as xpi_file:
+        for block in iter(lambda: xpi_file.read(1024 * 1024), b''):
+            digest.update(block)
+    return digest.hexdigest()
+
+
 def validate_self_update(source_manifest: dict, extension_version: str, xpi_path: Path) -> None:
     gecko_settings = source_manifest.get('browser_specific_settings', {}).get('gecko', {})
     addon_id = gecko_settings.get('id')
@@ -64,8 +72,7 @@ def validate_self_update(source_manifest: dict, extension_version: str, xpi_path
             f'the expected raw signed XPI URL {expected_link!r}'
         )
 
-    with xpi_path.open('rb') as xpi_file:
-        expected_hash = f'sha256:{hashlib.file_digest(xpi_file, "sha256").hexdigest()}'
+    expected_hash = f'sha256:{sha256_digest(xpi_path)}'
     if entry.get('update_hash') != expected_hash:
         fail(
             f'{UPDATES_PATH.relative_to(ROOT)} update_hash {entry.get("update_hash")!r} does not match '