Update the packaging recipe or script to ensure that the sha of the artifact being created matches the sha of the corresponding release tag

[drewroengoogle]

Without this protection, it is possible to trigger a packaging build and upload an artifact with a sha that was not tagged as the "official" version. We want to make sure that only the tagged shas are uploaded and released on flutter.dev

[flutter-triage-bot[bot]]

This issue is assigned to @XilaiZhang but has had no recent status updates. Please consider unassigning this issue if it is not going to be addressed in the near future. This allows people to have a clearer picture of what work is actually planned. Thanks!

[flutter-triage-bot[bot]]

This issue was assigned to @XilaiZhang but has had no status updates in a long time. To remove any ambiguity about whether the issue is being worked on, the assignee was removed.