The provided .sha256 files are always hashes of micromamba binaries and never the archives. In other words, micromamba-linux-64.tar.bz2.sha256 is not the sha256sum of micromamba-linux-64.tar.bz2. Relatedly, micromamba-linux-64.sha256 and micromamba-linux-64.tar.bz2.sha256 are identical. Assuming this isn't an artifact of how anaconda.org operates, I think these should be the hashes of the archive files instead of the binaries they contain.