The shasum file for the war artifact is always called jenkins.war.sha256 no matter what the name of the actual artifact is. Given that ARTIFACTNAME environment variable is overridable, it can happen that the generated war has a different name so this needs to be taken into account.