diff --git a/crates/opus/src/celt/mod.rs b/crates/opus/src/celt/mod.rs
index bf2d75e7..3f68641c 100644
--- a/crates/opus/src/celt/mod.rs
+++ b/crates/opus/src/celt/mod.rs
@@ -578,7 +578,7 @@ fn tf_decode(start: usize, end: usize, is_transient: bool, tf_res: &mut [i32; NB
     let mut budget = dec.storage() as i32 * 8;
     let mut tell = dec.tell();
     let mut logp: u32 = if is_transient { 2 } else { 4 };
-    let tf_select_rsv = lm > 0 && tell + logp as i32 < budget;
+    let tf_select_rsv = lm > 0 && tell + (logp as i32) < budget;
     budget -= tf_select_rsv as i32;
     let mut tf_changed = 0;
     let mut curr = 0;
diff --git a/packaging/linux/package.sh b/packaging/linux/package.sh
index 24d427ce..f8b24103 100755
--- a/packaging/linux/package.sh
+++ b/packaging/linux/package.sh
@@ -18,7 +18,10 @@ set -euo pipefail
 . "$(dirname "${BASH_SOURCE[0]}")/../common.sh"
 HERE="$ROOT/packaging/linux"
 APP_ID=ai.storyteller.deckcraft
-CHECKSUM_FMT='%s  %s\n'
+
+verify_sha256() {
+  printf '%s  %s\n' "$1" "$2" | sha256sum -c -
+}
 
 SKIP_BUILD=0
 FORMATS="appimage deb rpm tar"
@@ -138,21 +141,21 @@ if has appimage; then
       download="$TOOL.download"
       curl --proto '=https' -fsSL -o "$download" \
         "https://github.com/AppImage/appimagetool/releases/download/$APPIMAGETOOL_VERSION/appimagetool-$ARCH.AppImage"
-      printf "$CHECKSUM_FMT" "$APPIMAGETOOL_SHA256" "$download" | sha256sum -c -
+      verify_sha256 "$APPIMAGETOOL_SHA256" "$download"
       chmod 755 "$download"
       mv "$download" "$TOOL"
     fi
-    printf "$CHECKSUM_FMT" "$APPIMAGETOOL_SHA256" "$TOOL" | sha256sum -c -
+    verify_sha256 "$APPIMAGETOOL_SHA256" "$TOOL"
   fi
   RUNTIME="$CARGO_TARGET_DIR/appimage-runtime-$APPIMAGE_RUNTIME_VERSION-$ARCH"
   if [[ ! -f "$RUNTIME" ]]; then
     download="$RUNTIME.download"
     curl --proto '=https' -fsSL -o "$download" \
       "https://github.com/AppImage/type2-runtime/releases/download/$APPIMAGE_RUNTIME_VERSION/runtime-$ARCH"
-    printf "$CHECKSUM_FMT" "$APPIMAGE_RUNTIME_SHA256" "$download" | sha256sum -c -
+    verify_sha256 "$APPIMAGE_RUNTIME_SHA256" "$download"
     mv "$download" "$RUNTIME"
   fi
-  printf "$CHECKSUM_FMT" "$APPIMAGE_RUNTIME_SHA256" "$RUNTIME" | sha256sum -c -
+  verify_sha256 "$APPIMAGE_RUNTIME_SHA256" "$RUNTIME"
   # Absolute, because appimagetool runs in $DIST below (CARGO_TARGET_DIR or APPIMAGETOOL may be
   # relative).
   OUT="$(cd "$DIST" && pwd)/$BASENAME.AppImage"