Next try:
rpm -qp --dump qubes-manager-4.3.23-1.fc41.noarch.rpm | sha256sum
bd1de05e5d96b74e445eeef890c585977b6d46e1b1fc262e8bdb1da8da69160d -
This is the same for the local and remote packages.
I also went through all mirrors given in
https://yum.qubes-os.org/r4.3/current/host/fc41/repodata/repomd.xml.metalink
and downloaded qubes-manager-4.3.23-1.fc41.noarch.rpm to check for size and sha256-hash. The files are all the same and not the 3600 byte smaller version.
I’m running out of ideas. Is qubes altering the packages when updating, e.g., unpacking the packages, verifying and then rebuilding them again? In my opinion, this would make no sense.