diff --git a/release.sh b/release.sh
index dfef9083..41d76d6e 100755
--- a/release.sh
+++ b/release.sh
@@ -328,12 +328,18 @@ function get_images_in_yamls() {
   fi
 }
 
+# Finds a checksums file within the given list of artifacts (space delimited)
+# Parameters: $n - artifact files
 function find_checksums_file() {
-  for file in "$@"; do
-    if [[ "${file}" == *"checksums.txt" ]]; then
-      echo "${file}"
-      return 0
-    fi
+  for arg in "$@"; do
+    # kinda dirty hack needed as we pass $ARTIFACTS_TO_PUBLISH in space
+    # delimiter variable, which is vulnerable to all sorts of argument quoting
+    while read -r file; do
+      if [[ "${file}" == *"checksums.txt" ]]; then
+        echo "${file}"
+        return 0
+      fi
+    done < <(echo "$arg" | tr ' ' '\n')
   done
   warning "cannot find checksums file"
 }
diff --git a/test/unit/release_test.go b/test/unit/release_test.go
index c1190c7f..327409fe 100644
--- a/test/unit/release_test.go
+++ b/test/unit/release_test.go
@@ -10,7 +10,9 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func TestRelease(t *testing.T) {
+var CantFindChecksums = warned("cannot find checksums file")
+
+func TestBuildFromSource(t *testing.T) {
 	t.Parallel()
 
 	outChecks := []check{
@@ -31,7 +33,7 @@ func TestRelease(t *testing.T) {
 	tcs := []testCase{{
 		name:    "build_from_source",
 		retcode: retcode(0),
-		stderr:  warned("cannot find checksums file"),
+		stderr:  CantFindChecksums,
 		stdout:  outChecks,
 	}, {
 		name: "build_from_source (with_checksums)",
@@ -60,6 +62,50 @@ func TestRelease(t *testing.T) {
 	}
 }
 
+func TestFindChecksumsFile(t *testing.T) {
+	t.Parallel()
+
+	foundChecksums := lines("/tmp/other/checksums.txt")
+
+	tcs := []testCase{{
+		name:    "find_checksums_file /tmp/file1.out /tmp/file2.out",
+		retcode: retcode(0),
+		stderr:  CantFindChecksums,
+		stdout:  empty(),
+	}, {
+		name:   "find_checksums_file /tmp/file1.out /tmp/other/checksums.txt /tmp/file2.out",
+		stdout: foundChecksums,
+	}, {
+		name: `find_checksums_file "$ARTIFACTS_TO_PUBLISH"`,
+		commands: []string{
+			`export ARTIFACTS_TO_PUBLISH="/tmp/file1.out /tmp/other/checksums.txt /tmp/file2.out"`,
+			`find_checksums_file "$ARTIFACTS_TO_PUBLISH"`,
+		},
+		stdout: foundChecksums,
+	}, {
+		name:    `find_checksums_file "$ARTIFACTS_TO_PUBLISH" # without checksums in artifacts`,
+		retcode: retcode(0),
+		commands: []string{
+			`export ARTIFACTS_TO_PUBLISH="/tmp/file1.out /tmp/file2.out"`,
+			`find_checksums_file "$ARTIFACTS_TO_PUBLISH"`,
+		},
+		stderr: CantFindChecksums,
+		stdout: empty(),
+	}, {
+		name: `find_checksums_file "$ARTIFACTS_TO_PUBLISH" # with double spaces`,
+		commands: []string{
+			`export ARTIFACTS_TO_PUBLISH="/tmp/file1.out  /tmp/other/checksums.txt /tmp/file2.out"`,
+			`find_checksums_file "$ARTIFACTS_TO_PUBLISH"`,
+		},
+		stdout: foundChecksums,
+	}}
+	sc := testReleaseShellScript(loadFile("fake-build-release.bash"))
+	for _, tc := range tcs {
+		tc := tc
+		t.Run(tc.name, tc.test(sc))
+	}
+}
+
 func TestReleaseHelperFunctions(t *testing.T) {
 	t.Parallel()
 	sc := testReleaseShellScript()