How to calculate/verify SHA-256-Digest from META-INF/*.SF file?
You are trying to verify the APK using the old and outdated JAR signature (aka APK signature scheme v1). This type of signature is outdated for Android as there are some attack scenarios in which a file exists multiple times inside the APK/ZIP file.

Therefore when verifying a APK files you should better rely on the APK signature scheme v2/v3 if present in the APK file. 
The current verification process is documented here: APK signature verification process

The Android SDK comes with a tool called apksigner.jar (can also be used as library in own Java programs) that allows to to verify an APK files using the most recent available method. 

For more details on apksigner and how to use it see this answer:
https://android.stackexchange.com/a/218161/2241