Dear Maintainer,

dput.cf(5) documents a "hash" configuration option, for which "md5" and
"sha" are valid values.  The default is "md5".  When this option is set
to "sha", dput fails with an error:

    $ dput -d local test_0.0.0-1_amd64.changes
    [...]
    D: File to upload: test_0.0.0-1.dsc
    D: Checksum from .changes: 3fb0b53ffd9188eb1115e532c9fcb1f2
    D: Generated Checksum: fd3c230d8450f122bc88cb1b19c05f020e969daa
    Checksum doesn't match for test_0.0.0-1.dsc

This failure is due to an oversight in dput.py.  In the verify_files
function, dput retrieves the hash configuration value and passes it to
checksum_test, which uses the corresponding function from hashlib to
calculate a checksum for a file.  When verify_files tests to see that
the checksum is as expected, it always refers to the "Files" section
of the .changes file.  This section contains only MD5 checksums; the
SHA-1 checksums are in a separate section, "Checksums-Sha1".

I've confirmed that this issue affects Debian 12.7 (dput 1.1.3) and sid
(dput 1.2.2).  I've attached a patch for dput 1.2.2 that fixes the
issue.

Cheers,
Branen

While I was at it, I figured I'd also include a patch to add support for
SHA-256, since .changes files are required to include SHA-256 checksums.
It applies atop my previous patch.

Cheers,
Branen