The client code for parsing checksum sections will find the first section, assume that it's SHA1 and then call sha1sum to verify. The file list creator will now make multiple checksum sections, and so at minimum the client should specifically look for the SHA1 section. Better would be to check for multiple different sections and use one of them.