Several niggles exist with the checksum implementation:

a) both and md5 and sha256 sum must be defined, only one should be required.
b) when reporting a sum failure only one is reported at a time - if an incorrect md5 and sha256 sum are defined the incorrect md5sum will be reported, then once corrected the next invocation will report the incorrect sha256sum
c) it should be possible to define a sum as a parameter of a SRC_URI