When an erratum is pushed to rhn, the rpms, srpms and oval files should all have both md5sums and sha256sums listed. For rpms and srpms these must both be for the rhnPackage/rhnPackageSource and the rhnErrataFile.
Verified on dev