Yeah, yuck, this definitely could have been avoided if they did some proper lexing/parsing before dealing with the line, instead of manually separating things apart after matching on the beginning of the string...

That said, perhaps it's just too early in the morning but I don't think that commit introduced the error. The math/logic looks to be identical and I think the bug is `line + strlen("SHA256sum") + 1` which was already there before and doesn't increment past any spaces which might come after the (implied I guess?) colon. Though considering the colon isn't checked for in `SHA256sum`, you could put any character there and it'll work. Yay...